Password fields on Order form and Custom Fields

[sactobob]

I'm somewhat confused regarding the "password" type used for custom fields and also the username/password fields on the order page once the order is entered.

I had thought passwords were being stored in bcrypt format, but this obviously isn't the case for these fields. On the order form the DB entry for password is missing the "$2$" prefix and I'm also surprised when I view the order form the password is shown in clear text???   Is it because I'm an admin?  This  also indicates the stored password is encrypted and not hashed as whmcs is able to decrpyt the DB field and display it on the form. Either way that field doesn't seem to be as secure as I would think a password field should be.

My idea was to use the username/password field on the order form and propagate  that to a Unix server for provisioning . I guess I could decrypt the PW, and then bcrypt for the Unix side assuming I'm able to do that? I still don't like the password shown on the form though.  And the field doesn't seem to be following the system's minimum password requirement.

The same issue goes for an add-on custom field for the product, except when I define that field as a password it's even worse then the order form. For a custom field, there's no encryption taking place at all, the password is stored in clear text in the DB! 

Am I missing something? 

Thank you,

-Bob

[sactobob]

Replying to my own thread...  Looked through APIs and yep, it's not hashed, but encrypted. I can work with that to provision to the Unix side... And when clients view their record the PW is ******* out. All good. 🙂

DecryptPassword
EncryptPassword