How does VBulletin hash its passwords?

[Siraris]

I am curious how Vbulletin gets its password (is it through MD5 with salt?). The reason I am asking is, I want to have it so that when someone registers on my main site, I insert the account into the vbulletin user table as well, so that they don't have to register twice on my site and the forum as well. I inserted a straight record, and copied the MD5 hash as the PW, but when I entered the PW on vbulletin, it didn't login (even though it did on my main site).

Is this something very difficult to do, and can anyone help me with the process?

Also, so I don't have to post a second thread, how does it do the date in the user table? Under join date, I see this number: 1209845112 which makes no sense to me as to what it represents. I'd like to insert the correct date that they joined as well, and not have to just insert some wacky number each time

[nothing4me]

$hash=MD5(MD5($password)+$salt)

[Siraris]

Originally Posted by nothing4me

$hash=MD5(MD5($password)+$salt)

Thanks for the quick response. Where do I find out what the salt is?

I just tried updating the pw in the db with $hash = md5(md5($pw) + $salt); and I output the hash at the end, and it says 1454ca2270599546dfcd2a3700e4d2f1 but when I look in the DB it says: a3ddf69cbd7d58651119fb5265774ebb...

[cheesegrits]

If you want the currently logged in users salt, that's in $vbulletin->userinfo['salt'].

If you need the salt for some other user, assuming your target user ID is in $userid, this should grab it for you:

$my_userinfo = verify_id('user', $userid, 1, 1);

It'll then be in $my_userinfo['salt'].

-- hugh

--------------- Added [DATE]1209928846[/DATE] at [TIME]1209928846[/TIME] ---------------

I just reread your post, realized you are creating new users, so my response above doesn't help much.

Are you using the user datamanager, or trying to do it by steam yourself?

You might want to take a look at the code for 'addmember' in register.php, which shows how to use the datamanager to do this stuff.

If you still want to do it by steam, for a new user you just need to generate a 3 character salt randomly ...

PHP Code:

        for ($i = 0; $i < 3; $i++)
        {
            $salt .= chr(rand(33, 126));
        } 


The date you asked about is a simple UNIX style "seconds since epoch", as per:

http://www.php.net/time

-- hugh

[ssslippy]

Why dont u just redirect the user to the vbulletin register page? This would be 200x easier.

[cheesegrits]

Like it says in the original post ... "so that they don't have to register twice on my site and the forum as well".

It's not hard doing the initial registration automatically. The hard part is keeping the two accounts syncronized when the user starts changing passwords, but that's another story!

-- hugh

[ssslippy]

Then intergrating the front page system he is using to the forum system would be easier and more effecient.

[cheesegrits]

Erm ... that's what he's trying to do ... and unless he's using something like Joomla for which commercial bridges for vB exist, he doesn't have much choice but to roll his own.

-- hugh

[ssslippy]

Then he is doing it the wrong way, he should just be using the vbulletin cookie system. Duplicating information back and forth across 2 database's can be a very nasty thing and cause alot of issues.

What happens if someone registers in his forums? It wont work on the main page?

[Siraris]

OK, after doing a lot of thinking, I definitely need to integrate the two, let me post my thoughts and maybe someone can help me sort them out and tell me the right direction to go. This is my first time ever using VBulletin as an admin, and it's a bit overwhelming. I hope my post here makes sense, I'm a big discombobulated.

I have a user register on my site, I collect the Username, pass, zipcode, gender, birthday, and that's it. I can then insert that data into the VBulletin forum.user table - although for some reason, I think I am still doing the PW generation incorrectly (I still can't find the salt that VBulletin uses to generate the password, and in the DB it has something like *4e for when I registered) - and insert it into my tblUser database as well.

Is this stupid? Should I just use the VBulletin user database? If I do that, can I just add on my own columns on there, and then replace any reference to my tblUser in my code to the vbulletins user db?

If I do that, and just use the vbulletin user DB, then everything is solved. If a user changes his PW, it is reflected on both my site and the forum without any messing around.

The thing I'm most worried about is messing with VBulletins code and breaking everything, since I don't know how exactly their system is designed, and I am much better at working with code I wrote than other peoples code.

Anyways, if I don't just move all my data over to their DB, and continue to use mine and theirs, it could turn out to be a nightmare, at least in my thinking.

The only other issue there is, when they login on the main site, they will need to be logging in to the messageboard, correct? At that point, it will create the necessary cookies for Vbulletin, and I can also reflect it in my session variables in my login script. Can I have it so that it logs in with my user forum, posts to the message board, logs in, and redirects back to my front page?

If so, that should be everything. Taking into that I am thinking about this as me putting all my data into the VBulletin user table, and using that for both sections, any change of a PW will reflect on both sites, it will register on my site, it will login through VBulletin, create all the necessary cookie data for vbulletin, then go back to my site where I will use the userID in the VBulletin cookie to get the data I need from my site, and complete the login.

Please help!