Same username+password as live but login with it locally.

[leitel]

I am staging for an upgrade from 4.1x to 4.2.2.
I pull down db+code, run upgrade, go to login as admin and it rejects credentials.
I compare live/local password+salt for userid=1 and they are the same.

I run the following using the ACTUAL admin password:

UPDATE `user`
SET `password` = MD5(CONCAT(MD5('****'), `user`.`salt`))
WHERE `userid` = 1;

I can now login. HOWEVER, I compare previous/updated password values and they are DIFFERENT!!!!

Is the updated codebase using a different hashing method being used?

What's going on?

Thank You

[kh99]

Originally Posted by leitel

Is the updated codebase using a different hashing method being used?

That is strange, but the hashing algorithm hasn't changed, and if it had your update wouldn't have fixed the problem.

[leitel]

As a precaution, I suppose I can force users to reset their password after this upgrade. The site was hacked a little while back. I slapped on a temporary bandage. So forcing users to reset their password with this upgrade wouldn't be a bad thing.

[ozzy47]

That sounds like a good idea, will ensure you are secure then.

[kh99]

I wonder if it could be a difference in character sets between databases? Forcing users to change password might not be a bad idea, but if you want to figure out why you're having a problem, maybe you could put some test code in includes/functions_login.php, in function verify_authentication, to see what's happening.

[leitel]

Good catch!

Live collation: utf8_unicode_ci

I created local as: utf8_general_ci

Thank you!!

--------------- Added [DATE]1391471124[/DATE] at [TIME]1391471124[/TIME] ---------------

Since we are on the subject, I forget why it was ever set to utf8_unicode_ci. The site is an English language site. Is there a problem with leaving it as utf8_unicode_ci?

[kh99]

Originally Posted by leitel

Since we are on the subject, I forget why it was ever set to utf8_unicode_ci. The site is an English language site. Is there a problem with leaving it as utf8_unicode_ci?

To be honest I don't know. I guess if the site is working then it's best to leave it that way.