Passwords?

timnsal · Novice Joined: Aug 08, 2007 Posts: 20

When a user is mapped from phpbb3 to gallery2, should the user's password in both be the same so the user could log directly into either phpbb3 or gallery? I thought it used to be in the earlier integration, but I'm fairly sure phpbb3 changed how passwords are stored in the last update.

Discovered trying to use gallery remote that it doesn't work any more because I don't know the gallery password Embarassed

Sally

AdBot

jettyrat · Moderator Joined: Nov 28, 2005 Posts: 1144

This needs to be noted in better detail in the installation instructions. Here is the deal with integrating gallery. If you are going to use gallery in it's embedded mode, then standalone access should be disabled for several reasons. Not the least of which is that the integration does not do reverse syncing unless you specifically run the user export (which is only intended to be run once). People who login to gallery and create accounts do not get an account in phpbb and things can get out of sync easily. There is no real reason to allow users direct access to gallery when they can login to phpbb3 and get to everything in gallery that way. I admit I don't know much about gallery remote though.

The problem with passwords is that gallery uses a different method to store them. I believe they both use md5 as the hashing algorithm, but gallery uses a salted form where they generate a string of random characters and pre-pend that to the user password before it is hashed and the string is stored along with the password for later use when the user logs in again. I'm not sure what the logic is exactly to this method, but the result is that a user exported from phpbb3 will not be able to login directly to gallery because only the phpbb3 password is stored. Another reason to disable standalone gallery.

If you use the same password when you first created your admin account in gallery as the admin account in phpbb3, you should still be able to login directly to gallery because the integration did not have create a new user for the admin, but just add an external id mapping. So both methods of logging in work for the admin, but no other users will have this advantage.

Does that make any sense?

jettyrat · Moderator Joined: Nov 28, 2005 Posts: 1144

Here is the part in gallery2/config.php that should be changed:

Code: › /*
* Embedded mode. You can disable direct access to main.php (standalone G2)
* by setting this flag. Set value below to:
* true (without quotes) - block direct requests
* url (with quotes) - redirect requests to this url
* false (without quotes) - allow direct requests
*/
$gallery->setConfig('mode.embed.only', false);

jettyrat · Moderator Joined: Nov 28, 2005 Posts: 1144

You could probably 'force feed' a new password to the gallery db if you are locked out. Not sure though, haven't ever tried it with gallery before. I have with other apps though. Basically just write a little script that duplicates the gallery algorithm, enter your password, copy and paste to the gallery user db.

Web Hosting India