Aqua-Soft ForumsI see that you have virtua news running fine with ipb 2.x, How did you manage this, I have tried everything, how did you do it?
[question] The New Boards
Originally posted by Lou@Jul 7 2004, 05:27 PMStevie is a PHP god. (maybe Timmie too?)
// Lou
<{POST_SNAPBACK}>
Well would stevie mind giving me a little clue
oh comon someone, if its possible why dont you just tell
The reason is because the new IPB has "legacy_password" as the field where as the old one just has "password"
So change the following line in forum_ib_10.php
".$ibf_prefix."members.password,
To this
".$ibf_prefix."members.legacy_password,
That should work 
That doesn't work, Sid.
Sorry I've taken so long to reply, but this week has been very busy at work...
The legacy_password field is exactly what it says on the tin - the password hash for pre-IPB 2.0 systems. IPB 2.0, however, uses a completely different hashing algorithm, and stores different data in the cookie, so anything you try to do using that won't work.
Also, Tim's told me to tell you not to update to IPB 2.0 until you update to the latest version of VirtuaNews - we're apparently a few versions behind, and Tim can't decide whether or not to upgrade.
All that said, here's what you do...
Open forum_ib_10.php (all the changes to make are in here).
Find the function dologin($name,$password,$adminlogin=0). This should be somewhere around line 40.
Replace the following code:
$userinfo = query_first("SELECT
".$ibf_prefix."members.id,
".$ibf_prefix."members.mgroup,
".$ibf_prefix."members.name,
".$ibf_prefix."members.password,
".$ibf_prefix."groups.g_view_board
FROM ".$ibf_prefix."members
LEFT JOIN ".$ibf_prefix."groups ON ".$ibf_prefix."members.mgroup = ".$ibf_prefix."groups.g_id
WHERE ".$ibf_prefix."members.name = '$name'");
if ($userinfo) {
if ($userinfo[password] == md5($password)) {
if ($userinfo[mgroup] == 1) {
$error = "account_notmoderated";
} elseif ($userinfo[g_view_board] == 0) {
$error = "user_banned";
} else {
updatecookie($ibf_cookieid."member_id",$userinfo[id]);
updatecookie($ibf_cookieid."pass_hash",md5($password));
$error = "";
}
} else { // Password wrong
$error = "wrong_password";
}
} else { // Username wrong
$error = "wrong_username";
}
With
$userinfo = query_first("SELECT
".$ibf_prefix."members.id,
".$ibf_prefix."members.mgroup,
".$ibf_prefix."members.name,
".$ibf_prefix."groups.g_view_board,
".$ibf_prefix."members_converge.converge_pass_hash,
".$ibf_prefix."members_converge.converge_pass_salt,
".$ibf_prefix."members.member_login_key
FROM ".$ibf_prefix."members
LEFT JOIN ".$ibf_prefix."groups ON ".$ibf_prefix."members.mgroup = ".$ibf_prefix."groups.g_id
INNER JOIN ".$ibf_prefix."members_converge ON ".$ibf_prefix."members.email = ".$ibf_prefix."members_converge.converge_email
WHERE ".$ibf_prefix."members.name = '$name'");
if ($userinfo) {
if ($userinfo[converge_pass_hash] == md5( md5( $userinfo[converge_pass_salt] ) . md5($password) )) {
if ($userinfo[mgroup] == 1) {
$error = "account_notmoderated";
} elseif ($userinfo[g_view_board] == 0) {
$error = "user_banned";
} else {
updatecookie($ibf_cookieid."member_id",$userinfo[id]);
updatecookie($ibf_cookieid."pass_hash",$userinfo[member_login_key]);
$error = "";
}
} else { // Password wrong
$error = "wrong_epassword";
}
} else { // Username wrong
$error = "wrong_username";
}
Well, actually, don't replace it - comment out the original, just in case you need it later. It's always good to keep things like that for reference.
Basically, the changes are as follows:
We need to retrieve the members_converge.converge_pass_hass (the new-style password hash) and members_converge.converge_pass_salt (the new-style password hash's "salt" - some arbitrary character sequence) based on the user's e-mail (thus the INNER JOIN).
We must also retrieve the members.member_login_key, which I'll explain later.
We then compare the current hash value with the outcome of md5(md5(members_converge.converge_pass_salt) + md5(input password)). If the two match, then the user has provided the correct password. We then store the members.member_login_key value into the cookie for autologon purposes. More on this in a bit...
We also need to change the validateuser($userid,$userpassword) method. I can't, however, be bothered to calculate the original line this was at, so just find it yourselves. It's directly after dologin.
Replace
$userinfo = query_first("SELECT
".$ibf_prefix."members.mgroup,
".$ibf_prefix."members.name,
".$ibf_prefix."members.password,
".$ibf_prefix."members.email,
".$ibf_prefix."members.hide_email,
".$ibf_prefix."members.view_sigs,
".$ibf_prefix."members.new_msg,
".$ibf_prefix."groups.g_view_board,
news_staff.*
FROM ".$ibf_prefix."members
LEFT JOIN ".$ibf_prefix."groups ON ".$ibf_prefix."members.mgroup = ".$ibf_prefix."groups.g_id
LEFT JOIN news_staff ON ".$ibf_prefix."members.id = news_staff.userid
WHERE ".$ibf_prefix."members.id = $userid");
if ($userinfo) {
if ($userinfo[password] == $userpassword) {
With
$userinfo = query_first("SELECT
".$ibf_prefix."members.mgroup,
".$ibf_prefix."members.name,
".$ibf_prefix."members.email,
".$ibf_prefix."members.hide_email,
".$ibf_prefix."members.view_sigs,
".$ibf_prefix."members.new_msg,
".$ibf_prefix."groups.g_view_board,
".$ibf_prefix."members_converge.converge_pass_hash,
".$ibf_prefix."members_converge.converge_pass_salt,
".$ibf_prefix."members.member_login_key,
news_staff.*
FROM ".$ibf_prefix."members
LEFT JOIN ".$ibf_prefix."groups ON ".$ibf_prefix."members.mgroup = ".$ibf_prefix."groups.g_id
LEFT JOIN news_staff ON ".$ibf_prefix."members.id = news_staff.userid
INNER JOIN ".$ibf_prefix."members_converge ON ".$ibf_prefix."members.email = ".$ibf_prefix."members_converge.converge_email
WHERE ".$ibf_prefix."members.id = $userid AND ".$ibf_prefix."members.member_login_key='$userpassword'");
if ($userinfo) {
As before, keep the original in a comment block, explaining what you've done, if you feel the need.
Feel free to link to this post as an explanation 
The changes here:
Again, we need the members_converge.converge_pass_hash, members_converge.converge_pass_salt, and members.member_login_key. You'll notice, however, that we now have a second condition in our WHERE clause: "members.member_login_key='$userpassword'". What this does is matches the member_login_key (remember we stored this in the cookie?) in the table. If this isn't found, then no data is returned by the query. In other words, all of our password checking is done in the query. Therefore we don't need the line "if ($userinfo[password] == $userpassword) {" (or the corresponding closing curly brace).
Full file removed.
I forgot it's copyright-protected >.
Damn you good! :woot:
//Saves code to txt file
I might need this in the future, thanx Stevie
Yeah, stevie, thanks for replying
that's a very interesting method of checking password!!!! didn't even took a look at the latest IPB version but it seems there are a lot of improvement!! especialy in the DB management isn't it?
Thank for you enlightings Stevie