DecryptPassword API broken

[Nathanael]

Hi:

Since i updated to WHMCS 7.6, the "DecryptPassword" API ( https://developers.whmcs.com/api-reference/decryptpassword/ ) is returning a garbage string. For example:

For client password hash: "$2y$10$3utX0SFnu63/rBtRjHinCeK246TncFj74o67X.PoLd4zmnO7gNnT."

Returns:

array (size=2)
'result' => string 'success' (length=7)
'password' => string '�
�&=���?�����6���6�' (length=21)

It was working a few hours ago before the update was done.

PHP Version 7.0.30-0+deb9u1

[WHMCS Peter]

Hi Nathanael,

Client passwords are (and have been since around version 6) hashed and encrypted in an irreversible manner. This was done to protect the security of said passwords.

The DecryptPassword API call is designed for decrypting service passwords. There is no longer any way to decrypt Client passwords as the reversible encryption functionality was removed from WHMCS entirely.

In short, I can confirm that this is by design.

I hope this helps.

[Nathanael]

Thanks, you are right. Don't know why i thought client password could also be decrypted. I tested it with service and server passwords and works.

[twhiting9275]

On 8/1/2018 at 12:38 PM, Nathanael said:

Don't know why i thought client password could also be decrypted.

Prior to v6, it was able to be decrypted.