salt value in user table

[R. Bewley]

Hi,

I've since upgraded to vB3, and in adding users directly to the database (manually converting from another board), how is the "salt" value generated?

Also, where else do I need to add user information for new users besides the user table?

Thanks,
Richard

[Jake Bunce]

The salt is randomly generated by this function in the includes/functions_user.php file:

// ###################### Start makesalt #######################
// generates a totally random string of $length chars
function fetch_user_salt($length = 3)
{
	$salt = '';
	for ($i = 0; $i < $length; $i++)
	{
		$salt .= chr(rand(32, 126));
	}
	return $salt;
}

All users must have a userfield and usertextfield record.

[R. Bewley]

Perfect, exactly what I was looking for. Thanks!

[R. Bewley]

One more question/problem. What are the salts used for? I added in my conversion script when inserting rows into the user table to use that function and generate a random salt to add to the database. But, I still cannot login as the users I am adding, any ideas?

[R. Bewley]

Oh, I believe I would have to re-generate the password hashes with the salt values. Is it possible to do this if I only have the md5 hashes (without the salts)?

[Jake Bunce]

The salt is used to further secure the password hash for each user. The stored passwords are generated like this:

md5(md5($password) . $salt)

If you already have the md5() hash of the original password then you can concatenate the salt onto it and hash it again to get the correct hash.

[R. Bewley]

Thanks a lot. That did the trick, in case you're interested I did finish converting my forums, and the finished product is http://forums.betarun.net/.

Thanks again for your help,
Richard