2

I have an old Drupal 6 website with about 1000 active users and I want to replace it with new OpenCart 1.5 installation.

How to find out their passwords and copy them?

If I'm not mistaken Drupal 6 uses MD5 without a salt to store passwords as well as OpenCart 1.5. Would a simple copy/paste of the MD5 HASH code work?

7
  • You're correct, Drupal 6 uses MD5 with no salt. If OpenCart 1.5 does the same then yes, you can just copy the hashes - they're nothing more than fixed-length strings.
    – dartonw
    Commented Sep 27, 2014 at 1:54
  • You can always create a test case. Create the same user on each system with different passwords. Copy from the password from the Drupal account to the OpenCart account and log on to OpenCart with the Drupal password. You will have your answer. Simple.
    – closetnoc
    Commented Sep 27, 2014 at 4:09
  • @dartonw Digging deeper it seems that OpenCart is using MD5 with salt to store passwords. What I did: 1. Create user in Drupal 2. Create user in OpenCart (username and email are the same) 3. Replaced password data in OpenCart with Drupal's hash and deleted the salt field. Surprisingly for me that worked. I've done just a single user test. Now need to figure out how to bulk add users at once.
    – venta7
    Commented Sep 27, 2014 at 14:43
  • To copy them, assuming username and emails match on Drupal and OpenCart, then a PHP script run on COPY of the database will do it
    – Steve
    Commented Sep 28, 2014 at 5:49
  • @Steve I'm not familiar with PHP and SQL queries, could you give an example or something like a template to follow? Thanks a lot
    – venta7
    Commented Sep 28, 2014 at 7:49

1 Answer 1

1

My suggestion is not to do this. I would tell the users that you're making a change/upgrade/switch over to a new system. Tell them they'll be prompted for a new password the next time they login and have them set it up. It's a good opportunity to force everyone to change their password (better security practice). You don't have to tell them they can use their old password, so some will try this anyway and it should let them. At least some of your users, if not most, will change their passwords. If any of them have ever had their passwords stolen from another source, they'll be less exposed on your site.

I realize this isn't directly what you're after, but I encourage you not to go the down the path you're taking. Plus, it's simply easier, at risk of being slightly inconvenient for your users. At least they'll know what's happening to the degree they need to. It may even provide win you some cool points with your users for looking out for their best interest. If you tell them that you are, then they'll be less likely to get upset about it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.