Reply to thread

I should not post bug reports late at night when half asleep ...

While it does look strange, mentioned issues 2) and 3) are in fact correct - vBulletin 5 does apply md5 to the password before hashing it (jesus knows why!), so this md5 hash is the correct input for password_verify

The getHandler method still seems useless though, so at least this report isn't entirely wrong