vBulletin SHA1 Workaround?

[Marco van Herwaarden]

No you got the function of this constant wrong. When set vBulletin will still sent the hashed password to the server, and will still do the password check on the hashed password. It will however also sent the unencrypted password in a seperate variable to the server to be processed on the server side. (Normal the unencrypted password is not sent over the network to the server but stripped on the client side).

[agallian86]

Originally Posted by Marco van Herwaarden

It will however also sent the unencrypted password in a seperate variable to the server to be processed on the server side.

I see. So, what exactly do I need to do on the db server side?

Is there a location these seemingly undocumented things are...documented?

Thanks guys.

[Marco van Herwaarden]

Hmm what you COULD do:
- Check if the MD5 password matches
- If not encrypt the unencrypted password with SHA1, and check the password. If it is a match, re-hash the unencrypted password with MD5 and write to the database so the next attempt will match the normal MD5 hash vBulletin uses.

After some time most SHA1 hashed passwords should be gone.

[agallian86]

Originally Posted by Marco van Herwaarden

Hmm what you COULD do:
- Check if the MD5 password matches
- If not encrypt the unencrypted password with SHA1, and check the password. If it is a match, re-hash the unencrypted password with MD5 and write to the database so the next attempt will match the normal MD5 hash vBulletin uses.

After some time most SHA1 hashed passwords should be gone.

That's actually the plan.

The only thing is, I'm not sure how to actually implement it.

Any ideas?

[Muppettt]

I am also interested in how to check if the md5 passwords match for a script i am currently working on

https://vborg.vbsupport.ru/showthread.php?t=151787

[agallian86]

Well thanks for the hijacking, someone would've seen your thread.

Alas, I have a feeling if any progress is made for either one of our causes it'll be helpful to the other.

[Marco van Herwaarden]

To get assistence in coding these plugins, please post in Programming Discussions

[Muppettt]

Originally Posted by agallian86

Well thanks for the hijacking, someone would've seen your thread.

Alas, I have a feeling if any progress is made for either one of our causes it'll be helpful to the other.

They may of seen it but failed to give any reasonable answer/explaination as usual.