Converters: Audit imported password upgrades across all platforms

[johnjamesjacoby]

#3683 exposed that importer password verification had drifted from current upstream password formats. Audit every bundled production converter that stores _bbp_password and participates in the first-login upgrade path.

Scope

• Inventory each converter's source platform, supported source versions, password formats, and intentional reset-only behavior.
• Verify current upstream hashing behavior from primary sources. Do not assume that an old converter implementation still covers the platform's current formats.
• Identify converters whose authenticate_pass() intentionally returns false (currently Mingle, bbPress1, SimplePress5, and Vanilla) and document whether password upgrades can be supported safely.
• Keep phpBB 2 database-schema support distinct from phpBB 3's compatibility with accounts migrated from phpBB 2. Canonical bbPress has only bundled a phpBB 3 converter.

Test coverage

Add a shared fixture/test pattern where practical, plus converter-specific cases for:

• correct and incorrect passwords for every supported hash format;
• malformed, missing, oversized, and unsupported serialized password metadata;
• the full callback_pass() path, including WordPress password replacement, converter metadata cleanup after success, and metadata retention after failure;
• username and email login paths;
• whitespace, quotes, slashes, HTML-special characters, and non-ASCII passwords, accounting for each source platform's input normalization;
• source-database configuration no longer being available at first login.

Document any format that cannot be verified safely and confirm that it fails closed with a usable password-reset path. Avoid weakening comparisons or accepting ambiguous legacy formats to make tests pass.

Acceptance criteria

• Every bundled production converter has an explicit supported/unsupported password matrix.
• Automated fixtures cover every supported format and the shared first-login behavior.
• Unsupported formats and reset-only converters are documented.
• Any fixes discovered by the audit are narrow, backwards compatible, and committed with their regression tests.

Related: #3683, #3669, #1886.

[johnjamesjacoby]

In 7536:

Converters: Fix MyBB password upgrades.

Correct MyBB 1.6 salted MD5 verification and ensure the converter class metadata is imported so first-login password migration can run. Add coverage for password metadata, verification, malformed data, and the complete WordPress password upgrade path.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7537:

Converters: Fix MyBB password upgrades.

Correct MyBB 1.6 salted MD5 verification and ensure the converter class metadata is imported so first-login password migration can run. Add coverage for password metadata, verification, malformed data, and the complete WordPress password upgrade path.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7538:

Converters: Fix FluxBB password upgrades.

Verify FluxBB 1.2 MD5, 1.3 salted SHA-1, and newer SHA-1 passwords using their native formats. Detect the optional legacy salt column without breaking current schemas, import the converter class metadata, and add first-login upgrade coverage.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7539:

Converters: Fix FluxBB password upgrades.

Verify FluxBB 1.2 MD5, 1.3 salted SHA-1, and newer SHA-1 passwords using their native formats. Detect the optional legacy salt column without breaking current schemas, import the converter class metadata, and add first-login upgrade coverage.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7540:

Converters: Fix PunBB password upgrades.

Verify current salted SHA-1 and legacy unsalted SHA-1 and MD5 passwords using PunBB's native formats. Preserve printable salt characters through WordPress metadata writes, import the converter class metadata, and add first-login upgrade coverage.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7541:

Converters: Fix PunBB password upgrades.

Verify current salted SHA-1 and legacy unsalted SHA-1 and MD5 passwords using PunBB's native formats. Preserve printable salt characters through WordPress metadata writes, import the converter class metadata, and add first-login upgrade coverage.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7542:

Converters: Fix Phorum password upgrades.

Verify Phorum 5.2 passwords using their native unsalted MD5 format, remove nonexistent salt handling, and import the converter class metadata so first-login migration can run. Add coverage for metadata, verification, malformed input, and the complete WordPress password upgrade path.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7543:

Converters: Fix Phorum password upgrades.

Verify Phorum 5.2 passwords using their native unsalted MD5 format, remove nonexistent salt handling, and import the converter class metadata so first-login migration can run. Add coverage for metadata, verification, malformed input, and the complete WordPress password upgrade path.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7544:

Converters: Delay source database connections until import.

First-login password upgrades use the legacy hash and salt already stored in WordPress user metadata, but converter construction also required the source database to remain available. Connect to the source database only when table conversion begins so imported users can upgrade their passwords after the source database has been retired.

This preserves converter construction and extension points, retains the existing import connection error, and adds coverage for successful and unsuccessful first-login attempts without a source database connection.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7545:

Converters: Delay source database connections until import.

First-login password upgrades use the legacy hash and salt already stored in WordPress user metadata, but converter construction also required the source database to remain available. Connect to the source database only when table conversion begins so imported users can upgrade their passwords after the source database has been retired.

This preserves converter construction and extension points, retains the existing import connection error, and adds coverage for successful and unsuccessful first-login attempts without a source database connection.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

The shared first-login path also required the source forum database to remain available after an import completed.

bbp_user_maybe_convert_pass() constructs the selected converter so it can call that converter's existing authenticate_pass() method. The converter base constructor initialized both database objects and immediately connected to the source database, even though callback_pass() reads the imported hash and salt from _bbp_password in the WordPress database and does not query the source database.

The source db_connect() call now runs when convert_table() begins an actual source-data conversion. Converter constructors, setup_globals(), password algorithms, the bbp_new_converter() API, and its filter remain unchanged. Actual imports retain the same connection failure error and JSON response.

After a successful import, the source database is therefore no longer required for supported first-login password upgrades. A correct legacy password is replaced with a normal WordPress password hash and _bbp_password plus _bbp_class are removed. An incorrect password fails closed, keeps the empty WordPress password, preserves both metadata values, and does not connect to the source database.

Regression coverage exercises both successful and unsuccessful phpBB-backed first-login attempts and explicitly confirms that neither opens the source database connection.

Focused tests: 2 tests, 8 assertions.
Full suite: 917 tests, 2,187 assertions, 5 skipped, 355 incomplete.
PHPCS and whitespace checks pass.

Committed to branches/2.6 in [7544] and to trunk in [7545]. Documentation: ​Imported user passwords now explains the first-login upgrade lifecycle and when the source database may be retired.

[johnjamesjacoby]

In 7546:

Importers: Improve first-login password handling.

Preserve the literal legacy password for verification while passing WordPress the slashed value it expects when storing the upgraded hash. Also support email login and the password 0, and reject malformed non-string credentials.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7547:

Importers: Improve first-login password handling.

Preserve the literal legacy password for verification while passing WordPress the slashed value it expects when storing the upgraded hash. Also support email login and the password 0, and reject malformed non-string credentials.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7548:

Importers: Correct AEF password upgrades.

Use AEF 1.0.9's charset-aware escaping and salted MD5 algorithm when verifying imported passwords, and store the converter class under the valid user mapping. Add focused and end-to-end regression coverage.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7549:

Importers: Correct AEF password upgrades.

Use AEF 1.0.9's charset-aware escaping and salted MD5 algorithm when verifying imported passwords, and store the converter class under the valid user mapping. Add focused and end-to-end regression coverage.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7550:

Importers: Recover password upgrades without class metadata.

Use the saved importer platform when an imported user retains _bbp_password but lacks _bbp_class. Existing per-user converter metadata remains authoritative, password verification still fails closed, and normal conversions continue to connect to the configured source database.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7551:

Importers: Recover password upgrades without class metadata.

Use the saved importer platform when an imported user retains _bbp_password but lacks _bbp_class. Existing per-user converter metadata remains authoritative, password verification still fails closed, and normal conversions continue to connect to the configured source database.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7552:

Importers: Correct Kunena 1 password upgrades.

Store Joomla's complete digest:salt password value, verify its documented salted and legacy unsalted MD5 formats, and persist the converter class for future imports. Existing imported users without class metadata can recover through the saved importer platform.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7553:

Importers: Correct Kunena 1 password upgrades.

Store Joomla's complete digest:salt password value, verify its documented salted and legacy unsalted MD5 formats, and persist the converter class for future imports. Existing imported users without class metadata can recover through the saved importer platform.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7554:

Importers: Correct Kunena 2 password upgrades.

Preserve Joomla's complete password value and verify its portable, salted MD5, and unsalted MD5 formats. Persist the converter class for new imports while retaining compatibility with existing imported metadata.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7555:

Importers: Correct Kunena 2 password upgrades.

Preserve Joomla's complete password value and verify its portable, salted MD5, and unsalted MD5 formats. Persist the converter class for new imports while retaining compatibility with existing imported metadata.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7556:

Importers: Correct Kunena 3 password upgrades.

Preserve Joomla's complete password value and verify its portable, bcrypt, Argon2, SHA-256, and legacy MD5 formats. Persist the converter class for new imports while retaining compatibility with existing imported metadata.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7557:

Importers: Correct Kunena 3 password upgrades.

Preserve Joomla's complete password value and verify its portable, bcrypt, Argon2, SHA-256, and legacy MD5 formats. Persist the converter class for new imports while retaining compatibility with existing imported metadata.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7558:

Importers: Correct e107 v1 password upgrades.

Use e107 v1's unsalted MD5 verifier and preserve compatibility with its legacy UTF-8 conversion mode. Retain support for password metadata written by previous bbPress imports.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7559:

Importers: Correct e107 v1 password upgrades.

Use e107 v1's unsalted MD5 verifier and preserve compatibility with its legacy UTF-8 conversion mode. Retain support for password metadata written by previous bbPress imports.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7560:

Importers: Correct XMB password upgrades.

Use XMB's unsalted MD5 verifier, persist the converter class correctly for new imports, and retain support for metadata from existing imports.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7561:

Importers: Correct XMB password upgrades.

Use XMB's unsalted MD5 verifier, persist the converter class correctly for new imports, and retain support for metadata from existing imports.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7562:

Importers: Correct Drupal 7 password upgrades.

Use Drupal 7's portable password verifier, persist the converter class correctly for new imports, and retain first-login upgrades for interrupted and completed existing imports without requiring the source database. Avoid replacing passwords already recognized by WordPress or password plugins.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7563:

Importers: Correct Drupal 7 password upgrades.

Use Drupal 7's portable password verifier, persist the converter class correctly for new imports, and retain first-login upgrades for interrupted and completed existing imports without requiring the source database. Avoid replacing passwords already recognized by WordPress or password plugins.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7566:

Importers: Support XenForo password upgrades.

Import authentication data from XenForo's user_authenticate table and verify native SHA or bcrypt passwords on first login. Preserve the authentication scheme and unsupported imported-platform data so future support does not require another import.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7567:

Importers: Support XenForo password upgrades.

Import authentication data from XenForo's user_authenticate table and verify native SHA or bcrypt passwords on first login. Preserve the authentication scheme and unsupported imported-platform data so future support does not require another import.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7568:

Importers: Correct vBulletin password upgrades.

Preserve printable ASCII password salts when storing vBulletin 4 authentication metadata, avoid duplicate salt usermeta, and reject malformed metadata without changing historical import behavior.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7569:

Importers: Correct vBulletin password upgrades.

Preserve printable ASCII password salts when storing vBulletin 4 authentication metadata, avoid duplicate salt usermeta, and reject malformed metadata without changing historical import behavior.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7570:

Importers: Correct vBulletin 3 password upgrades.

Preserve printable ASCII password salts when storing vBulletin 3 authentication metadata and reject malformed metadata without changing historical import behavior.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7571:

Importers: Correct vBulletin 3 password upgrades.

Preserve printable ASCII password salts when storing vBulletin 3 authentication metadata and reject malformed metadata without changing historical import behavior.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7572:

Importers: Correct Invision password upgrades.

Reproduce IP.Board 3 password input cleaning while retaining the historical bbPress verifier for existing imported users, and reject malformed metadata without changing the stored password format.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7573:

Importers: Correct Invision password upgrades.

Reproduce IP.Board 3 password input cleaning while retaining the historical bbPress verifier for existing imported users, and reject malformed metadata without changing the stored password format.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7574:

Importers: Add Mingle password tests.

Verify that the Mingle converter preserves WordPress password hashes during import cleanup and delegates legacy MD5 upgrades to normal WordPress authentication.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7575:

Importers: Add Mingle password tests.

Verify that the Mingle converter preserves WordPress password hashes during import cleanup and delegates legacy MD5 upgrades to normal WordPress authentication.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7576:

Importers: Correct phpFox 3 password upgrades.

Store phpFox password salts from the correct source column, preserve printable salts through WordPress metadata handling, and reproduce phpFox's native double-MD5 verifier. Retain the historical verifier and recover salts omitted by older imports from the retained source database.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7577:

Importers: Correct phpFox 3 password upgrades.

Store phpFox password salts from the correct source column, preserve printable salts through WordPress metadata handling, and reproduce phpFox's native double-MD5 verifier. Retain the historical verifier and recover salts omitted by older imports from the retained source database.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7578:

Importers: Support Vanilla password upgrades.

Import Vanilla's native hash method with its password data, and verify phpass, legacy MD5, and legacy plaintext passwords on first login. Preserve historical direct-hash imports and reject authentication methods outside this converter's Vanilla 2 scope.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7579:

Importers: Support Vanilla password upgrades.

Import Vanilla's native hash method with its password data, and verify phpass, legacy MD5, and legacy plaintext passwords on first login. Preserve historical direct-hash imports and reject authentication methods outside this converter's Vanilla 2 scope.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7580:

Importers: Add bbPress 1.x password tests.

Confirm that WordPress-compatible portable and legacy MD5 hashes from bbPress 1.x are restored during import cleanup and handled through normal username or email login without source database access.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7581:

Importers: Add bbPress 1.x password tests.

Confirm that WordPress-compatible portable and legacy MD5 hashes from bbPress 1.x are restored during import cleanup and handled through normal username or email login without source database access.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7582:

Importers: Validate SMF password metadata.

Reject non-string SMF password hashes, source usernames, submitted passwords, and serialized payloads before calling string-sensitive password functions. Preserve the native SMF 2.0 verifier and existing first-login behavior.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7583:

Importers: Validate SMF password metadata.

Reject non-string SMF password hashes, source usernames, submitted passwords, and serialized payloads before calling string-sensitive password functions. Preserve the native SMF 2.0 verifier and existing first-login behavior.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7584:

Importers: Add Simple:Press 5 password tests.

Verify that WordPress-native password hashes imported from Simple:Press are restored from temporary metadata and support normal username and email authentication without the source database. Cover historical phpass and MD5 hashes, malformed metadata, and legacy converter-routing states.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7585:

Importers: Add Simple:Press 5 password tests.

Verify that WordPress-native password hashes imported from Simple:Press are restored from temporary metadata and support normal username and email authentication without the source database. Cover historical phpass and MD5 hashes, malformed metadata, and legacy converter-routing states.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7586:

Converters: Correct PHPWind 9 password imports.

Use PHPWind 9's WindID user tables for account data, preserve its login hash and salt as converter metadata, and verify the WindID password formula on first login.

This change applies to new and repeated imports and does not attempt to recover incomplete password data from earlier imports.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7587:

Converters: Correct PHPWind 9 password imports.

Use PHPWind 9's WindID user tables for account data, preserve its login hash and salt as converter metadata, and verify the WindID password formula on first login.

This change applies to new and repeated imports and does not attempt to recover incomplete password data from earlier imports.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7588:

Importers: Normalize password metadata handling.

Defer source-dependent FluxBB field detection until after connecting, centralize safe password metadata decoding, and preserve salts, usernames, and wrapped phpBB hashes through WordPress user-meta storage.

This raises the 2.6 maintenance branch's minimum supported PHP version to 7.2, adds regression coverage, and corrects the 2.6.18 changelog entries.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7589:

Importers: Normalize password metadata handling.

Defer source-dependent FluxBB field detection until after connecting, centralize safe password metadata decoding, and preserve salts, usernames, and wrapped phpBB hashes through WordPress user-meta storage.

This also adds regression coverage and documents the Drupal 7 password-upgrade correction.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7590:

Tests: Decouple imported passwords from user creation.

Create imported-user fixtures with a non-empty setup password before replacing the WordPress hash. This keeps the zero-password regression test focused on bbPress conversion behavior and compatible with WordPress versions that reject "0" during user creation.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7591:

Tests: Decouple imported passwords from user creation.

Create imported-user fixtures with a non-empty setup password before replacing the WordPress hash. This keeps the zero-password regression test focused on bbPress conversion behavior and compatible with WordPress versions that reject "0" during user creation.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7594:

Importers: Clear converted password metadata.

Use delete_user_meta() when removing temporary converter credentials so WordPress invalidates cached metadata and fires standard metadata hooks. This prevents stale converter metadata on older WordPress versions after a successful password upgrade.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7595:

Importers: Clear converted password metadata.

Use delete_user_meta() when removing temporary converter credentials so WordPress invalidates cached metadata and fires standard metadata hooks. This prevents stale converter metadata on older WordPress versions after a successful password upgrade.

In trunk, for 2.7.

Fixes #3684.

[johnjamesjacoby]

In 7596:

Importers: Invalidate caches during password cleanup.

Use delete_user_meta() when removing restored imported passwords and clean user caches after direct password updates. This prevents stale password and converter metadata on older WordPress versions.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7597:

Importers: Invalidate caches during password cleanup.

Use delete_user_meta() when removing restored imported passwords and clean user caches after direct password updates. This prevents stale password and converter metadata on older WordPress versions.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7598:

Importers: Correct password cleanup edge cases.

Use an immutable usermeta cursor so deleting native password metadata does not skip later batches. Preserve leading and trailing whitespace when verifying imported passwords, matching WordPress authentication behavior.

In branches/2.6, for 2.6.18.

See #3684.

[johnjamesjacoby]

In 7599:

Importers: Correct password cleanup edge cases.

Use an immutable usermeta cursor so deleting native password metadata does not skip later batches. Preserve leading and trailing whitespace when verifying imported passwords, matching WordPress authentication behavior.

In trunk, for 2.7.

See #3684.

[johnjamesjacoby]

In 7602:

Importers: Normalize final compatibility details.

Correct the PHPWind status-map documentation to match its source bitmask, reject malformed scalar values in the example password verifier, and add regression coverage. Align anonymous-author detection with trunk to avoid loose-comparison behavior on PHP 7.2.

In branches/2.6, for 2.6.18.

See #3684.
See #3686.

[johnjamesjacoby]

In 7603:

Importers: Normalize final compatibility details.

Correct the PHPWind status-map documentation to match its source bitmask, reject malformed scalar values in the example password verifier, and add regression coverage.

In trunk, for 2.7.

See #3684.
See #3686.