Making a separate login system

[THE UNCEN]

I'm making a separate login system. Can someone briefly explain to me how the vbulletin system checks passwords?

[Dismounted]

Passwords in the database are hashed like so:

PHP Code:

$password = md5(md5($plaintext) . $salt); 


[THE UNCEN]

What is the $salt formula they use?

[Dismounted]

It is the "salt" field in the database row for the user.

[THE UNCEN]

Thanks!

Next question... what does vbulletin use to create the password stored as the bbpassword cookie?

[Dismounted]

It is the hashed password, along with the "cookie salt" (license number).

PHP Code:

$cookie = md5($password . COOKIE_SALT); 


[THE UNCEN]

Ah, that gets me past that.

Next question... does vbulletin check the password in the DB every time it loads a page? I want to know the work flow vB uses to verify the user.

[ForumsMods]

PHP Code:

function verify_authentication($username, $password, $md5password, $md5password_utf, $cookieuser, $send_cookies)
{
    global $vbulletin;

    $username = strip_blank_ascii($username, ' ');
    if ($vbulletin->userinfo = $vbulletin->db->query_first("SELECT userid, usergroupid, membergroupids, infractiongroupids, username, password, salt FROM " . TABLE_PREFIX . "user WHERE username = '" . $vbulletin->db->escape_string(htmlspecialchars_uni($username)) . "'"))
    {
        if (
            $vbulletin->userinfo['password'] != iif($password AND !$md5password, md5(md5($password) . $vbulletin->userinfo['salt']), '') AND
            $vbulletin->userinfo['password'] != iif($md5password, md5($md5password . $vbulletin->userinfo['salt']), '') AND
            $vbulletin->userinfo['password'] != iif($md5password_utf, md5($md5password_utf . $vbulletin->userinfo['salt']), '')
        )
        {
            $return_value = false;
            ($hook = vBulletinHook::fetch_hook('login_verify_failure_password')) ? eval($hook) : false;
            if (isset($return_value))
            {
                // unset $return_value if you want to run the $send_cookies stuff
                return $return_value;
            }
        }
        else if ($vbulletin->userinfo['password'] == '')
        {
            // sanity check, though there should never really be an empty string for a password
            $return_value = false;
            ($hook = vBulletinHook::fetch_hook('login_verify_failure_password')) ? eval($hook) : false;
            if (isset($return_value))
            {
                // unset $return_value if you want to run the $send_cookies stuff
                return $return_value;
            }
        }

        if ($send_cookies)
        {
            if ($cookieuser)
            {
                vbsetcookie('userid', $vbulletin->userinfo['userid'], true, true, true);
                vbsetcookie('password', md5($vbulletin->userinfo['password'] . COOKIE_SALT), true, true, true);
            }
            else if ($vbulletin->GPC[COOKIE_PREFIX . 'userid'] AND $vbulletin->GPC[COOKIE_PREFIX . 'userid'] != $vbulletin->userinfo['userid'])
            {
                // we have a cookie from a user and we're logging in as
                // a different user and we're not going to store a new cookie,
                // so let's unset the old one
                vbsetcookie('userid', '', true, true, true);
                vbsetcookie('password', '', true, true, true);
            }
        }
        $return_value = true;
        ($hook = vBulletinHook::fetch_hook('login_verify_success')) ? eval($hook) : false;
        return $return_value;
    }

    $return_value = false;
    ($hook = vBulletinHook::fetch_hook('login_verify_failure_username')) ? eval($hook) : false;
    return $return_value;
}