validation - Has the hash password function changed in magento? If so, to what? -

i using magento version 1.9.0.1.

for switching magento purposes need create login function customers outside magento framework.

i have looked method magento uses hash , validate passwords, method doesn't seem work anymore.

below code use validate user login outside magento. code try proof of concept , not being used in live environment obvious reasons :).

function checkpassword($entity,$passwordinput){     $query = mysql_query("select value customer_entity_varchar entity_id = '$entity' , attribute_id = '12' limit 1");     $fetch = mysql_fetch_object($query);     $fetch_data = explode(':',$fetch->value);     $hashed_password = $fetch_data['0'];     $salt = $fetch_data['1'];      $hashinput = md5($passwordinput . $salt);     if($hashinput == $hashed_password){         return 'success';     }     else{         return 'failure';     } } 

$entity entity_id passed after email validation,

$passwordinput password entered in login form.

it returns failure. i'm not surprised because when return $hashinput , compare $hashed_password it's not same.

has way magento hashes passwords been changed? or there mistake in code?

if check in \app\code\core\mage\customer\model\customer.php can find (near line 430) :

/**  * encrypt password  *  * @param   string $password  * @return  string  */ public function encryptpassword($password) {     return mage::helper('core')->encrypt($password); } 

the helper('core') \app\code\core\mage\core\helper\data.php

in \app\code\core\mage\core\helper\data.php, find :

/**  * encrypt data using application key  *  * @param   string $data  * @return  string  */ public function encrypt($data) {     if (!mage::isinstalled()) {         return $data;     }     return $this->getencryptor()->encrypt($data); } 

and getencryptor() function :

/**  * @return mage_core_model_encryption  */ public function getencryptor() {     if ($this->_encryptor === null) {         $encryptionmodel = (string)mage::getconfig()->getnode(self::xml_path_encryption_model);         if ($encryptionmodel) {             $this->_encryptor = new $encryptionmodel;         } else {             $this->_encryptor = mage::getmodel('core/encryption');         }          $this->_encryptor->sethelper($this);     }     return $this->_encryptor; } 

$this->_encryptor in \app\code\core\mage\core\model\encryption.php , in file can find :

/**  * encrypt string  *  * @param string $data  * @return string  */ public function encrypt($data) {     return base64_encode($this->_getcrypt()->encrypt((string)$data)); } 

and

/**  * instantiate crypt model  *  * @param string $key  * @return varien_crypt_mcrypt  */ protected function _getcrypt($key = null) {     if (!$this->_crypt) {         if (null === $key) {             $key = (string)mage::getconfig()->getnode('global/crypt/key');         }         $this->_crypt = varien_crypt::factory()->init($key);     }     return $this->_crypt; } 

(string)mage::getconfig()->getnode('global/crypt/key'); in /app/etc/local.xml file.

your variable $hashed_password pass last method.

your variable $hashinput pass there ?

---

so, can change in checkpassword() function :

$hashinput = md5($passwordinput . $salt); 

to

$hashinput = encryptpassword($passwordinput); 

thereby, $hashinput , $hashed_password follow same way.