How to login an user from an external script?

[fabrizio]

Hello,
I'd like to be able to login users automatically on vBulletin from my own PHP scripts. Is that possible?

Thank you in advance for any help.

Sincerely,
Fab.

Anyone can help me?

Thank you.

Fabrizio.

[Aesma Deva]

You could try sending the username and the password to VB's login page, like this:

<form action="http://www.yoursite.com/path_to_forums/login.php" method="post">
<input type="hidden" name="do" value="login" />
<input type="hidden" name="vb_login_md5password" />
<input type="hidden" name="vb_login_md5password_utf" />
Username: <input type="text" name="vb_login_username" /><br />
Password: <input type="password" name="vb_login_password" /><br />
Remember me: <input type="checkbox" name="cookieuser" /><br />
<input type="submit" value="Log in" />
</form>

[fabrizio]

Thank you for your reply. Actually I asked to know the actual PHP code for login, but I was able to figure it out myself from the login.php script of vBulletin...

Thank you anyway!

Sincerely,
Fabrizio

[bfc]

Great now can those of us who do not know how to use php that well know how you did it?

[fabrizio]

Yes, of course, I must apologize... here i the code I created myself, you can adapt it on your own system:

$vb_login_username = $username1;
$vb_login_password = $pw;
$tempo = time();

#Define $scriptpath
if ($_ENV['REQUEST_URI'] OR $_SERVER['REQUEST_URI'])
{
	$scriptpath = $_SERVER['REQUEST_URI'] ? $_SERVER['REQUEST_URI'] : $_ENV['REQUEST_URI'];
}
else
{
	if ($_ENV['PATH_INFO'] OR $_SERVER['PATH_INFO'])
	{
		$scriptpath = $_SERVER['PATH_INFO'] ? $_SERVER['PATH_INFO']: $_ENV['PATH_INFO'];
	}
	else if ($_ENV['REDIRECT_URL'] OR $_SERVER['REDIRECT_URL'])
	{
		$scriptpath = $_SERVER['REDIRECT_URL'] ? $_SERVER['REDIRECT_URL']: $_ENV['REDIRECT_URL'];
	}
	else
	{
		$scriptpath = $_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_ENV['PHP_SELF'];
	}

	if ($_ENV['QUERY_STRING'] OR $_SERVER['QUERY_STRING'])
	{
		$scriptpath .= '?' . ($_SERVER['QUERY_STRING'] ? $_SERVER['QUERY_STRING'] : $_ENV['QUERY_STRING']);
	}
}

$scriptpath = preg_replace('/(s|sessionhash)=[a-z0-9]{32}?&?/', '', $scriptpath);
$find = array('"', '<', '>');
$replace = array('&quot;', '&lt;', '&gt;');
$scriptpath = preg_replace('/javascript/i', 'java script', $scriptpath);
$scriptpath = str_replace($find, $replace, $var);

#Define ALT_IP
if ($_SERVER['HTTP_CLIENT_IP'])
{
	define('ALT_IP', $_SERVER['HTTP_CLIENT_IP']);
}
else if ($_SERVER['HTTP_X_FORWARDED_FOR'] AND preg_match_all('#\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}#s', $_SERVER['HTTP_X_FORWARDED_FOR'], $matches))
{
	// make sure we dont pick up an internal IP defined by RFC1918
	foreach ($matches[0] AS $ip)
	{
		if (!preg_match("#^(10|172\.16|192\.168)\.#", $ip))
		{
			define('ALT_IP', $ip);
			break;
		}
	}
}
else if ($_SERVER['HTTP_FROM'])
{
	define('ALT_IP', $_SERVER['HTTP_FROM']);
}
else
{
	define('ALT_IP', $_SERVER['REMOTE_ADDR']);
}

#Define SESSION_IDHASH e altri...
define('SESSION_IDHASH', md5($_SERVER['HTTP_USER_AGENT'] . ALT_IP ));
define('IPADDRESS', $_SERVER['REMOTE_ADDR']);		
define('SESSION_HOST', substr(IPADDRESS, 0, 15));

function vbrandFABRI($min, $max, $seed = -1)
{

	if (!defined('RAND_SEEDED'))
	{
		if ($seed == -1)
		{
			$seed = (double) microtime() * 1000000;
		}

		mt_srand($seed);
		define('RAND_SEEDED', true);
	}

	return mt_rand($min, $max);
}

function iifFABRI($expression, $returntrue, $returnfalse = '')
{
	return ($expression ? $returntrue : $returnfalse);
}



// can the user login?

$username = &$vb_login_username;
$password = &$vb_login_password;
$md5password = &$vb_login_md5password;
$md5password_utf = &$vb_login_md5password_utf;

$sessionFABRI = array(
'sessionhash' => md5($tempo.$scriptpath.SESSION_IDHASH.SESSION_HOST.vbrandFABRI(1, 1000000)),
'userid' => intval($userid),
'host' => SESSION_HOST,
'idhash' => SESSION_IDHASH,
'lastactivity' => $tempo,
'location' => $scriptpath,
'styleid' => 0,
'useragent' => $_SERVER['HTTP_USER_AGENT'],
'loggedin' => 0
);

$sessionFABRI['dbsessionhash'] = $sessionFABRI['sessionhash'];

#Main procedure...


$queryZZ1 = "DELETE FROM vb3_session WHERE sessionhash = '" . addslashes($sessionFABRI['dbsessionhash']) . "'";
$resultZZ1 = @mysql_query($queryZZ1);

$sessionFABRI['sessionhash'] = md5($tempo.$scriptpath.SESSION_IDHASH.SESSION_HOST.vbrandFABRI(1, 1000000));
$sessionFABRI['dbsessionhash'] = $sessionFABRI['sessionhash'];







$queryZZ2 = "INSERT INTO vb3_session
		(sessionhash, userid, host, idhash, lastactivity, styleid, loggedin, bypass, useragent)
	VALUES
		('" . addslashes($sessionFABRI['sessionhash']) . "', " . intval($userid) . ", '" . addslashes(SESSION_HOST) . "', '" . addslashes(SESSION_IDHASH) . "', " . $tempo . ", $sessionFABRI[styleid], 1, " . iifFABRI ($logintype === 'cplogin', 1, 0) . ", '" . addslashes($_SERVER['HTTP_USER_AGENT']) . "')";
$resultZZ2 = @mysql_query($queryZZ2);

setcookie('bbsessionhash', $sessionFABRI['sessionhash'], 0,'/');

#Set cookies

setcookie('bbuserid', $userid, time()+60*60*24*365,'/');
setcookie('bbpassword', md5($password1 . 'L489612f'), time()+60*60*24*365,'/');

[wcm]

Digging up a zombie here...

This code worked perfectly with 3.6.1. I recently upgraded to 3.6.5 and now it does not. Has anything in the way login/cookie/session works been changed with the recent patches? If so, how?

[hotmasala4u]

yea i also wanna know how to make the same usernames/passwords as vb to work on other pages. please help me

[ricc]

I have the same problem and asked on other websites, but no-one seems to know how to login a user onto another non-vb page using their details in the vb forum

[Wizardjv]

Well an easy way to do this would be...

<?php

require('./global.php');   ?>

Though if you move the page outside of the forum you would have to edit the location of global.php

Then add a if statement

<? 
if (!is_member_of($vbulletin->userinfo, 6)  AND !is_member_of($vbulletin->userinfo, 13)  AND !is_member_of($vbulletin->userinfo, 5))
{
    print_no_permission();
}  
?>

This way only those user groups you define that can view the custom page can see it. Also if they are not signed in they will have to login via the vbulletin login system to see the page


Though this is a lil different than adding a login form. But should work.If want everyone to see it and login. Just add an

AND !is_member_of($vbulletin->userinfo, 5)

for everyone.

By the way you would add this at the top of the page

[ricc]

Originally Posted by hotmasala4u

yea i also wanna know how to make the same usernames/passwords as vb to work on other pages. please help me

I had help on a similar problem in this thread, hope it helps

https://vborg.vbsupport.ru/showthread.php?t=146089