Struggling with the API

[getup]

For some reason I can't figure out how passwords are used in http://wiki.whmcs.com/API:Get_Clients_Password. It says:

 

The hash uses the format "md5(salt.pw):salt" and so the salt can be obtained from the 5 characters after the colon ( for you to be able to generate your own hash to compare

 

So how should I build a password based on the returned hash? This is what I have so far:

 

$passCheck 	= explode(":", $result['password']);
		$salt		= $passCheck[1];
		if($passCheck[0] == md5("{$salt}.{$password}"))

 

Though they never match. I'm not sure what's going wrong here. Any ideas?

[sparky]

Try it this way

$passCheck = explode(":", $result['password']);
$salt = $passCheck[1];
if($result['password'] === md5($salt.html_entity_decode($password).':'.$salt){
echo "passwords match";
}else{
echo "passwords do not match"; exit;
}

[disgruntled]

l]Though they never match. I'm not sure what's going wrong here. Any ideas?

 

 

one idea..

 

$hash = md5($salt.$pass);

 

if thats how you hash the password.. thats how you hash all passwords.

 

when you check the password you need to do the same hash sequence as you did to set the password.

 

Dont mean to sound like i think your dumb because i dont, your doing somthing i will never do and thats use the api because i cant seem to get my head around it right now,

 

The above is just something i have seen before in regards to ppl using salts or even straight md5() and forgetting to salt in teh same way or hash in teh same way then wonder why there is no match.

 

It should be intuitive but its not i dont suppose.

Edited September 15, 2010 by disgruntled

[getup]

How am I supposed to know how WHMCS hashes the passwords? I haven't set the password, WHMCS did. Thought that'd be obvious. I'm not sure why you're thinking I did?

 

Anyway. Apparently you don't need to use the dot in md5(hash.pass) and just use md5(hashpass). Issue solved.

[disgruntled]

How am I supposed to know how WHMCS hashes the passwords? I haven't set the password, WHMCS did. Thought that'd be obvious. I'm not sure why you're thinking I did?

 

Anyway. Apparently you don't need to use the dot in md5(hash.pass) and just use md5(hashpass). Issue solved.

 

Because you are given the option to hash or not.

 

general settings > security i believe its located

 

none the less, glad you have it sorted