Hello,

Projeqtor is not yet compatible with php 7.4.1.
It will be soon with version 8.4.

Hello
Do you know how soon this version will be available?
I'm just looking for some information to know if I need to spend some time building a new server.

I tried to build one quickly, based on ubuntu LTS with PHP 7.2, attacking the same database. But I can't connect, the password is denied.
I think it's an encryption problem, on the PHP side (the extensions are all present).

Hi,

The version 8.4 will be available mid-March normally.
Did you change your database password in the Projeqtor parameter.php files, located in the config folder?

thank you for your response.

Yes, the $paramDbPassword parameter is strictly identical on my two machines.

In summary, I have three servers:

1) The old one (let's call it S1), which worked until PHP 7.4.
- arch linux
- apache
- php 7.4
- mariaDB
2) The new (S2)
- ubuntu
- apache
- PHP 7.2
I set up S2 to connect to the database located on S1 but also on S3 (to test more freely).

3) I also have a maria DB server (S3) containing a copy (export/import) of the database located on S1. in order to safely test configuration modifications.

result (log level 4 on S2, attempt to connect to S3 from S2 - the result is the same if I try to connect from 2 on S1) :
2020-01-10 12:52:25.687 ..... SCRIPT .... 192.168.1.13 ->/tool/loginCheck.php
2020-01-10 12:52:25.690 ----- DEBUG ----- loginCheck : current db version = 'V8.3.1'
2020-01-10 12:52:25.696 ----- DEBUG ----- User->authenticate('admin', 'WAJDOXllGF4ZnjwY4I+tNBu6f/W69NBLhKM=')
2020-01-10 12:52:25.698 ----- DEBUG ----- User->authenticate : sha256 encryption
2020-01-10 12:52:25.703 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=User #1)
2020-01-10 12:52:25.706 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=User #1)
2020-01-10 12:52:25.716 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=History #)
2020-01-10 12:52:25.721 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=History #)
2020-01-10 12:52:25.944 ----- DEBUG ----- User->authenticate : wrong password 56d8afdc9f97cdcfb8b6ec662bb7d7be0a84af30bcd1524365f5e1b37193b183!=WAJDOXllGF4ZnjwY4I+tNBu6f/W69NBLhKM= (exit)
2020-01-10 12:52:25.945 ----- DEBUG ----- loginCheck : unidentified incorrect authentification
2020-01-10 12:52:25.945 ===== TRACE ===== Login error for user 'admin'

here is the list of php extensions installed on S2
php -m

calendar

Core

ctype

date

dom

exif

fileinfo

filter

ftp

gd

gettext

hash

iconv

imap

json

libxml

mbstring

mcrypt

mysqli

mysqlnd

openssl

pcntl

pcre

PDO

pdo_mysql

Phar

posix

readline

Reflection

session

shmop

SimpleXML

sockets

sodium

SPL

standard

sysvmsg

sysvsem

sysvshm

tokenizer

wddx

xml

xmlreader

xmlwriter

xsl

zip

zlib

[Zend Modules]
///

I made a new test on S3. i reset the admion password with the update i found here  https://www.projeqtor.org/fr/forum-fr/5-ask-questions/8762-lost-password-for-admin

after that, i could login, and projeqtor asked me to change the password.

Then i can see some contents. I disconnected the session and tried to reconnect... no sucess, same error as before...

i think there there is something wrong with apache/php on my S2...

                                                                                                	                                                                        

                                                        
 
                                                    
	                                        

Take care that ProjeQtOr uses some negociation of hash keys for authentications.
If you try and connect to different servers on same domain you may have session issues, trying to connect on a server with hash key from another one.
Be sure to clean cache and cookies between tests, or test access on different servers from different browsers.

thanks.

I just ran the following test again:
- password reset on the S3 server.
- login, from my PC, in a private browsing session, with the new password :ok
- change password
- logout
- Attempt to reconnect (in the same private browsing session) impossible.

Even on private session, cache and cookies are kept if you do not close browser.
Close browser between tests or use another browser for second test.

When you reconnect, you enter the new changed password, I guess.
Could you check in DB if password stored is the old one or a new one (value stores is not the password you enter, but you may see change)

ok, i will test that tomorrow.

i don't have time now.

thanks a lot.

hi,
here is my new test.
a) SQL Update with new password (admin/admin), content of password column for table resource (id=1)
084cf5c804c917fa349e0012a4432271

b) in chromium browser ( instead of FF that i always use) : clean history (everything), quit the browser, then reopen the browser.
c) first launch of the app in chromium. Projeqtor ask me for a new password (he told me it’s ok). I changed it in the app and check the content of table resource
content of password column for table resource (id=1)
cd0972eea8cbc92b1bc66224528306ca67532aa13724f1cf1f7944f5af5b9c06

it seems to be the new password.

d) i disconnect from projeqtor and try to reconnect (in chromium) with my new password.
Got the following error in the log file :
2020-01-11 16:33:24.150 ..... SCRIPT .... 192.168.1.13 ->/tool/loginCheck.php
2020-01-11 16:33:24.152 ----- DEBUG ----- loginCheck : current db version = 'V8.3.1'
2020-01-11 16:33:24.158 ----- DEBUG ----- User->authenticate('admin', 'bwLJQMTqGV7xNexhvwVenPsFwHCbm6gXBY0=')
2020-01-11 16:33:24.161 ----- DEBUG ----- User->authenticate : sha256 encryption
2020-01-11 16:33:24.166 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=User #1)
2020-01-11 16:33:24.169 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=User #1)
2020-01-11 16:33:24.178 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=History #)
2020-01-11 16:33:24.184 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=History #)
2020-01-11 16:33:24.393 ----- DEBUG ----- User->authenticate : wrong password ec7371b06441eb823bba7aaab436f4be2eb1ae4756aabddac18087e8c13a9e61!=bwLJQMTqGV7xNexhvwVenPsFwHCbm6gXBY0= (exit)
2020-01-11 16:33:24.393 ----- DEBUG ----- loginCheck : unidentified incorrect authentification
2020-01-11 16:33:24.393 ===== TRACE ===== Login error for user 'admin'

Ji,

Thanks for testing and complete report.

First, a hint :
When you try and set default password, I don't know where you get the string 084cf5c804c917fa349e0012a443227 to set as new password value
but it may be more easy to enter password in clear text (admin) and set crypto to null

Second :
I hope that after changing the password through the application, when you try to reconnect, you use the password you entered in the application as new password, not the one stored in the db (cd0972eea8cbc92b1bc66224528306ca67532aa13724f1cf1f7944f5af5b9c06) as this one is result of encryption of the password

Last :
To have more clue, change in model/UserMain.php, line 1243 from

      if ($this->crypto=='sha256') {
        debugTraceLog("User->authenticate : sha256 encryption");
        $expected=$this->password.getSessionValue('sessionSalt');
        $expected=hash("sha256", $expected);

to

      if ($this->crypto=='sha256') {
        debugTraceLog("User->authenticate : sha256 encryption");
        $expected=$this->password.getSessionValue('sessionSalt');
        debugTraceLog(" sha encrypted password ");
        debugTraceLog("stored password = ".$this->password);
        debugTraceLog("session salt = ".getSessionValue('sessionSalt'));
        $expected=hash("sha256", $expected);

Then, in browser, open console on network tab, and filter result on getHash
Try and reconnect (with refused password)
Look at response for last request getHask.php : the last word (after last 😉 must be exactly the same as what you will find in the log file after "----- DEBUG ----- session salt ="
If it's not the case, you have a session issue.

Thanks for your answer.

New test
1)
→ UPDATE resource SET password='newpasswd', crypto=NULL, isLdap=0 WHERE id=1;

select * from resource where id=1;
→ resource.password is equal ti ‘newpasswd’

2) Clear chromium, exit + launch chromium, projeqtor landing page.
Login with admin/newpasswd : OK
3°) projeqtor ask me to changepasswd, then i did it with a new one, and log out
4°) i tried to log in with admin/ the password i set at step 3
5°) error in log file :

2020-01-11 19:39:34.171 ..... SCRIPT .... 192.168.1.13 =====/tool/getHash.php
2020-01-11 19:39:34.204 ..... SCRIPT .... 192.168.1.13 Page=getHash.php
2020-01-11 19:39:34.204 ..... SCRIPT .... 192.168.1.13 refreshParameters()
2020-01-11 19:39:34.358 ..... SCRIPT .... 192.168.1.13 =====/tool/loginCheck.php
2020-01-11 19:39:34.391 ..... SCRIPT .... 192.168.1.13 Page=loginCheck.php
2020-01-11 19:39:34.391 ..... SCRIPT .... 192.168.1.13 refreshParameters()
2020-01-11 19:39:34.424 ..... SCRIPT .... 192.168.1.13 ->/tool/loginCheck.php
2020-01-11 19:39:34.426 ----- DEBUG ----- loginCheck : current db version = 'V8.3.1'
2020-01-11 19:39:34.433 ----- DEBUG ----- User->authenticate('admin', '8QDpHGYWGl6wallAO5be/4RBIryZPPFjUmo=')
2020-01-11 19:39:34.435 ----- DEBUG ----- User->authenticate : sha256 encryption
2020-01-11 19:39:34.435 ----- DEBUG ----- sha encrypted password
2020-01-11 19:39:34.435 ----- DEBUG ----- stored password = 2aacc0a69b3803b630b11934307d43b21ad7954c5ff68cfec93bf003db736a49
2020-01-11 19:39:34.435 ----- DEBUG ----- session salt = b382b3591b7741bd5a408fcb6b605aea
2020-01-11 19:39:34.441 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=User #1)
2020-01-11 19:39:34.445 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=User #1)
2020-01-11 19:39:34.454 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=History #)
2020-01-11 19:39:34.460 ..... SCRIPT .... 192.168.1.13 getProfile(objectOrIdProject=History #)
2020-01-11 19:39:34.651 ----- DEBUG ----- User->authenticate : wrong password f432065c17779a84c33bd1e9b3b4b30939c88fe3a9acdd8c1b816cb132130fed!=8QDpHGYWGl6wallAO5be/4RBIryZPPFjUmo= (exit)
2020-01-11 19:39:34.651 ----- DEBUG ----- loginCheck : unidentified incorrect authentification
2020-01-11 19:39:34.651 ===== TRACE ===== Login error for user 'admin'

– in chromium (network console)
request header :
http://192.168.1.247/tool/getHash.php?username=OQB1qGYWGl7ic9VFVg%3D%3D
GET /tool/getHash.php?username=OQB1qGYWGl7ic9VFVg%3D%3D HTTP/1.1
Host: 192.168.1.247
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
X-Requested-With: XMLHttpRequest
Accept: */*
Referer: http://192.168.1.247/view/main.php
Accept-Encoding: gzip, deflate
Accept-Language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=p1lkq6j0ohrsn3p6mqn20uoj80

response

sha256;440c5bfd2beacc722fa848a6b41331856b354a7df4a7a029edd7b3344478f383;b382b3591b7741bd5a408fcb6b605aea

i think what your looking for is b382b3591b7741bd5a408fcb6b605aea which is the same in the log file & in the response in the browser.

OK, so now I'm sure it's not a Session issue.

Can you just verify that the second part of the getHash() response (440c5bfd2beacc722fa848a6b41331856b354a7df4a7a029edd7b3344478f383), after "sha256;" is the same as the user salt stored in table resource ?

If it is the same, it means that the encryption done on Javascript and done on PHP.
Authentication process compared result in php
value in PHP = hash("sha256", $user->$password.$sessionSalt) where $user->password, stored in DB is hash("sha256", $enteredPassWord.$user->salt)
value in JS = CryptoJS.SHA256(CryptoJS.SHA256(pwd + userSalt)+ sessionSalt)

So I would say that CryptoJS.SHA256() or PHP hash("sha256") does not work as expected (at least both don't give save result.
It's quite difficult to investigate to find why...

Hi,

thanks for you help.

select salt from resource where id=1;
+------------------------------------------------------------------+
| salt |
+------------------------------------------------------------------+
| 440c5bfd2beacc722fa848a6b41331856b354a7df4a7a029edd7b3344478f383 |
+------------------------------------------------------------------+

it is the same value...

My problem is solved.
I was the one who started it.

When I installed (replacing my arch linux server in PHP 7.4), an ubuntu server (which I just updated to PHP 7.3), I resin installed the application from the original zip (downloaded from the projeqtor site).
I updated the settings and encountered the problems mentioned in this thread.

What I forgot is the plugs in... (FR translation and reports).
I just reinstalled from a copy of my arch linux server files (including the plugins) and it works... no more connection problems...

I confess I didn't think that these authentication problems could come from the fact that the plugins were not installed.

Maybe this experience can be useful to other people...

Thank you again for your help these last few days.

I can now wait quietly for the 8.4 version.