utils.inc.php new function, problem with variable

Hello,

does somebody know please, which variable stores the username or userid in utils.inc.php when a new userprofile is created.

I want to extend utils.inc.php with a new function or extend (function genRndPwd), that will be store each new registered user in an extra table. The function will be read out each new created user an will be store username, id, and password in a new separate table in my database.

Thanks in advantage
Best regards

Thomas 

could you give a little more clarification. Depending on why you are doing what you want to do, someone may be able to give you better answers and/or solutions

the username and the password are saved as cookies - so in your example, you could do (if looking for id of logged in member):

ok, just a little tip/hint - if you are using firefox, install firebig for firefox - it is free, and you can inspect your web site and also see all the good little cookies that are created.

But anyways, the encrypted password is also saved in a cookie.You will never see the actual password, even if you looked in the database.

I have to ask though - there is already a table with the info you need, so why are you reinventing the wheel, when you can just query the existing table.

Hello and Thanks.

Also a lot of thanks for your hint. I inspected the page by using of Google Chrome / Webdevelopment Plugin and found the cookies and some additional informations. All i had seen is a encrypted password like in table Profiles. But i need a way to store the unencrypted password in a new databasetable or variable, because i work on a gateway (dolphin / coppermine) and coppermine uses another encryption as dolphin. 

It is not possilbe to query with table Profiles, because Dolphin does not store any passwords in clear/plain-text. Otherwise, i think, is there a possiblilty to read out the encrypted password from table Profiles an is there a way to de-encrpyt?

Kind regards and a lot of thanks

Thomas 

No. You can't decrypt the password because it not encrypted. It's hashed. Hashes are one way. In theory they are not suppose to be able to be reversed.

To do what you want the easiest way would be to modify the function that creates the profile. That would be the function createProfile in inc/classes/BxDolProfilesController.php to store the clear text password as the profile is being created.

Or you could also modify the function that checks the password during login. That would be the function check_password in inc/admin.inc.php

Dolphin does not store clear text passwords anywhere. Doing so would be a serious security risk. So if you do it and if your database gets compromised by a hacker that hacker would than have all the passwords to your users accounts. That is the reason modern software does not store actual clear text passwords.

You are better off storing a hashed version that matches the software your going to use it for rather than storing the actual clear text password.

 And you don't actually want to use that function. That function is used only when the password field when submitted is blank which would be a rare occurrence. It's also used by facebook connect because actual passwords cannot be retrieved from facebook so it generates a random one. So that's not the function you want to tap into.

What you need to think about is a way to store the same password in both Dolphin and Coppermine at the same time.  Is the account created first in Dolphin?  Is so, look at the code that Coppermine uses to store the password and look at a way to add that to Dolphin so when the user creates the password on Dolphin, it also creates and stores the password on Coppermine using Coppermine's method.

Hi Deano, Hi GeekGirl,

thanks a lot for help.

My first idea was, to modifiy BxDolJoinProcessor or BxDolProfilsController or  utils.inc.php. To modify one of these scripts, add a new funtction that runs a query in table Profiles and read out mailadress, nickname and so on and generate a new hashed password that is hashed, so that coppermine can work with it. All these informations should be inserted in the usertable of coppermine.

Now i found in BxDolProfilesController these function "function genRandomPassword()". Here i want to place the new insert, because i have 2 new and oldknown Problems.

1.) Where i can found the submitted password in cleartext
2.) Where can i found the Profileid in order to start the query with table Profiles.

Thanks a lot

Thomas

*** Deano, BIG Thank you ***

I think i have fixed it: In BxDolProfiles Controller i found these function (around line 145):

//set crypted password

            $sSalt = genRndSalt();

$this -> updateProfile($iNewID, array(

                'Password' => encryptUserPwd($aNewProfile['Password'], $sSalt),

                'Salt' => $sSalt

            )); --> after here i had placed a new insert, that writes direct in coppermines Usertable, i catched the password with $iPwID =    $aNewProfile['Password'];

Between  )); and my insert i will include some code that create a new hashed password for coppermine and store it in a variable.

Seems to work for the first look. 

What i must to know is, where i can find the funtion, when a member will change his password in dolphin.

Best regards

Thomas            

The function is in BxDollProfilesController: function updateProfile( $iMemberID, $aData ) you can use:$aData['NickName'];
$aData['password'];  $aData['FirstName']; $aData['LastName']; $aData['Email'].

My problem is: $aData['password'] is hashing ... y need the password in format clean text...

Where is created this array($aData)???