writing my own sign-up form

vanejilla

hi,

I need to know what hashing is used in hashing the password from the signup form. Presently i'm using vanillas signup but its not playing well because ive got it in an iframe which i cant break out of to redirect after the sign in process. So, having lost a day messing with it i reckon i'd be better off doing it my own way.

The form itself poses no problem - i use my own honeypot and will only need username, email and password. I can see from the DB that the password is hashed (md5) i suspect, but it also looks like its using a 'salt' - Does anyone know the exact algorithm - for the password hash??. I can deal with the other DB fields in the user table.

thanks

peregrine

this has been discussed I believe did you try searching the forum. I don't recallenought to give you an answer - but I am sure the hashing function is in the core if you search through the source code for things like salt etc.

hgtonight

Welcome to the community!

What version of Vanilla are you running?

You are looking for /library/core/class.passwordhash.php and /library/vendors/phpass/PasswordHash.php for all things related to password hashes.

vrijvlinder

Yes I recall the discussion I believe xx0 was in it , I found this

http://vanillaforums.org/discussion/19537/how-to-add-a-custom-password-hashing-method

vanejilla

hi,

@peregrine, @hgtonight, @vrijvlinder :

Thanks for your direction guys - got that working now... phew... had to leave it for 24 hours to give my head a rest!!

Just wondered if anyone knows if i can use any, random, 12 char alpha-numeric string for the transientkey to enter into the user table. when creating the user record after sign-in. If its a new user then the 'transientkey' wont exist at that point - any transientkey i create at this point will be used thereafter for this user...right?? Or is it created from some other user data or the sessionID??

@Peregrine:
i see you asked about the 'transientkey' in a thread last year and didnt get much response -
This forum thread:

http://vanillaforums.org/discussion/17498/sample-code

discusses it but im still non the wiser whether to make a call to the api mentioned here since i'm actually creating the user record for the first time so the ''transientkey' key can be anything i make it as long as its 'Vanilla-safe' 12 chars (uppercase) - if you know what i mean??

Any thoughts??

peregrine

i see you asked about the 'transientkey' in a thread last year and didnt get much response -

thanks for the followup @vanejilla