Logging into the admin via URL

[rabbitdog]

Not sure if this would be better posted in the hacks forum... but:

Anyone know what values/variables you need to pass to pages within the bulletin board admin to identify the user as an admin?

I'm trying to bypass the login page to access inside admin pages from other places on the site if a user is a valid admin.

Thanks in advance.

[Steve Machol]

http://www.yourdomain.com/forums/admin/?loginusername=AdminName&loginpassword=password

If there's a space in the admin name, use %20 in place of it. Also I hightly recommend you protect the admin directory with htaccess if you decide to do this. Heck you should protect it anyway.

[rabbitdog]

Cool thanks...one last question, if I pull the username and password from the cookie, will that cause problems? I notice the password is already encrypted in the cookie, but obviously the login takes a plain text password and ecrypts it to check against the database.

[Steve Machol]

AFAIK that shouldn't cause any problems

[rabbitdog]

Weird... it definately causes problems. It says the password is invalid.

[Steve Machol]

I guess I don't undertand what you meant by pulling 'the username and password from the cookie'. I assumed you meant when IE saves your login info and automatically fills in the data.

[rabbitdog]

No...I was talking about the forum cookie which stores the userid and md5(password) ($bbuserid and $bbpassword) thanks for all your help though , I guess I'll just have to require manual password entry.

[Steve Machol]

I still don;t understand what you mean pulling the username and password from the cookie. How exactly are you pulling this?

Also what's wrong with the sample URL I posted above? It works just fine for me.

[rabbitdog]

I have a custom script that runs from the admin directory that needs to be posted to from a non-vbb script on the site as well as run from the admin....

When you log in to the boards, I guess the vbb sets a cookie that contains your userid and password along with some other info.

So, on my non-vbb script I have a form that posts to the custom script within the vbb admin directory. I pull the userid and password from the cookie and validate against the database that the user is an admin. If they are, the form displays, and they should be able to submit it to the script within the admin directory...

Problem is that it always asks for the password when I submit the form. I used your suggestion of also posting those two variables, but when I post the md5 version of the password contained within the cookie, the vbb admin script doesn't recognize it as being the right password... it works fine if I manually enter the password in plain format.

I was wonder if there was a way around having to manually enter the password so I could just use the cookie info instead.

Hope that explains it :\

[Steve Machol]

Well you lost me through more of that. I have no idea how any of this would affect how you access the Admin CP.

but when I post the md5 version of the password contained within the cookie, the vbb admin script doesn't recognize it as being the right password

Why are you using md5 password? The non-encrypted one is the one you'd use.

[rabbitdog]

the md5 password is what's stored in the cookie...I just wanted to avoid having the user have to enter their password, but it seems unavoidable.

Thanks again for your help =)