vanilla / garden-password Goto Github PK

Hi! I found this trying to migrate from an old MyBB forum to vanilla.

I created password on my MyBB forum:
Password: testing user salt: PNjAshLI -> Hash: 0a26a9d4a87e66b104c1ec5143c87486
looking at the code from MyBB:
https://github.com/mybb/mybb/blob/c243e6a875467605d949dc6974c9da2e35549a93/inc/functions_user.php#L198

/**
 * Salts a password based on a supplied salt.
 *
 * @param string The md5()'ed password.
 * @param string The salt.
 * @return string The password hash.
 */
function salt_password($password, $salt)
{
	return md5(md5($salt).$password);
}

looks like salt_password ended as hashRaw function here
https://github.com/vanilla/garden-password/blob/master/src/MybbPassword.php#L23
however, this is wrong, as per the function description, password needs to be md5()'ed before.

after making this change:

/**
     * Hashes a password with a given salt.
     *
     * @param string $password The password to hash.
     * @param string $salt The password salt.
     * @return string Returns the password hash.
     */
    private function hashRaw($password, $salt) {
-        $calc_hash = md5(md5($salt).$password);
+       $calc_hash = md5(md5($salt).md5($password));
        return $calc_hash;
    }

it worked like a charm