Hey @emeraldsanctum,
This is a very specific use case. I don’t know why you’ve got a system that stores the username with the password but this is certainly not typical practice.
If I understand correctly, you are concatenating username, a colon and the password and then using a SHA1 hash on that entire string? If this is true, I imagine this has be done to prevent rainbow attacks by using the username and colon as a salt when you hash the password. Not helpful now, but I would recommend that the old system should be using BCRYPT as this will not only handle generating unique salts but is also using a slow algorithm to protect against brute force attacks.
I don’t really want to clutter the settings of the plugin and do the extra work for a single use case.
However I would like to offer you a simple solution. If you’re happy to add a single line of code to the plugin you could make this work for just your build.
The reason I wouldn’t want to do this if I were in your shoes is that as soon as the plugin is updated you would lose this change and have to re-add it. If the core functionality of the file changed in a future update this could also break the system.
However, if you set the plugin to use the SHA1 hash with no salt and then in the file wordpress_external_login_plugin/login/db.php before the line . . .
$valid_credentials = exlog_validate_password($password, $userData->{$db_data["dbstructure_password"]}, $user_specific_salt);
. . . you could add a line something like this . . .
$password = strtoupper(esc_sql($username)) . ":" . $password;.
If you’re comfortable with development you could always fork the project from it’s public repository on github: https://github.com/tbenyon/wordpress_external_login_plugin
You’d have your own copy of the plugin then.
If you were really keen for this functionality and wanted to make a reasonable donation I’ll look at putting hidden functionality in for you to the actual plugin.
I’m happy to discuss this further if you think I’m being unreasonable but I think this is a one off use case that is specific to your needs.
Thanks,
Tom
🙂
