external login - logouthash

[30et]

Hi there

I have created a simple script that is a login form for vbulletin 4.

I was using the variables available when including global.php but this didn't work on some of my pages as I couldn't set the include directory since it was already set by another CMS system. eg chdir($_SERVER['DOCUMENT_ROOT'] . '/forums');

So instead I manually connected to the vb database and got the session and user details. The only thing I can't get is the logouthash variable.

logouthash is defined in the /includes/functions.php -

PHP Code:

    $user['securitytoken_raw'] = sha1($user['userid'] . sha1($user['salt']) . sha1(COOKIE_SALT));
    $user['securitytoken'] = TIMENOW . '-' . sha1(TIMENOW . $user['securitytoken_raw']);

    $user['logouthash'] =& $user['securitytoken']; 


I can get the userid and salt from the database and I can define COOKIE_SALT myself to match whats in /includes/functions.php but the variable that is difficult is TIMENOW.

Is TIMENOW the same as time()?

I find if I echo TIMENOW its not the same as time() and it changes all the time?

How should I define TIMENOW or is there a better way to do this whole thing?

[ForumsMods]

You are right. TIMENOW is time()

PHP Code:

define('TIMENOW', time()); 


[30et]

Thanks for that. I got it working. Here is the code in case it can help others -

PHP Code:

// connect to db
include $_SERVER['DOCUMENT_ROOT'] . '/forums/includes/config.php';
$DB_SERVER = $config['MasterServer']['servername']; ///mysql server
$DB_LOGIN =  $config['MasterServer']['username']; /// Database Login - You have to give login name for DB
$DB_PASSWORD = $config['MasterServer']['password']; /// Database Password
$DB_DATABASE = $config['Database']['dbname']; ////Database name
$DB_PREFIX = $config['Database']['tableprefix'];
$vip_con=mysql_connect ($DB_SERVER, $DB_LOGIN, $DB_PASSWORD) or die ('Cannot connect to the database.');
mysql_select_db ($DB_DATABASE);

// get if logged in from db
$vip_sql = "SELECT s.loggedin, u.username, u.userid, u.salt FROM " . $DB_PREFIX .  "session s INNER JOIN " . $DB_PREFIX .  "user u ON s.userid = u.userid WHERE sessionhash = '" . $_COOKIE['bb_sessionhash'] . "'"  ;
$vip_result = mysql_query($vip_sql) or die ('query not working'.mysql_error());
$row = mysql_fetch_array( $vip_result );
$vip_loggedin = $row['loggedin'];
$vip_username = $row['username'];
$TIMENOW = time();
$vip_cookie_salt = 'Cc26QdsovANkeY3pRPt36wERQP'; // this is copied from forums/includes/functions.php
 
// create logouthash 
$vip_securitytoken_raw = sha1($row['userid'] . sha1($row['salt']) . sha1($vip_cookie_salt));
$vip_securitytoken = $TIMENOW . '-' . sha1($TIMENOW . $vip_securitytoken_raw);

$vip_logouthash =& $vip_securitytoken;

// close db connection
mysql_close($vip_con);



if ($vip_loggedin!=0) {
?>
<p>You're logged in as <b><?php  echo $vip_username; ?></b></p>
<a class="more_info" href="/forums/login.php?<?php echo $session[sessionurl]; ?>do=logout&amp;logouthash=<?php echo $vip_logouthash; ?>">Log Out</a>

--------------- Added [DATE]1275978418[/DATE] at [TIME]1275978418[/TIME] ---------------

Oh yeah I should mention if you've got other db connections open you might need to do this to seperate the vb db connection.
Change

PHP Code:

$vip_con=mysql_connect ($DB_SERVER, $DB_LOGIN, $DB_PASSWORD) or die ('Cannot connect to the database.');
mysql_select_db ($DB_DATABASE); 


to

PHP Code:

$vip_con=mysql_connect ($DB_SERVER, $DB_LOGIN, $DB_PASSWORD, true) or die ('Cannot connect to the database.');
mysql_select_db ($DB_DATABASE, $vip_con); 


[brandondrury]

Works great, dude! Thanks. You saved me a days work trying to figure out the login code myself.

Just for corrections sake, I did have to add this to bottom to complete the final if statement:

PHP Code:

<?php } ?>

Now I just need to figure out how to snag the user variables I need from the database. I guess I can do it the old-fashioned way, but I was really hoping that good ol' this would work:

PHP Code:

$userid=$vbulletin->userinfo['userid'];
$usergroup=$vbulletin->userinfo['usergroupid'];
$membergroupids= $vbulletin->userinfo['membergroupids']; 


The jury is still out.