WHMCS User passwords

[bin_asc]

Is the checkout script the only way to collect a user`s password if you want to do a bridge with a 3rds party script ?

If no, what type of encryption does it use.

If yes, what variables are passed to the checkout script.

[skmd]

I guess its encrypt it with md5(). To make sure of that, create a user with known password, check the password in the database for this user. compare it with

<?

echo md5('YOURPASSWORD');

?>

[bin_asc]

It`s not, as I`ve checked that.

[skmd]

well, I checked it . you are right. the admins passwords are in md5 I thought its the same for the clients. i'm intrested now to know the encryption as im going to integrate it with other system.

[Nick]

The passwords in the database can be decrypted with the decrypt() function which is defined when whmcs function files are loaded. See documentation on creating new pages in whmcs, the function will be available to pages created in this manner.

[bin_asc]

So, basically, a decrypt would give me the pure password ?

[bin_asc]

WOO HOO, it WORKED !! Thanks Nick

[bin_asc]

Question, what encryption does the session upw have ?

[dsaunier]

Question, what encryption does the session upw have ?

 

As I am developping an import script from a custom site, this is of the highest interest to me, as my import script must save the clients profile with their password properly encrypted. Right now the way they are stored does not seem to be with the usual MySQL methods (mD5, Password, hash etc)? Or did I overlook something ?

 

Thanks.

 

Edit : Looks like we have to rely on WHMCS to encrypt those passwords; using the API and a function...Back to writing another function to encrypt passwords while importing our clients...

 

http://wiki.whmcs.com/API:Example_Usage

http://v3manual.whmcs.com/display.php?id=139

[gurumani]

The passwords in the database can be decrypted with the decrypt() function which is defined when whmcs function files are loaded. See documentation on creating new pages in whmcs, the function will be available to pages created in this manner.

 

Nick, this function didn't work for me... I am on V4 of WHMCS. Is the decrypt() function still available? I am trying to decrypt the users passwords to get the MD5 HASH.

[Nick]

I can't remember which version made the change, but user passwords are no longer stored with reversable encryption.

[DedicatedPros]

This was one of the security upgrades in WHMCS v4, so WHMCS 3.8.2 and down will be able to get the passwords, however newer versions will not.