[kh99]

Originally Posted by nullified

However: is it a bother to block changing the password and email address inside of vBulletin?

I don't think so. I think you can edit template USERCP_SHELL and take out the link to "Edit Email and Password", which looks like this:

<li class="{vb:raw navclass.password}"><a href="profile.php?{vb:raw session.sessionurl}do=editpassword">{vb:rawphrase edit_email_and_password}</a></li>

or I suppose if you wanted to you could change it to link to somewhere else. Also, you'll want a plugin using hook location profile_start that checks for $_REQUEST['do'] == 'editpassword' or $_POST['do'] == 'updatepassword' and does something like print_no_permission().

...if that is the case, would it be possible to simply write the md5 hashs with every synchronization and rely on that fallback to make it smooth for the users

I'm not sure I understand this, but the password stored in the vb database is md5(md5(password) . salt). verify_authentication() is written to accept plain text passwords or md5(password), I think because if a user doesn't have js enabled there's no choice but to send the plain password. You can also define the value DISABLE_PASSWORD_CLEARING (like in the config.php file) so that the plain text password will be sent even if the md5password is also sent (otherwise only one or the other will be filled in).

Also, in case this matters to you - if the user has checked "remember me", the password is saved in a cookie and I don't believe verify_authentication() is called in that case.