0012705: Login page hang. Crypt crash. - MantisBT

ID	Project	Category	View Status	Date Submitted	Last Update
0012705	mantisbt	authentication	public	2011-01-20 07:10	2011-08-05 02:41

Reporter	Gerrit	Assigned To	atrol
Priority	normal	Severity	block	Reproducibility	always
Status	closed	Resolution	duplicate
Product Version	1.2.4

Summary	0012705: Login page hang. Crypt crash.
Description	The login page will remain hanging indefinitely under circumstances. This happens when the login page script tries to check for security threats. When it checks the admnistrator account for password it will call the crypt method with a certain salt on the second login method try. This crypt method can crash on PHP versions 5.3.1 and 5.3.2 compiled as threadsafe Apache 2 modules and block the server thread. Behaviour with not thread safe versions unknown. Type of session storage relevant. With PHP file storage of sessions on Windows the next call to the login_page will hang immediately on sessions_start invocation, probably because the session file is locked by a hanging server thread. Working with XAMPP 1.7.3 platform and PHP version 5.3.1. Crypt is called in core within authentication_api.php inside function auth_process_plain_password(...). It is also called in library within adodb\session\adodb-session.php and adodb\session\adodb-session2.php and adodb\session\old\adodb-cryptsession.php.
Tags	No tags attached.

Gerrit 2011-01-20 07:14 reporter ~0028013	Bug involved is discussed at: http://bugs.php.net/bug.php?id=51424 and http://stackoverflow.com/questions/2699629/did-i-find-a-bug-in-phps-crypt Probably fixed from PHP 5.3.3 but have not confirmed. Mcrypt method could be alternative or crypt could be replaced only for 5.3.1 and 5.3.2. This could be included in the php_api.php for compatibility.

atrol 2011-01-20 07:23 developer ~0028014	For a workaround see http://www.mantisbt.org/bugs/view.php?id=11535#c24532

Gerrit 2011-01-20 08:01 reporter ~0028015	If the code is not going to be changed, may I suggest to adopt this info into the administration manual. http://docs.mantisbt.org/master/en/administration_guide.html#ADMIN.ABOUT.REQUIRMENTS It seems a little behind on the PHP versions and this issue has taken me several hours to get to the cause and work around it. You can't say that it runs on all versions after 5.2 with this issue lying around. Having a compatibility table in the guide could save people a lot of time when they are installing and making it a smoother experience. And I actually did read the guide before installing. PHP 5.3.1 and 5.3.2 should be struck for Mantis. Regards, Gerrit

Olaf123 2011-03-03 04:03 reporter ~0028357	Thanks for the solution. It caused me several hours of work. I have PHP 5.3.1. on Apache2.2.14 (XAMMP 1.73 on windows server 2003) and Mantis 1.2.4. Commenting out CRYPT works so far. I don't think this issue should be considered as resolved. First of all you do not replace PHP on a running server. Second, if the fix is really this simple, the array $t_login_methods filled with constants could easily have been defined as a global constant in config_inc.php. Put a few remarks in the manual (and default config file) about the PHP version that causes problems with CRYPT and everybody is happy!

atrol 2011-03-14 16:24 developer ~0028420	Version 1.3.x of MantisBT will check that at least PHP 5.3.2 is installed

Gerrit 2011-03-14 16:45 reporter ~0028422	Please be advised. The crypt bug was only fixed from PHP version 5.3.3.

atrol 2011-03-14 17:14 developer ~0028423	I had an internal discussion with user dhx because I want the check for 5.3.3 The compromise was to check for 5.3.2 because 5.3.3 would rule out RHEL 6 which delivers PHP 5.3.2 with some own fixes http://www.mantisbt.org/bugs/view.php?id=11535 http://git.mantisbt.org/?p=mantisbt.git;a=commit;h=2ef534bfd774bc7b7132ace97b7f9649cb3b3c9f I hope that there will be an update of PHP in RHEL 6, so we can check against 5.3.3

Olaf123 2011-03-15 04:29 reporter ~0028424	Dear developers: As I stated before please consider that one does not always have a choice in PHP versions. Ruling out everything below 5.5.3 because of a crypt error that seems to have an easy workaround seems to much to me. Unless there are other major problems, I urge you carefully weigh the pro's and con's of such a decision.

atrol 2011-03-15 08:30 developer ~0028425 Last edited: 2011-03-15 08:31	See http://php.net/ChangeLog-5.php I don't recommend to use any early PHP 5.3 version in a production environment.