Can anyone help with this little conundrum?

Hi guys,

Apache
Evolution 1.0.4
PHP 5+

I’m moving a site into MODx.
There are over 700+ active users of the website. I have recieved a spreadsheet of their details.
The passwords are stored as hashes (of course) however they are not the standard md5 hashes I am used to seeing with MODx.

The hashes start with: $1$ and were generated using the php crypt function.

Problem is I want to be able to use webLoginPE and the MODx web user backend for user admin.
If I store these hashes authentication will fail (I am assuming).

I have looked into converting the hashes above into standard md5 hashes, but the more I research the more I feel like I will end up in jail for hacking

Can anyone suggest a solution. I guess I could hack webLoginPE to use crypt, but this will mean I can’t set the PW in the MODx Manager, unless I hack that too!!!

Help Please

J

CRYPT_MD5 - MD5 hashing with a twelve character salt starting with $1$

You can’t do anything with these; hashes are one-way encryption functions. Those passwords are not compatible with MODx.

However. It should be possible to bypass the normal MODx web user creation/login functions with plugins that will use crypt() instead of md5(). This would take a bit of work, but should be doable.

Or... you could simply change everybody’s password using MODx functions, sending everybody an auto-generated email with their new password.

Quote from: sottwell at Sep 14, 2010, 08:12 AM

Or... you could simply change everybody’s password using MODx functions, sending everybody an auto-generated email with their new password.

Thanks for the reply Susan. This is the one option that is not an option! The client wants as little impact (IE none at all) on the users. For this reason I think my only course of action is:

- Hack webloginpe.class.php and encrypt all passwords using crypt, saving to the password field in modx_web_users.
- I will then change the authentication functions to crypt rather than md5.

This will effectively mean I can’t use Security -> Web Users (well at least the password part of it), however this is not a big deal as I am writing a module to handle my users.

Thanks for help