Account Password Vulnerability - enhancing it more?

[Skyrider]

Account Password Vulnerability option in vB resets the passwords of those who has found to be vulnerable. It emails you a new password, yay! But is there anyway the password that is going to be send out is more enhanced? More characters, lower/bigger cases and symbols?

The passwords that were send and given by vbulletin though this feature is not that long, and i prefer it to be stronger by default.

[Digital Jedi]

I'm not sure about how to configure that without major(?) code changes, but the new password should only be used temporarily, and immediately changed by the user. Even it it sends them a more complicated one. In fact, the email should probably tell them this, if it doesn't already.

[HM666]

Maybe try this: https://vborg.vbsupport.ru/showthrea...light=password

If that is not what you are looking for then just do a search. Go to the search box at the top of the forum and use the word password as your search term then choose "All Mods" in the first drop down and then choose "Titles only" in the second one. That will give you several results to compare.

[Skyrider]

I saw that, but I'm looking for a way to give everyone a new password (mass force), but I prefer it having a hard password right away also for the inactive users.

[HM666]

Hmmmm I see the built in feature will not work for that either. You would probably nee a special plugin/code for that.

[kh99]

You could edit file includes/functions.php and change the function fetch_random_password(), but that's also used by the mobile api so I don't know what affect that would have. It's also a kind of strange function that generates a string of random characters but seems to have been modified to insert one digit in a random place or something like that.

Or you could edit admincp/passwordcheck.php and where fetch_random_password() is called, substitute your own code. That's where the vulnerable password check happens, if the user requests a change that's done in login.php.

[Skyrider]

Thanks for the hint KH. I've altered the line:

$password_characters = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz';

and I've included some symbols. Seems to work just fine!

However, when I alter:

function fetch_random_password($length = 8)

And change the lenght of the password to 12, doesn't appear to work. It sticks with giving a password length of 8.

[Dave]

That's because in admincp/passwordcheck.php around line 148 it calls the function with the number 8, that has priority over those default values.

[Skyrider]

Originally Posted by Dave

That's because in admincp/passwordcheck.php around line 148 it calls the function with the number 8, that has priority over those default values.

Sweet, thanks! Now I receive awesome passwords now, the way I want it.

Last question though. When resetting a password through recovery (user recovery password), what controls the type of password there that will be send? I am unable to find password_characters under login.php, though I found fetch_random_password.

[kh99]

You should find a call to fetch_random_password(8) in login.php.