Using memberName and passwd to login

[jossif]

I am sure this has been asked thousands of times, but I have been unable to find the answer by searching the forum.

I want to use the members table data to login my users to a different app on my site.

I have a simple form requesting username and password and want to check these credentials against the SMF database.

My form sends $user and $passwd via POST to a login script.

The problem I am having is that I do not know how the passwd field is encrypted by SMF. I though that it was sha1 using the user name as salt... but when I do this, it does not work:

Code Select Expand


import_request_variables("PG");
$validate = "SELECT memberName, passwd FROM smf_members WHERE memberName like \"$user\" LIMIT 1";
if ($row = mysql_fetch_array($sql_result)){
# Get user data needed
$hash_pass = "$row[passwd]";
        //compare credentials
if ( sha1($passwd . $user) == $hash_pass) {
            // login OK
      } else {
           // login not OK - password does not match
      }
// login not OK - user not found
}


Any help will be appreciated.

-- Jossi

[jossif]

OK... I see that it is possible to use SSI to display a login box and redirect to a specific section of my site:

Code Select Expand

<?php ssi_login('http://mysite.net/dashboard/index.php'); ?>

Now, how do I check in http://mysite.net/dashboard/index.php that a user is indeed logged-in?

[niko]

OK... I see that it is possible to use SSI to display a login box and redirect to a specific section of my site:

Code Select Expand

<?php ssi_login('http://mysite.net/dashboard/index.php'); ?>

Now, how do I check in http://mysite.net/dashboard/index.php that a user is indeed logged-in?

global $user_info;

if ($user_info['is_guest'])
{
// GUEST
}
else
{
// NOT GUEST
}

The problem I am having is that I do not know how the passwd field is encrypted by SMF. I though that it was sha1 using the user name as salt... but when I do this, it does not work:

Passwords hashes are sha1(strtolower($username). $password);

[jossif]

  Thank you!

[Moobi]

Passwords hashes are sha1(strtolower($username). $password);

That's the ticket! Yeah! This is what I was looking for. I kept seeing references to using SSI.php, but that seemed like overkill for my needs. For the record, I ended up using it in my query string thusly:

Code Select Expand

$query = "SELECT ID_MEMBER, is_activated FROM smf_members WHERE memberName='$memberName' AND passwd=sha1('".strtolower($memberName)."$passwd')";