[Beta 1.5.2] Password Change 1.0

[[Unknown]]

I wrote this as a result of this thread:
http://www.yabbse.org/community/index.php?thread=22402

This mod adds an additional step to the "forgot password" password change process.  This means you won't get your password changed by some prankster.

http://unknown.network32.net
Mod File: http://unknown.network32.net/security/enhancedsecurity.zip

-[Unknown]

[Peter Duggan]

Yes, it works!

I had to apply it manually (had some permission problem with Packer.php and the YaBBpak Center that could be my own fault), and discovered that two of the <search for> instructions didn't match my Reminder.php exactly because of extra blank lines in the .mod.yp file.

It's not immediately obvious when it returns you to the Login screen that another email with a new password has been sent, and I haven't tested it yet with a secret question because I've never used one (just about to), but it definitely works on at least one of my installations.

<edit>Tested successfully with secret question too!</edit>

[Webby]

I have this error :

Fatal error: Call to undefined function: md5_hmac() in /home/sites/salesplaza.nl/www/forum/Reminder.php on line 160

It has a problem with the md5_hmac ??

What to do next ?

[Shoeb Omar]

What is the "additional step"?

[Webby]

There is a few times an entry like this :

Code Select Expand

<replace>
   sendmail($email, $txt['passchange_for'] . $mbname . ' : ' . $name,
      $txt['passchange_email'] .
      $scripturl . '?action=reminder;what=step2;hash=' . md5_hmac($member_name, $row['memberIP']) . ';user=' . $member_name . ';searchtype=usearch', $webmaster_email);
   $messagetext = "<b>$txt[192]: $user</b><br /><br /><a href=\"$scripturl?action=login;u=$member_name\">$txt[34]</a>";
</replace>


This md5_hmac is hocuspocus to my board I guess ?

[Shoeb Omar]

Ithought that md5_hmac was a function in Load.php?

[Webby]

I have to look for that then....

[Webby]

The function is there in load.php :

Code Select Expand

// MD5 Encryption

function md5_hmac($data, $key)

{

   if (strlen($key) > 64)

      $key = pack('H*', md5($key));

   $key  = str_pad($key, 64, chr(0x00));



   $k_ipad = $key ^ str_repeat(chr(0x36), 64);

   $k_opad = $key ^ str_repeat(chr(0x5c), 64);



   return md5($k_opad . pack('H*', md5($k_ipad . $data)));

}



/* Load the users settings into the array settings.  This array has

      been kept as close to the settings array in Y1G as possible*/

But I do get this error.

How come ??

[[Unknown]]

Make sure all your files have been updated to the newest versions.  You should be calling Reminder.php like index.php?action=reminder.

The extra step is an extra confirmation email.

-[Unknown]

[Webby]

Thanx.

Well, there you have it, I don't have the newest version for all my files.  I have too much mods to upgrade at the moment

Is there something I could do or should I forget about this mod ?

[[Unknown]]

Copy the md5_hmac function in... and it *should* work.

-[Unknown]

[Webby]

Well, I've put it in, and it worked.





but.....




When I receive the second email with the new password, the new password isn't accepted.

Does it have to do with the method of encrypting the password ?  I tried 3 times, but all the passwords aren't accepted..........So I've put my old Reminder.php back for the time being.  I would really like to have this mod, it's much saver........

[Peter Duggan]

When I receive the second email with the new password, the new password isn't accepted.

FWIW, I've had this mod running on two boards since Sunday and everything works for me. I've tested it several times on each and never had any problems.

[Webby]

Well, I have to admit, I'm running a previous version (1.5.1Rcxx), but I'm trying to get this working.

If it is not possible, please say so, I will leave it alone then.

[[Unknown]]

Well, I have to admit, I'm running a previous version (1.5.1Rcxx), but I'm trying to get this working.

If it is not possible, please say so, I will leave it alone then.

I'd have to rewrite it for 1.5.1RC1 or below...

-[Unknown]