COOKIE_SALT is no longer the license number since vB 3.8.4

I modified drupalvb.module to fix this issue.
I modified the function drupalvb_login

Here is the original function:

function drupalvb_login() {
  global $user;

  if ($_POST['name']) {
    $form_state = array('values' => $_POST);
    if ($user->uid) {
      // If the user is already logged in to Drupal, we ensure the same for
      // vBulletin.
      if (drupalvb_login_validate(array(), $form_state)) {
        drupal_goto(!empty($_REQUEST['destination']) ? $_REQUEST['destination'] : 'user/'. $user->uid);
      }
      else {
	// Where do we go from here? user/login won't work, as the user is
        // already authenticated in Drupal.
        unset($_REQUEST['destination']);
        drupal_goto(variable_get('site_frontpage', 'node'));
      }
    }
    else {
      // Otherwise perform the full login procedure.
      foreach (user_login_default_validators() as $validator) {
        $validator(array(), $form_state);
      } 
      if (!form_get_errors()) {
        user_login_submit(array(), $form_state);
        $redirect = (isset($form_state['redirect']) ? $form_state['redirect'] : '');
        drupal_goto(!empty($_REQUEST['destination']) ? $_REQUEST['destination'] : $redirect);
      }
      else {
 	// Login failed: send back to login form.
        unset($_REQUEST['destination']);
        drupal_goto('user/login');
      }
    }
  }
} 

Here is the new function:

function drupalvb_login() {
  global $user;
      
  if ($_POST['name']) {
    $form_state = array('values' => $_POST);
    if ($user->uid) {
      // If the user is already logged in to Drupal, we ensure the same for
      // vBulletin.
      if (drupalvb_login_validate(array(), $form_state)) {
        drupal_goto(!empty($_REQUEST['destination']) ? $_REQUEST['destination'] : 'user/'. $user->uid);
      }
    }

      // Otherwise perform the full login procedure.
      foreach (user_login_default_validators() as $validator) {
        $validator(array(), $form_state);
      }
      if (!form_get_errors()) {
        user_login_submit(array(), $form_state);
        $redirect = (isset($form_state['redirect']) ? $form_state['redirect'] : '');
        drupal_goto(!empty($_REQUEST['destination']) ? $_REQUEST['destination'] : $redirect);
      }
      else {
        // Login failed: send back to login form.
        unset($_REQUEST['destination']);
        drupal_goto('user/login');
      }
  }
}

I changed it so that if drupalvb_login_validate fails, it will just force a full login instead of redirecting them to the front page.
This way, if they go to the forum while drupal is logged in and they are logged out on the forum (because vbulletin's cookies have expired), it can just log them back in and redirect them back to the forum with new cookies (through the use of the ?destination= variable). Otherwise, the user is caught in a trap where they can't login to the forum because drupal has them marked as being logged in already.

I am not a security expert but I think this is okay.
I would love to hear feedback on this.

um, could you do a proper patch? See http://drupal.org/patch for more information.

I had the same problem and I've found something odd with vB 3.8.4. Go open [vb folder]/includes/functions.php and look at line 37. In older vB's, the COOKIE_SALT string is your license number. On 3.8.4 however, my copy shows a 39-character string. Anyway, if the string specified in line 37 is different than your license number, use this string instead as the "vBulletin license number" in Drupal vB's config. This should fix your problem.

As for aliases, yes, the only way to fix this for me is to install 'Me aliases.'

I also removed the login fields in navbar and several other templates so i could force users to log on from Drupal.

EDIT: It looks like this is a vB bug ( http://www.vbulletin.com/forum/project.php?issueid=34514 ). This might have been fixed already. Check the file anyway.

As far as I know, the timeout doesn't get really extended. They get set when you log in. vB's cookies are set to expire after a year when you check 'Remember me.' On Drupal however, it is set to I think 3 months by default. The trick is, you don't let users log in from vB so the cookies expire at the same time for both Drupal and vB.

FYI, I downloaded the just released 3.8.5 and it still had the COOKIE_SALT bug in includes/functions.php.

EDIT: Just to letting everyone know that I submitted this as a bug to vBulletin and they replied that it isn't a bug. This means, the Drupal vB admin should be changed to ask for the COOKIE_SALT string in [vb folder]/includes/functions.php and not the license number.

More info here: http://www.vbulletin.com/forum/project.php?issueid=36858

Discussion around the first described issue should be moved into #866326: vBulletin loses session/cookie before Drupal does

Updating issue title for the second issue.

Looks like we're about to fix this.

#1367112: Determine vB version by parsing config.php will allow us to automatically determine the vBulletin version in use.

#691736: Vbulletin 4 Support contains a patch that adjusts the settings form to account for the new cookie salt value. That part of the patch should probably be extract and tackled here.