Go Back   vb.org Archive > vBulletin 3 Discussion > vB3 General Discussions
  #1  
Old 02-21-2005, 04:14 AM
CMilne CMilne is offline
 
Join Date: Oct 2004
Location: Melbourne, Australia
Posts: 23
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default vBulletin Member Authentication -- Solution for novice coders.

I'm not sure about other people, but I needed this for an integration script I was doing, and it took me three hours to work out. It's just a file that checks is the password a client has entered is their real one, good for member integrations, stick it up with sessions and cookies and you've got yourself a keeper.

It's so hard because it uses a very advanced md5 code and uses a per member encryption system, so password 'jonny' for one account, dosen't result in the same md5 code as th password 'jonny' for another account.

This code is free for all, just wanted to share my discovery.

PHP Code:
<?

// connect to the database
@ $db = mysql_connect('dbhost', 'dbusername', 'dbpassword');
mysql_select_db('dbname');

// magical query #1
$sql = mysql_query("SELECT * FROM user WHERE userid='1'");
$userinfo = mysql_fetch_assoc($sql);

$username    = $HTTP_POST_VARS['username']; // username
$password     = $HTTP_POST_VARS['password']; // password

// magical query #2
$sql = mysql_query("SELECT * FROM user WHERE username='$username'");
$userinfo = mysql_fetch_assoc($sql);
$userrows = mysql_num_rows($sql);

// Convert the password entered into the fancy vBulletin code
$newpassword     = md5(md5($password) . $userinfo['salt']);

$sql2 = mysql_query("SELECT * FROM user WHERE username='$username' and password='$newpassword'");

if (mysql_num_rows($sql2) > 0) {

    echo "You're Registered!";

} else { // Credentials are wrong

    if ($userrows > 0) {
        echo "Wrong Password"; // They ARE Registered, but they entered the wrong password
    } else {
        echo "You aint registered here MATE!";  // They arent registered at your forums
}

?>
This is mainly useful because MD5 encryption is one way making it a million times harder to integrate

Confirmed works in PHP 4.3.10 & 5.0.3
Reply With Quote
  #2  
Old 02-21-2005, 06:18 AM
Marco van Herwaarden Marco van Herwaarden is offline
 
Join Date: Jul 2004
Posts: 25,415
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

You should really change this:
PHP Code:
$username    $HTTP_POST_VARS['username']; // username 
$password     $HTTP_POST_VARS['password']; // password 
into
PHP Code:
$username    addslashes($HTTP_POST_VARS['username']); // username 
$password     addslashes($HTTP_POST_VARS['password']); // password 
to avoid exploits.
Reply With Quote
  #3  
Old 02-22-2005, 08:28 PM
Revan's Avatar
Revan Revan is offline
 
Join Date: Jan 2004
Location: Norway
Posts: 1,671
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

and $HTTP_POST_VARS are deprecated, $_POST does the trick
Reply With Quote
  #4  
Old 02-23-2005, 02:40 AM
Marco van Herwaarden Marco van Herwaarden is offline
 
Join Date: Jul 2004
Posts: 25,415
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default

Quote:
Originally Posted by Revan
and $HTTP_POST_VARS are deprecated, $_POST does the trick
Lol, didn't even see that one

But i am not sure if we will hear again from him.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 02:42 PM.


Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2024, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.06144 seconds
  • Memory Usage 2,189KB
  • Queries Executed 11 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (3)bbcode_php
  • (1)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (4)post_thanks_box
  • (4)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (4)post_thanks_postbit_info
  • (4)postbit
  • (4)postbit_onlinestatus
  • (4)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 

Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete