--- C:/wamp/www/phpbb_309-RC1/phpBB3/includes/auth/auth_db.php	Sun Jun 12 18:09:36 2011
+++ C:/wamp/www/phpbb_309-RC1/phpBB3/includes/auth/auth_db_new.php	Tue Jun 14 00:46:25 2011
@@ -8,6 +8,7 @@
 *
 * @package login
 * @version $Id$
+* @version: universal auth_db.php 1.0.0 2011/05/07 Dicky
 * @copyright (c) 2005 phpBB Group
 * @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
@@ -37,6 +38,7 @@
 *								'user_row' => array
 *							)
 */
+
 function login_db($username, $password, $ip = '', $browser = '', $forwarded_for = '')
 {
 	global $db, $config;
@@ -60,13 +62,45 @@
 		);
 	}
 
-	$username_clean = utf8_clean_string($username);
+	$has_login_name = $has_pass_salt = FALSE;
 
-	$sql = 'SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts
-		FROM ' . USERS_TABLE . "
-		WHERE username_clean = '" . $db->sql_escape($username_clean) . "'";
+	$sql = 'SHOW COLUMNS FROM ' . USERS_TABLE;
 	$result = $db->sql_query($sql);
+	
+	while ($_row = $db->sql_fetchrow($result))
+	{
+		if ($_row['Field'] == 'login_name')
+		{
+			$has_login_name = TRUE;
+		}
+		if ($_row['Field'] == 'user_passwd_salt')
+		{
+			$has_pass_salt = TRUE;
+		}
+	}
+	$db->sql_freeresult($result);
+
+	$sql = 'SELECT user_id, username, user_password, user_passchg, user_pass_convert, user_email, user_type, user_login_attempts';
+	$sql_where_login_name = ' WHERE username_clean = \'' . $db->sql_escape(utf8_clean_string($username));
+
+	if ($has_login_name)
+	{
+		$sql .= ', login_name';
+		$sql_where_login_name .= '\' OR login_name = \'' . $db->sql_escape($username) . '\' OR user_email = \'' . $db->sql_escape($username);
+	}
+	if ($has_pass_salt)
+	{
+		$sql .= ', user_passwd_salt';
+	}
+
+	$sql .= ' FROM ' . USERS_TABLE;
+
+	$sql_where_login_name .= '\'';
+	$sql .= $sql_where_login_name;
+
+	$result = $db->sql_query($sql);
 	$row = $db->sql_fetchrow($result);
+
 	$db->sql_freeresult($result);
 
 	if (($ip && !$config['ip_login_limit_use_forwarded']) ||
@@ -113,10 +147,10 @@
 			'user_row'	=> array('user_id' => ANONYMOUS),
 		);
 	}
-
 	$show_captcha = ($config['max_login_attempts'] && $row['user_login_attempts'] >= $config['max_login_attempts']) ||
 		($config['ip_login_limit_max'] && $attempts >= $config['ip_login_limit_max']);
 
+
 	// If there are too much login attempts, we need to check for an confirm image
 	// Every auth module is able to define what to do by itself...
 	if ($show_captcha)
@@ -143,7 +177,6 @@
 		{
 			$captcha->reset();
 		}
-
 	}
 
 	// If the password convert flag is set we need to convert it
@@ -165,13 +198,27 @@
 			}
 
 			// cp1252 is phpBB2's default encoding, characters outside ASCII range might work when converted into that encoding
-			// plain md5 support left in for conversions from other systems.
-			if ((strlen($row['user_password']) == 34 && (phpbb_check_hash(md5($password_old_format), $row['user_password']) || phpbb_check_hash(md5(utf8_to_cp1252($password_old_format)), $row['user_password'])))
-				|| (strlen($row['user_password']) == 32  && (md5($password_old_format) == $row['user_password'] || md5(utf8_to_cp1252($password_old_format)) == $row['user_password'])))
+			$other_passwords = array();
+			$other_passwords[] = sha1(strtolower($row['login_name']) . $password_old_format);
+			$other_passwords[] = sha1($password_old_format);
+//			$other_passwords[] = hash('sha256', (hash('sha256', $password) . $unserialized_data['salt'])); // For future development
+//			$other_passwords[] = sha1(sha1($password.$unserialized_data['salt'])); // For future development
+			$other_passwords[] = md5($row['user_passwd_salt'].md5($password_old_format));
+			$other_passwords[] = md5(md5($row['user_passwd_salt']).md5($password_old_format));
+			$other_passwords[] = md5(md5($password_old_format).$row['user_passwd_salt']);
+			$other_passwords[] = md5(base64_encode(bin2hex(mhash(MHASH_SHA256,$password_old_format))));
+			$other_passwords[] = rtrim(base64_encode(pack("H*",md5($password_old_format))),"=");
+			$other_passwords[] = md5($password_old_format);
+			$other_passwords[] = md5(utf8_to_cp1252($password_old_format));
+			$other_passwords[] = phpbb_check_hash($password_old_format, $row['user_password']);
+			$other_passwords[] = phpbb_check_hash(md5($password_old_format), $row['user_password']);
+			$other_passwords[] = phpbb_check_hash(md5(utf8_to_cp1252($password_old_format)), $row['user_password']);
+
+			if (in_array($row['user_password'], $other_passwords))
 			{
 				$hash = phpbb_hash($password_new_format);
 
-				// Update the password in the users table to the new format and remove user_pass_convert flag
+				// We have a password that needs to be converted. Update the password in the users table to the new format and remove user_pass_convert flag
 				$sql = 'UPDATE ' . USERS_TABLE . '
 					SET user_password = \'' . $db->sql_escape($hash) . '\',
 						user_pass_convert = 0
