[Shock_CNOP2]

Yes, there's this in the functions_login.php:

PHP Code:

if ($bbuserinfo = $DB_site->query_first("SELECT userid, usergroupid, membergroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE username = '" . addslashes(htmlspecialchars_uni($username)) . "'"))
    {
        if (
            $bbuserinfo['password'] != iif($password AND !$md5password, md5(md5($password) . $bbuserinfo['salt']), '') AND
            $bbuserinfo['password'] != md5($md5password . $bbuserinfo['salt']) AND
            $bbuserinfo['password'] != iif($md5password_utf, md5($md5password_utf . $bbuserinfo['salt']), '')
        )
        {
            return false;
        }
    } 


I'm not sure where the encrypted password variables are coming from, like $md5password and $md5password_utf :ermm: