Amember + PHPBB3 plugin + MediaWiki - weird password updating

Discussion in 'Integration' started by menspsy, Sep 15, 2010.

  1. menspsy

    menspsy New Member

    Joined:
    Aug 4, 2010
    Messages:
    24
    I've just come across a weird issue how Amember and/or PHPBB3 updates passwords. It's an isolated problem and it took me quite a few hours to pinpoint where the problem is, so bare with me while I try to explain it.

    I have the latest 3.2.2BETA with PHPBB3 plugin and PHPBB 3.0.7-PL1 forum. Then we also use MediaWiki which uses PHPBB's user database for user authentication.


    Here is what happens:
    When I change an user password in Amember (or when I do Rebuild DB in Amember, same thing), the password in PHPBB database is updated as well. BUT ...

    Let's say I set the user password as "password". Right after I click save, the password in user's MySQL record is "5f4dcc3b5aa765d61d8327deb882cf99".

    Then when I login into PHPBB, the password in user's MySQL record is changed to "$H$9F4R2kbYtPxEjBITj6OrEA/glWBSHl."

    Both passwords work for logging in. I assume the first one is just a simple MD5 encryption, and the second one is a new hashed version.


    While this works fine for logging into Amember and PHPBB, it causes issue with login into my MediaWiki.
    I have this modification installed: http://www.mediawiki.org/wiki/Extension:PHPBB/Users_Integration and I think it works like this:
    MediaWiki hashes the password user enters, and then compares the hashed password with the password stored in PHPBB database.

    The problem is that until the user logs into PHPBB, his password isn't hashed and when he tries to login into MediaWiki, the MediaWiki compares hashed password with so far "unhashed" password in PHPBB, this giving an "incorrect password" error.


    To summarize, the user can't login into MediaWiki until he first logs into PHPBB (because the password is not correctly hashed yet).


    Ouch, I hope this all makes sense.

    Any help is welcome. I will open a support ticket if the developers would like to look into that.

Share This Page