I think, there's a little mistake in the code:

setcookie($cookie_prefix .'password', md5(md5($vbuser['password']) . $vbuser['salt']), $expire, $cookie_path, $cookie_domain);

This is the way passwords are stored in the database. So you take the already encrypted password in the database and encrypt it with salt and md5 again. But the password in cookies is encrypted this way:

setcookie($cookie_prefix .'password', md5($vbuser['password'] . '*YOUR LICENCE NUMBER*'), $expire, $cookie_path, $cookie_domain);

(of course you have to replace *YOUR LICENCE NUMBER* with your vBulletin licence number).

After replacing this part, everything works fine and the users are not logged out at the end of the session lifetime.
I used Drupal 5.7 and vBulletin 3.7.1 Patch Level 2

Comments

sun’s picture

Priority: Normal » Critical

We need a way to retrieve the actual license number from vBulletin.

sun’s picture

@TW-IYF: Do you know how/where vBulletin stores the license number internally? I have already searched through the settings, but was unable to find it.

sun’s picture

Assigned: Unassigned » sun
Status: Active » Needs review
StatusFileSize
new2 KB

I was unable to find a resource for determining the actual vBulletin license number. Thus, implemented as module setting now.

Please test. I'll probably roll a new official release in the next days.

sun’s picture

StatusFileSize
new2 KB

Re-rolled.

sun’s picture

Status: Needs review » Fixed
Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.

ml1’s picture

Check around line 37 of includes/functions.php. We're using 3.7.x.