Vanilla 1 is no longer supported or maintained. If you need a copy, you can get it here.
HackerOne users: Testing against this community violates our program's Terms of Service and will result in your bounty being denied.
Need help implementing a different password handling into Vanilla
Hi experts!!
I have a task to do: integrating the nice Vanilla into an existing structure for testing purposes.
As the site has its own user management, it should be an easy task (and most of the things work from scratch).
The big problem is the usage of passwords in the given user management: it uses "salt" added to the password hashs. As easy it is to copy all user information into LUM_User... as hard it is for me to find the right place, where i could manipulate Vanilla, that it uses the same structure for creating and validating the same password structure (I got a little lost, while walking through the framework).
The existing functions are pretty easy:
function validate_password($plain, $encrypted) {
if (tep_not_null($plain) && tep_not_null($encrypted)) {
// split apart the hash / salt
$stack = explode(':', $encrypted);
if (sizeof($stack) != 2) return false;
if (md5($stack[1] . $plain) == $stack[0]) {
return true;
}
}
return false;
}
function encrypt_password($plain) {
$password = '';
for ($i=0; $i<10; $i++) {
$password .= tep_rand();
}
$salt = substr(md5($password), 0, 2);
$password = md5($salt . $plain) . ':' . $salt;
return $password;
}
As you can easily see, the hashes and the "salt" is stored like "86009c99b15779ddc661d74fa8f0ac58:e6" in the DB (some bytes longer, which is not the point).
So, if anyone could help me finding the right place to implement this existing structure... it would be much appreciated!!
Thanx in advance!
0
This discussion has been closed.
Comments
You can keep your users in the existing table and make Vanilla use *that* table instead. Just make sure that all of the vanilla fields exist in your other table. You can rename and remap them using the database structure in appg/database.php (copy that structure into conf/database.php to customize).
Once that is finished and Vanilla now maps to your user table, you can create a new authenticator class for Vanilla to use. Copy the existing library/People/People.Class.Authenticator.php file, rename it to library/People/People.Class.MyAuthenticator.php, and then alter it as needed. It might sound tough, but it's really not. All the Vanilla authenticator does is grabs cookie or session values and returns the Vanilla UserID based on those values. So, if your system's sessions contain the userid, there's almost no work involved. You just grab it and return it. If your system's session don't contain the UserID, then there might be some more work querying the database to get it.
The final step is to make Vanilla use your authenticator instead of the standard one. To do that you just specify the name of the authenticator to use in your conf/settings.php file like this:
$Configuration["AUTHENTICATION_MODULE"] = "People/People.Class.MyAuthenticator.php";$sql = 'select whatever from wherever'; $Result = $this->Context->Database->Execute($sql, 'Authenticator', 'ValidatePassword', 'An error occurred while attempting to validate your password');