0

I am trying to incorporate the Php121 Messenger into an existing website. The website uses usercake accounts.

It does not recognize password because the type of md5 encryption for the password.

Usercake uses this type of encryption

function generateHash($plainText, $salt = null)
{
if ($salt === null)
{
    $salt = substr(md5(uniqid(rand(), true)), 0, 25);
}
else
{
    $salt = substr($salt, 0, 25);
}

return $salt . sha1($salt . $plainText);
}

This is the function from php121 messenger for authenticating user. I have all the database settings correct and it finds the user name but password doesn't match because of the hash format

function userLookup($username, $password) {
global $php121db, $password;
global $db_usertable, $dbf_uid, $dbf_uname, $dbf_upassword, $dbf_passwordtype, $dbf_uemail;
global $dbf_user_chatting, $dbf_smilies, $dbf_level, $dbf_showrequest;
global $dbf_upassword_len;

    $stop = "";
    if (mysql_num_rows(mysql_query("SELECT $dbf_uname FROM $db_usertable WHERE $dbf_uname='$username'",$php121db)) == 0) $stop .= _USERNAME_NOT_FOUND . "<br>";
    if ($stop == ""){
            $row = mysql_fetch_row(mysql_query("SELECT $dbf_upassword from $db_usertable WHERE $dbf_uname='$username'", $php121db));
    if ($dbf_passwordtype == "md5") {
        if ($row[0] != substr(md5($password), 0, $dbf_upassword_len)) $stop .= _INCORRECT_PASSWORD . "<br>";
    } else if ($dbf_passwordtype == "plaintext") {
        if ($row[0] != substr($password, 0, $dbf_upassword_len)) $stop .= _INCORRECT_PASSWORD . "<br>";
    }
    else if ($dbf_passwordtype == "salted") { 
if ($row[0] != substr(md5(uniqid(rand(), true)), 0, 25)) $stop .= _INCORRECT_PASSWORD . "<br>"; 

 }
}
return($stop);
}

I need to figure out how to compare the md5 hash

http://forums.php121.com/viewtopic.php?t=1162

Tried to use something like this which is used for joomla but no luck.

Any assistance would be appreciated.

Thanks

user1443402
  • 33
  • 2
  • 9
  • The userLookup is simply taking a 25-character substring of some random unique id. substr(md5(uniqid(rand(), true)), 0, 25)) seems to be a random session id. The upper function uses it to generate a salt that is both appended to the SHA-1 and appended with the real password in SHA-1. The salted mode in the userLookup() function does not match the process used in the generateHash() function and therefore the passwords will never match in the database. – MagikWorx Mar 12 '15 at 19:27
  • What should the salted mode be then? – user1443402 Mar 12 '15 at 19:57

0 Answers0