Automatically login to vbb

[WeBBy]

If you want to know how....

I use a access_user_class on several sites because it is readily customizable and offers a high degree of security (http://www.finalwebsites.com/snippets.php?id=10).

1. As part of the registration for the general user-class login, I added an automatic vbb account as follows:

 //Create Randon Salt 4 password
	function gen_salt($length = '3')
    {
    $salt = "";
    $possible = "abcdefghjklmnpqrstuvwxyzABCDEFGHJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_-+=[]{}\/.,?<>~";
    $i = 0;
    while($i < $length)
        {
        $char = substr($possible, mt_rand(0, strlen($possible) - 1), 1);
        $salt .= $char;
        $i++;
        }

    return $salt;
    }  
//generate encrypted password
	$mysalt = gen_salt();
	$vbbpasswd = md5(md5($_POST[password]).$mysalt);
//Add to vbb user table
$db = mysql_connect("localhost", "username", "userpass") or die ("Cannot connect to MySQL");
mysql_select_db("dbname",$db) or die ('Cannot Connect to Forum Database');
$query = "insert into user (usergroupid, username, password, email, usertitle, ipaddress, salt) values ('2', '$_POST[username]',  '$vbbpasswd',  '$_POST[email]',  'Title',  '$ip', '$mysalt')";
$result = mysql_query($query,$db) or die ("Cannot update Discussion Forum Database");

VBB User Account Created

2. Stripped out the login from vbb login.php and saved it as vbblogin.php:

<?
// ############################### start vbb login ###############################

$curdir = getcwd ();
chdir('/path/to/forum');
$_POST[vb_login_username] = $_GET[user];
$_POST[vb_login_password] = $_GET[mempass];
$_POST[cookieuser] = "1";

require_once('/path/to/forum/global.php');
require_once('/path/to/forum/includes/functions_login.php');
	$vbulletin->input->clean_array_gpc('p', array(
		'vb_login_username'        => TYPE_STR,
		'vb_login_password'        => TYPE_STR,
		'vb_login_md5password'     => TYPE_STR,
		'vb_login_md5password_utf' => TYPE_STR,
		'postvars'                 => TYPE_BINARY,
		'cookieuser'               => TYPE_BOOL,
		'logintype'                => TYPE_STR,
		'cssprefs'                 => TYPE_STR,
	));
	// can the user login?
	$strikes = verify_strike_status($vbulletin->GPC['vb_login_username']);
	// make sure our user info stays as whoever we were (for example, we might be logged in via cookies already)
	$original_userinfo = $vbulletin->userinfo;
	if (!verify_authentication($vbulletin->GPC['vb_login_username'], $vbulletin->GPC['vb_login_password'], $vbulletin->GPC['vb_login_md5password'], $vbulletin->GPC['vb_login_md5password_utf'], $vbulletin->GPC['cookieuser'], true))
	{
		($hook = vBulletinHook::fetch_hook('login_failure')) ? eval($hook) : false;
		// check password
		exec_strike_user($vbulletin->userinfo['username']);
		$vbulletin->userinfo = $original_userinfo;
			}
	exec_unstrike_user($vbulletin->GPC['vb_login_username']);
	// create new session
	process_new_login($vbulletin->GPC['logintype'], $vbulletin->GPC['cookieuser'], $vbulletin->GPC['cssprefs']);
	// do redirect
	exec_header_redirect($vbulletin->options['forumhome'] . '.php');
?>

Notice the:

$_POST[vb_login_username] = $_GET[user];
$_POST[vb_login_password] = $_GET[mempass];
$_POST[cookieuser] = "1";

at the top of the page. Will explain that later.

3. Now to login, I located the login and cookie functions of the access_user_class.php that performn the login/cookie which happens to be the function set_user().

I tried an include, but the scripting in vbblogin.php and access_user_class.php were in conflict and to take the cheap and easy way out (easier than fixing the conflicts), I used a Location to drive the vbb login:

//define username-password of access_user_class
		$user = $this->user;
		$mempass = $this->user_pw;
//Send it to vbblogin as a GET
		header("Location: http://www.mysite.com/forum/mystuff/vbblogin.php?user=$user&mempass=$mempass");

Probably not the best way to do it, but it works and accomplishes what I wanted. Because I am now using a GET and vbb is using a POST, I redefined the POST values to the GET values. The $user and $mempass are from the user_class but could be replaced with the original post[] command in the login form

I also changed the login form in the narbar template to the user_class login, added the user_class to the top of headinclude, changed logout to the user_class (rather than vbb), added a few plug-ins to deal with a few issues.

As I said, probably not the best way, but it works and probably can be applicable to a host of different external registration/login schemes.

Hope it helps someone