Zen Cart Logo
Forums / Upgrading from 1.3.x to 1.3.9 / Upgraded from v1.39h to v1.57c, passwords upgraded too?

Upgraded from v1.39h to v1.57c, passwords upgraded too?

Views: 5,454

Results 1 to 3 of 3
26 Jan 2022, 4:02 AM
#1
split63 avatar

split63

Totally Zenned

Join Date:
May 2010
Location:
Texas
Posts:
513
Plugin Contributions:
0

Upgraded from v1.39h to v1.57c, passwords upgraded too?

When v1.39h was upgraded to 1.57c, the customers_password entries in the DB were also upgraded
Given that our Server PHP = 5.6, the passwords should be upgraded by the php password_hash() right?
More specifically: password_hash($plain, PASSWORD_DEFAULT)

However, a separate utility which accesses the DB to validate customers, fails because it gets a different result.

password_hash($entered_password, PASSWORD_DEFAULT) does not match $customers_password in the DB

When I display the two long strings, they both start the same $2y$10$..... but after that, they are different.

Was the DB not upgraded with the php password_hash() function?

26 Jan 2022, 1:42 PM
#2
swguy avatar

swguy

Administrator

Join Date:
Feb 2006
Location:
Tampa Bay, Florida
Posts:
10,682
Plugin Contributions:
56

Re: Upgraded from v1.39h to v1.57c, passwords upgraded too?

The upgrade does not modify customers_password other than to extend its length.
If you want to write password matching logic you'll need to study includes/classes/class.zcPassword.php and use the same techniques.

26 Jan 2022, 4:14 PM
#3
split63 avatar

split63

Totally Zenned

Join Date:
May 2010
Location:
Texas
Posts:
513
Plugin Contributions:
0

Re: Upgraded from v1.39h to v1.57c, passwords upgraded too?

The fix was to use this command: if (password_verify($plain, $customers_password)){