MD5 Passwords

[JTek]

Just wanted to say that I found the MD5 hack, and it works great. Thanks guys

[TWTCommish]

How will this addition/modification effect sites integrated with vBulletin? Example: I have a site that checks for the bbuserid/bbpassword cookies and, if they are not detected, prompts them to login if they want to add any comments...will this change effect any such work?

[DarkReaper]

You'll just have to make all checks on the password take encryption into account. For example, on my site, I added a bit to check if their password is encrypted or not, and if it is, encrypt the password they give you and check it against the DB. If not, just compare them like you would normally.

[TWTCommish]

So, rather than "if ($bbuserid) == whatever", I'd have to try "if (md5($bbuserid) == whatever"? Or something like that? I guess that, if I'm just checking for the existence of the cookie, it should still be good?

[DarkReaper]

if(user[usesencryption])
{
if(md5(inputpass) == user[pass])
// you're in
}
else(//they don't use password encrytpion)
{
if(inputpass == user[pass])
//you are in
}

[TWTCommish]

Uh, you mean there's some option in their User CP to allow them to have their password encrypted or not?

[MrLister]

it would be better if there wasn't a option.. i hate it when ppl look at my password

[TWTCommish]

No no, that's not what I mean: the code you posted implied that, at times, the password won't be encrypted.

[DarkReaper]

With the hack/2.0.3 it won't be encrypted at times. With 2.2.0 it'll always be encrypted.

[MrLister]

oh ok i see now