Echo ing $vbulletin->GPC['vb_login_username']

[LunchBreak]

Hi,

Just wanted to ask a silly question, but not a stupid one of course. "The question that is not asked is the most stupid one".

I am writing a plugins for login integration with vBulletin. For this purpose, I need to do the following.
1) vBulletin tries to login and fails
2) vBulletin fails and tries to check the username and password in my webservice.
3) if vBulletin finds the username and password in my webservice, it creates a new user in vBulletin and logs him.
Upto this stage everything is working fine!

However, when the user tries to login manually later on, he is not authorised. I believe I have traced where the problem is. When I add the user, I do a datamanager setup.

1. $newuser =& datamanager_init('User', $vbulletin, ERRTYPE_ARRAY);
2. $newuser->set('username', $vbulletin->GPC['vb_login_username']);
3. $newuser->set('password', $vbulletin->GPC['vb_login_password']);

Line 3 is not working. I believe $vbulletin->GPC['vb_login_password']) does not carry the actual password value. However, $vbulletin->GPC['vb_login_username']) does carry the username value.

Question:
How can I get the exact password value that was entered in navbar login form? I would like to apply that value in login_failure hook.

Cheers.

[Adrian Schneider]

The raw password isn't actually sent to the form. Upon submitting, it takes the password field, and puts the md5 hash of it into a hidden field ('vb_login_md5_password') and clears the password field.

Take the hashed password (from the form), and set that as the password. vBulletin will then md5($hashedpassword . $usersalt) and set the result as the password in the database.

Edit: If I am reading correctly, you can change the navbar template from

<form action="login.php" method="post" onsubmit="md5hash(vb_login_password, vb_login_md5password, vb_login_md5password_utf, 0)">

to

<form action="login.php" method="post" onsubmit="md5hash(vb_login_password, vb_login_md5password, vb_login_md5password_utf, 1)">

to preserve the actual password. This may open up some security concerns though.

[LunchBreak]

Hi,

I have changed the values as desired. It seems that the integration is working for only the navbar login, since I have changed $show[nopasswordempty] to 1.

However, I want it to work for the permission error that appears during new thread or new post. Where do I need to make the change?

What if I want to change the $show[nopasswordempty] value to 1 globally? What do I need to do?

Cheers,
Kaiser.

[Adrian Schneider]

Create a new plugin using the global_start hook.

PHP Code:

define('DISABLE_PASSWORD_CLEARING', 1); 


[LunchBreak]

wHi I am doing a autologin for users who come from our site. When they come to vBulletin they are not asked for any credentials. I have the userid in my hand. So, this is how I am trying to log the user in.
$newuserid is the userid I already know.

$newsession->set('userid', $newuserid);
$newsession->set('loggedin', 1);
$newsession->set('bypass', 0);
$newsession->set_session_visibility(($vbulletin->superglobal_size['_COOKIE'] > 0));
$vbulletin->session =& $newsession;

I have set it in global_start. It logs the user fine! but the problem is the first time it logs the user in, it does not show the user as logged in on navbar. However, when I refresh the page, shows the user as logged in.

I believe, I am defining the session after the page is loaded.

Question 1:
How can I escape the login redirect and log the user directly in without refreshing?
Question 2:
What does $newsession->set('bypass', 0); do?

It would be of big help if someone could answer my questions ASAP.

Cheers,
Kaiser.