phpBB • Free and Open Source Forum Software

At the moment passwords are escaped form before hashing is done. E.g.a & character is escaped to & before the md5 hash is calculated.

Because it is done when the password is set AND when the password is verified, everything seems to work as it should. But unless there is a strong reason to do the transformation I would suggest to hash the unescaped form because many forum systems probably use this form. (perhaps you know the phpBB 2.x forum software, which just uses the md5 over the original password Wink

)

Changing it now would prevent some broken passwords when the first official converters appear

Every forum has some quirks in how it hashes the password, including phpBB 2 itself which does not hash the password directly as entered but an escaped form of it (although escaped differently).

So far I'm concerned it is unavoidable that there will be a number of passwords which will need resetting after a conversion ranging from a small number if coming from phpBB 2 (ie those with special characters in them) to all of them if coming from software which manipulates the hash in other ways before storing it.

So from the conversion perspective there is nothing to fix here - we cannot guarantee that 100% of passwords will work on a conversion unless we have the original password in plain text which clearly we won't have Wink

There is however a possible concern with this code related to the authentication plugins which needs investigating and may be a valid bug

The forum passes the password in the escaped form to the auth plugin so any plugin which relies on external passwords would have to unescape it first before it checks the password - like the LDAP auth plugin or some 3rd party plugins

You could easily call this a feature but that would make the plugin interface somewhat unintuitive.

If you want to keep Olympus password compatibility, you could decode it for the plugin and reencode it in the plugin though Wink