Wrong UserName/ Password on main site and the mod

[kreegaa]

carllfo edit: This problem has now been corrected, please do not create any more topics related to this issue!
"Re-download the mod, login to this site, logout and login again. Continue your evil cheating ways"
At least that's what I think Shu said as I have been busy lately and didn't even notice any problems

hi,
am getting a wrong username/password error on the http://hellwich.nl/shu/main site. that means the main site and the downloads page. And in the mod when i try logging in it says the same. But with the same user name and password i have still got access to the forums!

[Xircon]

i have the same problem

[Stabilo]

See this:
http://hellwich.nl/shu/forums/viewtopic ... 336#p21336

[Xircon]

it still doesn't work, I always remember to use upper & lower case in my login but doesn't seem to work.. (as mentioned in the news section on that part of the site)

en what do they mean by " is it plugged in???"

Grtz

[Shu]

it works for me .... it's strange ....

[Shu]

PHPBB 3.0 RC7
# [Sec] Use new password hash method for forum passwords (#i43)
# [Sec] New password hashing mechanism for storing passwords (#i42)

Strange I don't have any problems :p well ...

http://www.phpbb.com/community/viewtopi ... 6&t=585387

i'll fix this later today or tomorrow... this will also require a new azureus shu mod update

[Xircon]

Yeah i know quite strange , i even tried to change my password and try login' in again, with no effect though...

I don't know if you need to change the mod.. cause this week i still used it with 2.5.x.x mod, worked fine, till i saw there's a new version out of the mod..
but that's a b*tch if you can't reach the download page

Anyway I appreciate your fast response for this shu your the best (like you didn't know already )

[hellwich]

With RC6/RC7 update you can no longer just md5 the password and compare to the database. The password hashing function is too complex and md5'ing is just a small, small, small part of the password hashing. (I'm being very careful to not use encryption because encryption is designed to be easily reversible, hashing is a one way function.)

Another thing I just figured out is that during the update, it does not update your users' passwords. In order for the passwords to be updated, they need to logout and log back in.

Alternatively, perhaps we could force logout all users then making them have to log back in to the forums and it would take care of most of the users? The problem then would still be someone that doesn't login to the forums but still tries to use your custom script, so you could check with the new hash password, and if that fails, check with the old md5 method. I'm choosing to just require them to logout and login so they are all updated and more secure.

Quote taken from phpbb forum.

Just don't logout from the forum, and you will be alright untill Shu finds a way to fix the login issues.
(I know this isn't going to help the people who already can't login.. it's just a tip for all the users who still can login with Azureus.

[Shu]

hehe nice tip....

edit : main page works
i gotta make a new mod version now

[Xircon]

tested and confirmed that the main page works!
and now i've given you extra work with the new mod version you need to build

[Shu]

the new system is pissing me off.... it bugs me a lot

[Xircon]

i'm feeling guilty..

[Shu]

here you go a tempory new version

there is still a security issue with it... so use it at your own risks

my advice : DO NOT USE IT IF YOUR NETWORK ISN'T SAFE ... that's all for now

i'll release a new version when i've had more time coding an encryption algo in the mod.... and in a php file....

[hellwich]

man, I give up... I tried to alter the php file but I can't figure it out... maybe you can take a look at it Shu? (I'm sure you know which file I mean..)

[hellwich]

btw, the checking page doesn't work at all right now (it just always says "invaliduserpass")