Hi there;
After noticing how easy to guess were users' passwords, I wrote a little piece of code for update every users' passwords to something more complicated to guess.
It's higly customizable, especially the generation of the password part. Right now, it makes the password look like this:
{consonant}{vowel} * $amount_of_chars / 2 + {number} * $amount_of_numbers
Like this:
sareguli1562 (with amount_of_chars = 8 and amount_of_numbers = 4)
(You should also consider changing the minibb minimal password length requirement).
It should be upgraded to do $max_users at a time, then auto refresh itself. If needed I'll do it for you.
The code :
<?php
//CONFIGURATION PART
define("from_email","admin@yoursite.com");
define("amount_of_chars",8); //can be divided by 2
define("amount_of_numbers",4);
define("email_subject","Your password has been changed");
define("email_content","
<html><body><br>
Hi %USERNAME%,<br>
For security of the forums and your account, all the passwords have been changed to stronger ones.<br>
<br>
Please take note of your new password : <b>%NEW_PASS%</b><br>
<br>
Thanks.</body></html>
");
//END CONFIGURATION PART
if ( ! include_once("setup_options.php") ) die("Could not include setup_options.php");
@set_time_limit(0);//may not work on your server (if safe_mode is on)
function send_mail($to,$sujet,$message) {
$headers = "From: ".from_email."\n";
$headers .= "Return-Path: <".from_email.">\n";
$headers .= "Date: ".date("D, d M Y H:i:s") . " UT\n";
$headers .= "Reply-To:".from_email."\n";
$headers .= "X-Mailer: PHP/".phpversion()."\n";
$headers .= "MIME-Version: 1.0\n";
$headers .= "Content-type: text/html; charset=iso-8859-1\n";
if (!@ mail($to, $sujet, $message, $headers)) {
return(false);
} else {
return true;
}
}
function new_password() {
$chars1 = "bcdfghjklmnpqrstvwxz";
$chars2 = "aeiouy";
$pass = "" ;
for ($i=1; $i <= amount_of_chars ; $i++) {
$pass .= substr($chars1, mt_rand(0, 22), 1);
$pass .= substr($chars2, mt_rand(0, 5), 1);
$i++;
}
for ($i=1; $i <= amount_of_numbers; $i++) {
$pass .= mt_rand(0, 9);
}
return $pass;
}
$sql=@mysql_connect($DBhost,$DBusr,$DBpwd);
if ( ! $sql ) die("Could not connect to mysql server");
$sqldb=@mysql_select_db($DBname);
if ( ! $sqldb ) die("Could not select db");
$total_users_count=mysql_query("SELECT COUNT(user_id) FROM ".$Tu);
$total_users_count=mysql_fetch_row($total_users_count);
$total_users_count=$total_users_count[0];
$done=1;
$current=2;
while($done < $total_users_count) {
$res=@ mysql_query("SELECT username, user_email FROM ".$Tu." WHERE user_id=".$current);
if ( !$res ) {
$current++;
break;
}
$res=mysql_fetch_row($res);
$pass=new_password();
$content=email_content;
$content=str_replace("%USERNAME%",$res[0],$content);
$content=str_replace("%NEW_PASS%",$pass,$content);
if ( !send_mail($res[1],email_subject,$content) ) die("Could not send email");
$update=mysql_query("UPDATE ".$Tu." SET user_password = '".md5($pass)."' WHERE user_id =".$current);
$current++;
$done++;
}
echo "Updated ".$total_users_count." users accounts. NOW DELETE THIS FILE";
Hope this can be usefull to someone :) | 
