sessionhash and idhash

[marcelk1809]

Where does vb 3.5.1 make the sessionhash and the idhash ???

need to know it, to add sessions of users that visit the site without being in the forums

[Marco van Herwaarden]

this is done in class_core.php.

[monotreme]

Classic example of a glib unhelpful answer.

I KNOW it's done in class_core.php but that code is so forking obtuse and there's so many layers that it takes a couple of HOURS of intense code backtracing to find where the stuff actually originates.

idhash I have discovered.
it comes from SESSION_IDHASH
and to get that you md5 ($_SERVER['HTTP_USER_AGENT'] . $registry->alt_ip);

And if you want to know what alt_ip is you must duplicate the function fetch_alt_ip
which uses optional headers to see if a proxy requester leaked any info about where they really came from. But they are optional. Really sneaky people will turn it all off.

That's a reasonably good way to id people, but if you have a NAT'd group with RFC addys and they all have the same useragent and the same user is logged into several identical stations in a NAT
subnet it might cause trouble so you need the sessionhash.

I'm still working on actually COMPUTING the correct session hash. So far I've found that an alias for it is the 's' variable and that when its inserted in the db it is found in
$vbulletin->session->vars['sessionhash']

Now if I can just figure out how and when that forking thing is computed in the first place I'm home free.

[war_bird]

id hash i have discovered;

$ipadress=getenv("REMOTE_ADDR");
$ses_idhash=md5($_SERVER['HTTP_USER_AGENT'].$ipadress);

[Paul M]

From class_core ;

PHP Code:

function fetch_sessionhash()
{
    return md5(TIMENOW . SCRIPTPATH . SESSION_IDHASH . SESSION_HOST . vbrand(1, 1000000));
} 


Originally Posted by monotreme

I KNOW it's done in class_core.php but that code is so forking obtuse and there's so many layers that it takes a couple of HOURS of intense code backtracing to find where the stuff actually originates.

It took about 5 minutes.

[iansmith]

Anyone figure out the formulea for creating an idhash? The above post (old) is for sessionid which is not the same thing.

I am trying to create a login by adding an entry to the session table from outside vb and the idhash seems to be the sticking point.

[janitor123]

I know that this reply is to a very, very old post but I wanted to put here an answer that I found for others that may be looking for it. This is taken from the DrupalVB module to auto login to Drupal. This module sets cookies for vBulletin to look for.

I am using this module with Drupal 6.17 and vBulletin 3.8.4 PL2

The below is in PHP

$idhash = md5($_SERVER['HTTP_USER_AGENT'] . $vbuser['userid']);
$sessionhash = md5($now . request_uri() . $idhash . $_SERVER['REMOTE_ADDR'] . user_password(6));

[Speysider]

Have you joined to just go around bumping threads?

[aussiev8]

They made it much easier now

PHP Code:

    function fetch_sessionhash()
    {
        return md5(uniqid(microtime(), true));
    }