Para los GENIOS, problema al logear con encriptacion SHA-1 de SMF

[XtremeBook]

hola amigos estoy haciendo una web en la que quiero usar la misma BD de mi foro SMF, estoy usando el foro SMF 2.0 que por lo que he podido ver, para almacenar las contraseñas usa una encriptacion SHA-1 de usuario y password osea algo asi:

sha1($usuario.password);

mi problema es que no se como hacer un sistema de logeo y que de alguna forma la contraseña que incluyan en el campo password del formulario se compare con la de la base de datos que esta cifrada y sepa si es correcta o no, aquí les dejo el fichero de encriptacion o login de smf:

Código PHP:

<?php
    // Figure out the password using SMF's encryption - if what they typed is right.
    if (isset($_POST['hash_passwrd']) && strlen($_POST['hash_passwrd']) == 40)
    {
        // Needs upgrading?
        if (strlen($user_settings['passwd']) != 40)
        {
            $context['login_errors'] = array($txt['login_hash_error']);
            $context['disable_login_hashing'] = true;
            unset($user_settings);
            return;
        }
        // Challenge passed.
        elseif ($_POST['hash_passwrd'] == sha1($user_settings['passwd'] . $sc))
            $sha_passwd = $user_settings['passwd'];
        else
        {
            // Don't allow this!
            validatePasswordFlood($user_settings['id_member'], $user_settings['passwd_flood']);
 
            $_SESSION['failed_login'] = @$_SESSION['failed_login'] + 1;
 
            if ($_SESSION['failed_login'] >= $modSettings['failed_login_threshold'])
                redirectexit('action=reminder');
            else
            {
                log_error($txt['incorrect_password'] . ' - <span class="remove">' . $user_settings['member_name'] . '</span>', 'user');
 
                $context['disable_login_hashing'] = true;
                $context['login_errors'] = array($txt['incorrect_password']);
                unset($user_settings);
                return;
            }
        }
    }
    else
        $sha_passwd = sha1(strtolower($user_settings['member_name']) . un_htmlspecialchars($_POST['passwrd']));
 
    // Bad password!  Thought you could fool the database?!
    if ($user_settings['passwd'] != $sha_passwd)
    {
        // Let's be cautious, no hacking please. thanx.
        validatePasswordFlood($user_settings['id_member'], $user_settings['passwd_flood']);
 
        // Maybe we were too hasty... let's try some other authentication methods.
        $other_passwords = array();
 
        // None of the below cases will be used most of the time (because the salt is normally set.)
        if ($user_settings['password_salt'] == '')
        {
            // YaBB SE, Discus, MD5 (used a lot), SHA-1 (used some), SMF 1.0.x, IkonBoard, and none at all.
            $other_passwords[] = crypt($_POST['passwrd'], substr($_POST['passwrd'], 0, 2));
            $other_passwords[] = crypt($_POST['passwrd'], substr($user_settings['passwd'], 0, 2));
            $other_passwords[] = md5($_POST['passwrd']);
            $other_passwords[] = sha1($_POST['passwrd']);
            $other_passwords[] = md5_hmac($_POST['passwrd'], strtolower($user_settings['member_name']));
            $other_passwords[] = md5($_POST['passwrd'] . strtolower($user_settings['member_name']));
            $other_passwords[] = md5(md5($_POST['passwrd']));
            $other_passwords[] = $_POST['passwrd'];
 
            // This one is a strange one... MyPHP, crypt() on the MD5 hash.
            $other_passwords[] = crypt(md5($_POST['passwrd']), md5($_POST['passwrd']));
 
            // Snitz style - SHA-256.  Technically, this is a downgrade, but most PHP configurations don't support sha256 anyway.
            if (strlen($user_settings['passwd']) == 64 && function_exists('mhash') && defined('MHASH_SHA256'))
                $other_passwords[] = bin2hex(mhash(MHASH_SHA256, $_POST['passwrd']));
 
            // phpBB3 users new hashing.  We now support it as well ;).
            $other_passwords[] = phpBB3_password_check($_POST['passwrd'], $user_settings['passwd']);
 
            // APBoard 2 Login Method.
            $other_passwords[] = md5(crypt($_POST['passwrd'], 'CRYPT_MD5'));
        }
        // The hash should be 40 if it's SHA-1, so we're safe with more here too.
        elseif (strlen($user_settings['passwd']) == 32)
        {
            // vBulletin 3 style hashing?  Let's welcome them with open arms \o/.
            $other_passwords[] = md5(md5($_POST['passwrd']) . $user_settings['password_salt']);
 
            // Hmm.. p'raps it's Invision 2 style?
            $other_passwords[] = md5(md5($user_settings['password_salt']) . md5($_POST['passwrd']));
 
            // Some common md5 ones.
            $other_passwords[] = md5($user_settings['password_salt'] . $_POST['passwrd']);
            $other_passwords[] = md5($_POST['passwrd'] . $user_settings['password_salt']);
        }
        elseif (strlen($user_settings['passwd']) == 40)
        {
            // Maybe they are using a hash from before the password fix.
            $other_passwords[] = sha1(strtolower($user_settings['member_name']) . un_htmlspecialchars($_POST['passwrd']));
 
            // BurningBoard3 style of hashing.
            $other_passwords[] = sha1($user_settings['password_salt'] . sha1($user_settings['password_salt'] . sha1($_POST['passwrd'])));
 
            // Perhaps we converted to UTF-8 and have a valid password being hashed differently.
            if ($context['character_set'] == 'utf8' && !empty($modSettings['previousCharacterSet']) && $modSettings['previousCharacterSet'] != 'utf8')
            {
                // Try iconv first, for no particular reason.
                if (function_exists('iconv'))
                    $other_passwords['iconv'] = sha1(strtolower(iconv('UTF-8', $modSettings['previousCharacterSet'], $user_settings['member_name'])) . un_htmlspecialchars(iconv('UTF-8', $modSettings['previousCharacterSet'], $_POST['passwrd'])));
 
                // Say it aint so, iconv failed!
                if (empty($other_passwords['iconv']) && function_exists('mb_convert_encoding'))
                    $other_passwords[] = sha1(strtolower(mb_convert_encoding($user_settings['member_name'], 'UTF-8', $modSettings['previousCharacterSet'])) . un_htmlspecialchars(mb_convert_encoding($_POST['passwrd'], 'UTF-8', $modSettings['previousCharacterSet'])));
            }
        }
 
        // SMF's sha1 function can give a funny result on Linux (Not our fault!). If we've now got the real one let the old one be valid!
        if (strpos(strtolower(PHP_OS), 'win') !== 0)
        {
            require_once($sourcedir . '/Subs-Compat.php');
            $other_passwords[] = sha1_smf(strtolower($user_settings['member_name']) . un_htmlspecialchars($_POST['passwrd']));
        }
 
        // Whichever encryption it was using, let's make it use SMF's now ;).
        if (in_array($user_settings['passwd'], $other_passwords))
        {
            $user_settings['passwd'] = $sha_passwd;
            $user_settings['password_salt'] = substr(md5(mt_rand()), 0, 4);
 
            // Update the password and set up the hash.
            updateMemberData($user_settings['id_member'], array('passwd' => $user_settings['passwd'], 'password_salt' => $user_settings['password_salt'], 'passwd_flood' => ''));
        }
        // Okay, they for sure didn't enter the password!
        else
        {
            // They've messed up again - keep a count to see if they need a hand.
            $_SESSION['failed_login'] = @$_SESSION['failed_login'] + 1;
 
            // Hmm... don't remember it, do you?  Here, try the password reminder ;).
            if ($_SESSION['failed_login'] >= $modSettings['failed_login_threshold'])
                redirectexit('action=reminder');
            // We'll give you another chance...
            else
            {
                // Log an error so we know that it didn't go well in the error log.
                log_error($txt['incorrect_password'] . ' - <span class="remove">' . $user_settings['member_name'] . '</span>', 'user');
 
                $context['login_errors'] = array($txt['incorrect_password']);
                return;
            }
        }
    }
    elseif (!empty($user_settings['passwd_flood']))
    {
        // Let's be sure they weren't a little hacker.
        validatePasswordFlood($user_settings['id_member'], $user_settings['passwd_flood'], true);
 
        // If we got here then we can reset the flood counter.
        updateMemberData($user_settings['id_member'], array('passwd_flood' => ''));
    }
 
    // Correct password, but they've got no salt; fix it!
    if ($user_settings['password_salt'] == '')
    {
        $user_settings['password_salt'] = substr(md5(mt_rand()), 0, 4);
        updateMemberData($user_settings['id_member'], array('password_salt' => $user_settings['password_salt']));
    }
 
    // Check their activation status.
    if (!checkActivation())
        return;
 
    DoLogin();
}
 
function checkActivation()
{
    global $context, $txt, $scripturl, $user_settings, $modSettings;
 
    if (!isset($context['login_errors']))
        $context['login_errors'] = array();
 
    // What is the true activation status of this account?
    $activation_status = $user_settings['is_activated'] > 10 ? $user_settings['is_activated'] - 10 : $user_settings['is_activated'];
 
    // Check if the account is activated - COPPA first...
    if ($activation_status == 5)
    {
        $context['login_errors'][] = $txt['coppa_no_concent'] . ' <a href="' . $scripturl . '?action=coppa;member=' . $user_settings['id_member'] . '">' . $txt['coppa_need_more_details'] . '</a>';
        return false;
    }
    // Awaiting approval still?
    elseif ($activation_status == 3)
        fatal_lang_error('still_awaiting_approval', 'user');
    // Awaiting deletion, changed their mind?
    elseif ($activation_status == 4)
    {
        if (isset($_REQUEST['undelete']))
        {
            updateMemberData($user_settings['id_member'], array('is_activated' => 1));
            updateSettings(array('unapprovedMembers' => ($modSettings['unapprovedMembers'] > 0 ? $modSettings['unapprovedMembers'] - 1 : 0)));
        }
        else
        {
            $context['disable_login_hashing'] = true;
            $context['login_errors'][] = $txt['awaiting_delete_account'];
            $context['login_show_undelete'] = true;
            return false;
        }
    }
 

[jatg]

hola extreme, trata de utilizar algo como esto si quieres te paso los archivos suerte

Código PHP:

if($_POST['username']!='' && $_POST['password']!='' && $_POST['password']==$_POST['password_confirmed'] && $_POST['email']!='' && valid_email($_POST['email'])==TRUE && checkUnique('Username', $_POST['username'])==TRUE && checkUnique('Email', $_POST['email'])==TRUE)
 
 
            $query = mysql_query("INSERT INTO users (`Username` , `Password`, `Email`, `Random_key`) VALUES ('".mysql_real_escape_string($_POST['username'])."', '".mysql_real_escape_string(md5($_POST['password']))."', '".mysql_real_escape_string($_POST['email'])."', '".random_string('alnum', 32)."')") or die(mysql_error());
 
            $getUser = mysql_query("SELECT ID, Username, Email, Random_key FROM users WHERE Username = '".mysql_real_escape_string($_POST['username'])."'") or die(mysql_error());
 
            if(mysql_num_rows($getUser)==1)
            {
 
                $row = mysql_fetch_assoc($getUser);
                $headers = 'From: [email protected]' . "\r\n" .
                'Reply-To: [email protected]' . "\r\n" .
                'X-Mailer: PHP/' . phpversion();
                 $subject = "Activation de registro de usuarios www.josealexis.com";
                 $message = "hola ".$row['Username'].", éste es su eslabón de activación para unir nuestro website. Para por favor confirmar su número de miembros haga clic en lo siguiente eslabón : http://www.josealexis.tk/confirm.php?ID=".$row['ID']."&key=".$row['Random_key']. " gracias por registrarse";
                 if(mail($row['Email'], $subject, $message, $headers))
                {//we show the good guy only in one case and the bad one for the rest.
                    $msg = 'Registro creado. Por favor haga click en el enlace que le hemos enviado a su dirrecion de correo electronico para activar su cuenta.';
                      echo "&msg=$msg";
 
 
 
 
                echo "&estatus=ok&"; //registro exitoso
 
                }
                else {
                    $error = 'La cuenta esta creada pero falta que usted active la misma en en link que le hemos enviado a su direccion de e-mail';
                   echo "&error=". $error;
                }
            }
            else {
                $error = 'se ha terminado su tiempo de velides para activar su cuenta. Por favor registrese nuevamente .';
                  echo "&error=". $error;
            }
 
        }
 
         }
?>
<?=$_SERVER['PHP_SELF']?>
 

aqui en confirm.php

Código PHP:

<?php
require_once('db.php');
include('functions.php');
 
    if($_GET['ID']!='' && numeric($_GET['ID'])==TRUE && strlen($_GET['key'])==32 && alpha_numeric($_GET['key'])==TRUE)
    {
 
        $query = mysql_query("SELECT ID, Random_key, Active FROM users WHERE ID = '".mysql_real_escape_string($_GET['ID'])."'");
 
        if(mysql_num_rows($query)==1)
        {
            $row = mysql_fetch_assoc($query);
            if($row['Active']==1)
            {
                echo "&error=".$error = 'This member is already active !';
            }
            elseif($row['Random_key']!=$_GET['key'])
            {
                echo "&error=".$error = 'The confirmation key that was generated for this member does not match with the one entered !';
            }
            else
            {
                $update = mysql_query("UPDATE users SET Active=1 WHERE ID='".mysql_real_escape_string($row['ID'])."'") or die(mysql_error());
                $msg = 'Congratulations !  You just confirmed your membership !';
            }
        }
        else {
 
            echo "&error=".$error = 'User not found !';
 
        }
 
    }
    else {
 
        $error = 'Invalid data provided !';
 
    }
 
    if(isset($error))
    {
        echo "&error=".$error;
    }
    else {
        echo "&msg=".$msg;
    }
?>
 

y aqui el confirm_pass.php

Código PHP:

<?php
require_once('db.php');
include('functions.php');
 
    $query = mysql_query("SELECT * FROM users WHERE ID = '".mysql_real_escape_string($_GET['ID'])."'");
 
    if(mysql_num_rows($query)==1)
    {
        $row = mysql_fetch_assoc($query);
        if($row['Temp_pass']==$_GET['new'] && $row['Temp_pass_active']==1)
        {
            $update = mysql_query("UPDATE users SET Pass = '".md5(mysql_real_escape_string($_GET['new']))."', Temp_pass_active=0 WHERE ID = '".mysql_real_escape_string($_GET['ID'])."'");
            $msg = 'Your new password has been confirmed. You may login using it.';
        }
        else
        {
            $error = 'The new password is already confirmed or is incorrect';
        }
    }
    else {
        $error = 'You are trying to confirm a new password for an unexisting member';
    }
 
    if(isset($error))
    {
        echo $error;
    }
    else {
        echo $msg;
    }
?>
 

[Sourcegeek]

Para ello tienes que encriptar la contraseña introducida en el formulario para comparar las dos encriptadas, y listo

[Gurrutello]

Hola nunca he utizado SMF por lo que no se el tipo de conexiones o como se conecta a una base de datos

lo mas facil seria...
Ya que conoces que los passwords son asi..

sha1($usuario.$password);

Simplemente puedes hacer
// recoge variable y la pones en lowercase si es necesario

$username = strtolower(mysql_real_escape_string($_POST['username']));

$clave = sha1($_POST['username'].$_POST['password']; // comprobar que no esta lowercase, uppercase etc...

$query = mysql_query("SELECT username,password,ID FROM users WHERE LOWER(username) = '".$username."' LIMIT 1");

if(mysql_num_rows($query)==0){
echo 'usuario no encontrado';
}else{
// existe el nombre de usuario podemos hacer la comprobacion
while($row = mysql_fetch_assoc($query){
if($row['password']==$clave){
echo 'Usuario Existe';
}else{
echo 'Usuario NO Existe';
}
}
}

espero que te sirva
Saludos