This makes it exceedingly difficult for an attacker to decrypt the password hashes on your forum. I recommend doing this while you have a small number of members on your forum.
First up, open inc/functions_user.php in your favorite text editor, search for the following function.
PHP Code:
function salt_password($password, $salt) { return md5(md5($salt).$password); }
Come up with a random 5 character long combination of letters and numbers, I'm going to use 3g45h in the example.
Modify the above function so that it looks like this:
PHP Code:
function salt_password($password, $salt) { return md5(md5(md5($salt).$password)."ss1t3"); }
It may seem a little overboard, but the security of your member's passwords is the most important thing.
Open PHPMyAdmin and navigate to your mybb_users table, manually update each users password, by following the next step. Open http://www.adamek.biz/md5-generator.php then enter the user's current password hash, with your 5 random characters at the end.
For example.
Code:
1a79a4d60de6718e8e5b326e338ae533
Becomes
Code:
1a79a4d60de6718e8e5b326e338ae533ss1t3
Click "Calculate MD5".
Copy the new hash and replace the user's old password.
Upload your modified functions_user.php to your server.
Now if an attacker attempts to crack the hashes, it's useless unless they know your 5 random characters.
