WHMCS carry over login from external page

[thomas.rodriguez]

I followed the API documentation to validate a login [1], which works fine for me.

However, when I set the session variables $_SESSION['uid'] and $_SESSION['upw'] as described there, with the returned userid and passwor**ash from the validate login API call, I am not automatically logged in to WHMCS.

 

Via the forums I found that the passwor**ash is (or was once?) computed as follows:

$_SESSION['upw'] = md5($userRow['id'] . $userRow['password'] . $_SERVER['REMOTE_ADDR']);

 

Because the API is not called from the clients IP but a servers IP, I suppose that this might cause it not to work. However, even if I create the $_SESSION['upw'] hash as described above I am not automatically logged in.

 

To verify the hashs I obtained the $_SESSION['upw'] variable after a regular login to WHMCS which indeed turns out to be different to the one I am returned by the API call validate login, as well as the manual construction.

 

Later, I discovered AutoAuth [3]. It also works for the first page within WHMCS to which i'm going via the goto parameter. However, when I go to other pages of WHMCS the login seems to get lost again.

First I thought it's because the server time and php's time() were no on the same timezone. But after fixing that, I still have the issue.

 

Can you plase tell me how this is supposed to be done? I could not find any more information in the forums nor the documentation.

Thanks

 

 

[1] http://docs.whmcs.com/API:Validate_Login

[2] http://forum.whmcs.com/showthread.php?15092-WHMCS-Session-Login-Questions/page2

[3] http://docs.whmcs.com/AutoAuth