Hello vbmods!

[phands]

I'm Paul. I'm CTO of a small New York based startup, annum.com. We are a digital/tele health company, focusing initially on helping people who suffer from Alcohol Use Disorder in the USA...later globally. I'm an ex-employee of some global-scale companies, such as Google and Salesforce, where I worked in worldwide scalable infrastructure. Coming to a startup is the most fun I've had in years, as I get to build a globally scalable product to improve people's quality of life, and thoroughly enjoy what we do.

The reason I'm here is that we use VBulletin as one part of our treatment regime - as a social forum where people in our treatment program can post and discuss their experiences and support one another as they head toward a new relationship with alcohol (not necessarily abstinence!). We also have a React Native mobile app on Android and iOS where Participants get the majority of their treatment. The VB forum is accessed only from within that App at present, and I'm trying to find a way to automatically log into VB via the API or then V5-4-1 rebuilt third-party login capability.

Separately, I'd also like to be able to register new users programmatically via the API, as we may scale rapidly, making manual entry unfeasible. Even if I could upload a CSV file with those new users, that would help. This is not from the App, just via an internal PHP mod to VB in our current setup.

I've been trying for a few weeks to use the examples that can be found on various VB forums and helps sites, but I'm not a PHP expert, and have got really nowhere. The problem is that the API documentation is average, and the examples are all quite old. I can add new PHP scripts to the LAMP stack that we use, and can make them work just fine, but anything that tries to use the API examples given just fails silently....hence me showing up here!

I'm interested in free or paid mods to do these things, or some pointers as to how I can use the API or the new 3rd party login system.

Any and all input welcome, and you'd be helping a worthy cause!

Thanks, and regards,

Paul

[glennrocksvb]

Hi Paul aka phands! Thanks for joining and the nice intro.

Have you tried this for the login?

https://www.vbulletin.com/forum/blogs/david-grove/4327147-how-to-log-into-vbulletin-from-an-external-script-on-your-website

And the vB5 API documentation

http://vb5support.com/resources/api/

[phands]

Hi there, and thanks for the fast reply.

The link is exactly what I tried as a template, and have tried it many times, making experimental changes, and instrumenting the code with echo statements. Whatever I do so far, any of the api calls just seem to do nothing - no return value gets assigned to the relevant variable.

For instance, the call "$api = Api_InterfaceAbstract::instance();" always returns nothing, which is what the API document you linked to says (there is no return value shown), but silently moves on to the next line... "$loginInfo = $api->callApi('user', 'login', array($username, $password));" similarly seems to do nothing and $loginInfo is empty. However $logininfo is used later in the code, in the cookie setting.

In any case, even when I pass a known user and password, the login still doesn't happen.

Again, being a PHP and vB novice probably means I'm doing something stupid, or have the wrong expectations.

[glennrocksvb]

Is the script running on the same server as vBulletin?
Did you change $vbpath to the correct path to your vbulletin instance?
No PHP errors? Try adding error_reporting(E_ALL); at the top of the script.

[phands]

Hi...yes, the code is running on the same LAMP stack. The $vbpath variable is correct. The code is in the root of the apache tree. Other code in the same file works, such as stuff I wrote to pull extra info out of a URL query. Only the vB API calls do nothing,

Thanks,

P

[glennrocksvb]

Can you PM the code?

[phands]

will do...I have to clean up the plethora of debug "echo" statements first. The code is a short snippet based on the example. None of the stuff in it is confidential - we haven't gone live yet, and the whole build is experimental.
.

[phands]

I couldn't see a PM button, so here's the code anyway. Note that I'm very aware of the bad idea that is sending a password in a URL query sting, but . this is for test purposes only. Once I get the login working in principle, I'll change that.

:~/htdocs$ more logintest.php

<?php


// Path to your vBulletin installation

$vbpath = '/opt/bitnami/apache2/htdocs';

echo "VBPath is: $vbpath .";

echo "<br>";

echo "Attempting to start VBulletin session. <br>";

// Start login script

define('CSRF_PROTECTION', false);

require_once($vbpath . '/includes/vb5/autoloader.php');

vB5_Autoloader::register($vbpath);




/*

$autoarray = vB5_Autoloader::getAutoLoadInfo();

$len=count($autoarray);

echo($len);

echo "Autoloader returned: $autoarray[0] <br>";

for ($x=0;$x<$len;$x++)

{

echo "Autoloader return value $x is: =";

echo "$autoarray[$x]";

echo "=";

echo "<br>";

}

*/







vB5_Frontend_Application::init('config.php');




echo "Got past VBulletin Frontend initialization";

echo "<br>";

echo "Server Request Method is: " . $_SERVER['REQUEST_METHOD'];

echo "<br>";

echo "Raw Request URI is: " . $_SERVER['REQUEST_URI'] . "<br>";

//echo urldecode($_SERVER['REQUEST_URI']);

//echo "<br>";

$myurl = $_SERVER['REQUEST_URI'];

echo "<br> url decoded is: ";




echo urldecode($_SERVER['REQUEST_URI']);

echo "<br> Entities is: ";

echo htmlentities($_SERVER['REQUEST_URI']);

echo "<br> Decoded URL is....";

$decodedurl = urldecode($_SERVER['REQUEST_URI']);

echo $decodedurl . "<br>";

$shrapnel = explode("?", $decodedurl);

echo count($shrapnel) . "<br>";

echo $shrapnel[0] . " ...and... " . $shrapnel[1] . "<br>";

$realquery = $shrapnel[1];

echo "Real query is: " . $realquery . ". <br>";

$fragments = explode("&", $realquery);

echo "User Name Fragment is: " . $fragments[0] . "<br>";

echo "Password Fragment is: " . $fragments[1] . "<br>";

$username = explode("=", $fragments[0]);

echo "Username is: " . $username[1] . "<br>";




$password = explode("=", $fragments[1]);

echo "Password is: " . $password[1] . "<br>";










/*

echo "<br>";

var_dump(parse_url($myurl));

echo "<br>";

var_dump(parse_url($myurl, PHP_URL_SCHEME));

echo "<br>";

var_dump(parse_url($myurl, PHP_URL_USER));

echo "<br>";

var_dump(parse_url($myurl, PHP_URL_PASS));

echo "<br>";

var_dump(parse_url($myurl, PHP_URL_HOST));

echo "<br>";

var_dump(parse_url($myurl, PHP_URL_PORT));

echo "<br>";

var_dump(parse_url($myurl, PHP_URL_PATH));

echo "<br>";

var_dump(parse_url($myurl, PHP_URL_QUERY));

echo "<br>";

var_dump(parse_url($myurl, PHP_URL_FRAGMENT));

echo "<br>";

*/







$api = Api_InterfaceAbstract::instance();

$loginInfo = $api->callApi('user', 'login', array(
    $username,
    $password
));

echo "LoginInfo1 is: - " . $LoginInfo . " - <br>";

$cnt = count($LoginInfo, 1);

echo $cnt;

echo "<br>";

//header("Location: http://34.239.115.226");

//exit();










if ($_SERVER['REQUEST_METHOD'] == 'GET') {

    /////////////////////////////////////////////////////////////////////////////////

    // process the login form




    $api = Api_InterfaceAbstract::instance();

    $loginInfo = $api->callApi('user', 'login2', array(
        $username,
        $password
    ));



    echo "Got into Server login2 method";

    echo "<br>";




    if (empty($loginInfo['errors'])) {

        // set cookies

        vB5_Auth::setLoginCookies($loginInfo, '', !empty($_POST['remember']));

        echo "Set login cookies <br>";

        // redirect somewhere Also see: vB5_Auth::doLoginRedirect();

        header('Location: vb5_external_login.php');

        exit;

    }

    else {

        echo "Login Error <br>";

        // there was a problem logging in.

        // redirect or display errors here

    }

}

else {

    ///////////////////////////////////////////////////////////////////////////////////////

    // display a login form




    $userid = vB5_Cookie::get('userid', vB5_Cookie::TYPE_UINT);

    $hash = vB5_Cookie::get('password', vB5_Cookie::TYPE_STRING);

    echo "Got into Login form";

    echo "<br>";

    echo "UserID is: $userid";

    echo ", and Hash is: $hash";







    if (empty($userid) OR empty($hash)) {

?>

<form action="vb5_external_login.php" method="post">




<input type="text" name="username" value="" placeholder="User Name" />

<input type="password" name="password" value="" placeholder="Password" />

<label><input type="checkbox" name="remember" /> Stay logged in?</label>

<input type="submit" value="Log In" />




</form>



<?php

    }

    else {

        echo 'Already logged in';

    }

}

[glennrocksvb]

Please wrap the code in [PHP] or [Code] tags for readability. I already did it for you here but please do so going forward.

[glennrocksvb]

1. Try adding error_reporting(E_ALL); at the top to see PHP notices and errors.
2. PHP variables are case-sensitive. You declared $loginInfo variable but in some lines you reference it as $LoginInfo (note the uppercase L).
3. Why are you retrieving the username and password user inputs from the URL? The form method is POST not GET, so you should retrieve them as:

$username = $_POST["username"];
$password = $_POST["password"];  

[glennrocksvb]

Note that I'm very aware of the bad idea that is sending a password in a URL query sting, but . this is for test purposes only.

Just saw this note. Why then you are not using $_GET['password'] to retrieve the password from querystring? But either way, I recommend using POST right away. There's no benefit using GET for testing when in the end, it will be changed to POST.

[phands]

Hi again, and once again, thanks for pitching in. I will be sure to put it in Code tags henceforward.
I added the error_reporting(E_ALL); as you suggested/ . It didn't make an visible difference to the output on screen...do errors get logged elsewhere?
Great catch on the mixed-case Ls...I must have looked at that code 1000 times!
I agree the retrieval of username and password should not be done that way - I just needed a fast way to test the login code. The URL parsing will go away once I get login working, and then we'll use a secure and encrypted method. It's an embedded webview in a phone app, which never shows the URL anyway, but I'll never send passwords in clear text anyway.

When all else is said and done, I can'r make the login API call work, even if I pass in the username and password direct.

[glennrocksvb]

Can you post or PM the URL to the script?

[phands]

Hi....sorry for the delay in replying...was out of office. With your help, I got it working! I corrected the upper/lower confusion that you spotted, converted over to $_POST, and now I can login a known user, returning a session hash and other useful info!

Now I can clean up and add proper error trapping before handing it to another developer to check it's production ready.

Thanks you VERY much...VBMods Rocks....well rocks!!!

[glennrocksvb]

Glad you got it working