[scoopr]

I was pleased to find amatulic's class.forumops.php as that was exactly what I needed, excellent work!

However, I found the user login part of it acting a bit weird.

PHP Code:

   function login($vbuser)
   {
      global $vbulletin;
      $vbulletin->userinfo = fetch_userinfo_from_username($vbuser['username']);
      // set cookies
      vbsetcookie('userid', $vbulletin->userinfo['userid'],
         PERMANENT_COOKIE, true, true);
      vbsetcookie('password',
         md5($vbulletin->userinfo['password'].COOKIE_SALT),
         PERMANENT_COOKIE, true, true);
      // create session stuff
      process_new_login('', 1, '');
   } 


If you look at the function, it does not use the $vbuser['password'] value at any point! This means, if you use this login function in some page, it logs in successfully any user no matter what she supplied as her password!

You might need forcing successful login when you have custom user database you check against yourself and want to ignore vbulletin user database and still be logged in to vbulletin, but in my eyes, the class implied it actually checked against the vb user database (the comments have an example where it supplied the password).

I replaced the login method as follows, now it returns true when the login is successfully, false otherwise. I'm not totally sure if the md5 passwords are totally correct here, but seem to work in my quick test.

PHP Code:

   function login($vbuser)
   {

        return verify_authentication($vbuser['username'], 
                                   $vbuser['password'], 
                                   md5(htmlentities($vbuser['password'], ENT_NOQUOTES, "UTF-8")), 
                                   md5($vbuser['password']), 
                                   1, true);

   } 


Feel free to comment if I had misunderstood something, but I felt it would be important bring this issue up, if someone else uses this class as a login method assuming the same thing as I did.

Oh, and this skips the userdata conversion part, as I felt it was a bit pointless in this context.