Joomla 3.9.x Password Crypt Aid

Question

I have tried a few way to Crypt the password for the database. I have tried with out salting before entering it in to the DB Query and i have tried with a few function to salt before entering it. Not sure what i mite be missing. Below i will display the ways i have tried if anyone mite see what i am missing.

First Try:

$mypassword = JUserHelper::genRandomPassword(10);$salt = JUserHelper::genRandomPassword(32);
    $crypt = JUserHelper::getCryptedPassword($mypassword, $salt);
    $password_hash = $crypt.':'.$salt;
     //below is how i imputed it to my array.
     $udata = array(
         'name'=>$nUser,
         'username'=>$nUser,
         'password'=>$password_hash,
         'email'=>$nMail,
         'groups'=>array(2), // set the usergroup(s) here (id)
         );

Second Try:

$udata = array(
     'name'=>$nUser,
     'username'=>$nUser,
     'password'=>password_hash($mypassword, PASSWORD_DEFAULT),
     'email'=>$nMail,
     'groups'=>array(2), // set the usergroup(s) here (id)
     );

Also Tried This:

     $udata = array(
     'name'=>$nUser,
     'username'=>$nUser,
     'password'=>JUserHelper::genRandomPassword(15),
     'email'=>$nMail,
     'groups'=>array(2), // set the usergroup(s) here (id)
     );

This last one was with out hashing it just create the pass right in the array.

But with all trys i get this message on front end.

If i log in to the back end the account is there but can not log in till i change the password from the back end.

EDIT: Added Content.

function nUser_joomla($nUser, $myuuid, $myobject)
{
//$nUser = 'Test User 3';//$_GET['name'] <== Put this when using SL to URL Registration.
$arr = array($myobject,'@lsl.secondlife.com');
$nMail = implode("",$arr);

 $udata = array(
     'name'=>$nUser,
     'username'=>$nUser,
     'password'=>  ***THIS IS WHERE I PUT THE PASSWORD STRING.***,
     'email'=>$nMail,
     'groups'=>array(2), // set the usergroup(s) here (id)
 );
 $user = new JUser;

     $user->bind($udata);         
     $user->save();
     $userId = JUserHelper::getUserId($nUser);
       //return $userId;
       //The Issue Is Up Here ^^^^

  /// *** Everything Below is working
// Get a db connection.
$db = JFactory::getDbo();
// Create a new query object.
$sql = $db->getQuery(true);
$columns = array('id', 'asset_id', 'ordering', 'jid', 'sl_name', 'sl_uuid');
$values = array(0, 0, 1, $userId, $db->quote($nUser), $db->quote($myuuid));
$sql
->insert($db->quoteName('#__sljooma_user'))
->columns($db->quoteName($columns))
->values(implode(',', $values));

    $db->setQuery($sql);
    $db->execute();
 }

Answer 1

Several pointers/recommendations regarding your resolving code for you and future researchers.

1. implode() has a default "glue" of an empty space. PHP Manual When you want to join array elements into a string with no delimiter, you can omit the glue parameter and solely provide the array.

   $nMail = implode($arr);
   

   Or

   $nMail = implode([$myobject,'@domain.com']);
   

   Or simply:

   $nMail = "{$myobject}@domain.com";
   

2. date() default time is the as time(). PHP Manual For this reason, you can safely omit the second parameter from your date() call.

   $registerDate = date('Y-m-d H:i:s');
   

   That said, when ever I am setting up my table schema (whether it be a Joomla build or not) which must capture the INSERT time in the row, I configure the column (registerDate in this case) to generate the CURRENT_TIMESTAMP by default so that I don't need to produce it via php. Then, I simply do not pass that column as part of the INSERT query. Just something to consider.

3. Please avoid manually writing json strings. In this case, your data is not in any danger (and technically it will be more efficient in units of microseconds because it calls no functions), but if this practice is continued elsewhere in your project(s), then there is the potential to create malformed json strings. Trust json_encode() to always get it right for you.

   $params = json_encode(array_fill_keys(["admin_style", "admin_language", "language", "editor", "helpsite", "timezone"], ""));
   

4. Unfortunately, your queries are:

   • not secure (in terms of injection attack)
   • not stable (prone to breakage when a value contains a single quote)
   • not portable (might not work instantly if you change the database/environment)

   I prefer the beauty and simplicity of passing data to insertObject(). Joomla Manual

   Not tested:

   $user = (object)[
       'name'     => $nUser,
       'username' => $nUser,
       'password' => JUserHelper::hashPassword($mypassword);,
       'params'   => json_encode(array_fill_keys(["admin_style", "admin_language", "language", "editor", "helpsite", "timezone"], "")),
       'email'    => "{$myobject}@domain.com",
       'block'    => 'umm, you forgot to declare $block'
       // configure registerDate to generated automatically by the database
   ];
   $user_result = $db->insertObject('#__users', $user, 'primary_key');
   
   $user_gm = (object)[
       'user_id'  => $user->primary_key,
       'group_id' => $joomla_group
   ];
   $user_gm_result = $db->insertObject('#__user_usergroup_map', $user_gm);
   
   $user_sl = (object)[
       'id'       => 0, // not sure if this is necessary
       'asset_id' => 0,
       'jid'      => $user->primary_key,
       'sl_name'  => $nUser,
       'sl_uuid'  => $myuuid
   ];
   $user_sl_result = $db->insertObject('#__sljooma_user', $user_sl);
   

   after execution, $object->primary_key will be updated with the newly inserted row's primary key value.

Here is a simple demo of points #2 and #3.

Answer 2

So could not get it to work with "Juser", so i just used the code below. This cleaned it up and everything works right. :)

function nUser_joomla($nUser, $myuuid, $myobject, $mypassword, $joomla_group)
{
    $arr = array($myobject,'@domain.com');
    $nMail = implode("",$arr);

    $db = JFactory::getDbo();
    jimport('joomla.user.helper');
    $pass = JUserHelper::hashPassword($mypassword);
    $time = time();
    $params = '{"admin_style":"","admin_language":"","language":"","editor":"","helpsite":"","timezone":""}';
    $registerDate = date('Y-m-d H:i:s', $time);
    $query = "INSERT INTO #__users (`name`, `username`, `password`, `params`, `email`, `block`, `registerDate`) VALUES \n\t\t\t\t\t('" . $nUser . "', '" . $nUser . "', '" . $pass . "', '" . $params . "', '" . $nMail . "', '" . $block . "', '" . $registerDate . "')";
    $db->setQuery($query);
    $db->query();
    $last_id = $db->insertid();
    $query = "INSERT INTO #__user_usergroup_map (`user_id`, `group_id`) VALUES ('" . $last_id . "', '" . $joomla_group ."')";
    $db->setQuery($query);
    $db->query();    
    // Create a new query object.
    $query = "INSERT INTO #__sljooma_user (`id`, `asset_id`, `jid`, `sl_name`, `sl_uuid`) VALUES ('0', '0', '" . $last_id . "', '" . $nUser . "', '" . $myuuid . "')";  
        $db->setQuery($query);
        $db->query();
}

^^^ MAYBE LATER ILL FIX THE TABLE NAME TO MATCH THE COMPONENT ^^^ LOL

This was the function that works now, thank you everyone for your help. This is mounting up to be a great helpful community. :)