no passwords

[Karmann]

Hi

I'm very happy that I have been able to use Vbullletin, but I have a problem:

I've imported users from discus, but the passwords didn't get imported. I knew that, but what I didn't know was that users were allowed to login WITHOUT password. How can I stop this???

[Zachery]

users should not be able to login without a password.

Users should need to reset their passwords before they are able to login via

login.php?do=lostpw

[Karmann]

users should not be able to login without a password.

Users should need to reset their passwords before they are able to login via

login.php?do=lostpw

Well, a user told me about it and I checked a random profil. I got in.
Anyway I can prevent this ?

[Zachery]

Did you confirm it? Prevent what?

[brisk_99]

Did you confirm it?

Zachery Darling...

I checked a random profil. I got in.

[Zachery]

Misread that, this should NOT be possible in any way shape or form.....

[Karmann]

Misread that, this should NOT be possible in any way shape or form.....

Be my guest: http://www.sunddebat.com/debat/

Any idea what I can do ?

[Steve Machol]

Confirmed. However this means that the import was not done correctly since passwords should have been imported:

http://www.vbulletin.com/forum/showthread.php?p=761893#post761893

I suggest redoing the import.

[Jerry]

The only way that could happen is if the discuss user file was diffrent and a blank string was imported, I would also advise redoing the import, or setting all of them to a random string to force the user to update the password.

[Karmann]

The funny thing is that if you check the Mysql all the fields are set with some code

[Jerry]

The funny thing is that if you check the Mysql all the fields are set with some code

Thats probally going to be MD5 hash of the salt and a blank field, which is why you can login with a blank password, i.e. thats what was imported, a blank password.

Try logging in with a random string opposed to a blank password.

This will force them all to change the password.

UPDATE user SET password='a8305446bf6faca25b8163335b56b03b' WHERE userid != 1; 

That's if your admin user is userid 1 and there arn't any other users in there that is !