Looking for a profile update hook with uncrypted password

  • ggodart

    (@ggodart)


    11 years, 11 months ago

    Hello,

    I use the [profile_update] hook to reflect on another platform a user profile update. But the provided password is encrypted (since the hook is done after setting db). Does anyone know a way to get the password uncrypted ? For example another hook or another way to reach the same goal…

    Regards
    Guillaume
    PS: The hook [password_reset] (which is called when using the feature “Forgot password”) provided an uncrypted password

Viewing 3 replies - 1 through 3 (of 3 total)
  • luckdragon

    (@luckdragon)

    11 years, 11 months ago

    does the $_POST variable get changed before adding it to the db? if not, you can use that.

    Moderator bcworkz

    (@bcworkz)

    11 years, 11 months ago

    The password handling uses a one way hash cipher. It’s essentially impossible to determine the password from the resulting hash. Passwords are verified by hashing the user input and comparing it to the stored hash value. This only works inter-platform if both platforms not only use the same hash function, but also use the exact same salt.

    I’m not answering your question, but I hope you better understand what you’re dealing with now.

    PS: The password reset is unencrypted, but the user is forced to change the password once they use it, so it doesn’t really help here.

    Interestingly, the monsterID icons next to our usernames use a similar system. The monster is created from a hash of your email address. It’s impossible to derive your email address from the monster elements, but the email is hashed the same way each time so you always get the same monster, even on different sites, because the salt is built into the monsterID function.

    Thread Starter ggodart

    (@ggodart)

    11 years, 11 months ago

    Thank you very much luckdragon, it worked !

    Well done.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Looking for a profile update hook with uncrypted password’ is closed to new replies.