500 Error when posting new ad with photo using PHP 7.1.2

[SmaRTeY]

I think it is 'strict' related, PHP becoming more secure which is also reason for dropping the mcrypt functionality.

Anyway, there are 'fixes' in case others run into PHP 7.1+ problems now.
I also created a new encrypt/decrypt function that replaces both osc_encrypt_alert() and osc_decrypt_alert() and commented out some code in generate password function which also makes use of mcrypt. The new function is now used by osclass/controller/search.php and /osclass/controller/ajax.php in my dev environment for testing the working of the alerts and everythingelse that is related. So far so good, less code in hSecurity and no more mcrypt deprecated warnings

Though this is officially Osclass 3.6.1 running on PHP 7.1.2, if it works it would also be an alternative for Osclass 3.7.1.
If you're interested I can share the hSecurity changes with you.

[dev101]

It will be addressed and it is already noted by Osclass Team, take a look at these links:

http://forums.osclass.org/development/sha1-password-hash-16947/msg145054/#msg145054
https://github.com/osclass/Osclass/issues/2073

[SmaRTeY]

Cool, good to see it's on the agenda

Thanks

It will be addressed and it is already noted by Osclass Team, take a look at these links:

http://forums.osclass.org/development/sha1-password-hash-16947/msg145054/#msg145054
https://github.com/osclass/Osclass/issues/2073

[SmaRTeY]

For those interested and keeping the wheels spinning....

So far my new function seems to be working OK and I would like your opinion on the code I am using in hSecurity at this moment making it PHP 7.1+ ready with regard to the use of MCRYPT (and also (ok, not 100% sure but I think so) being able to get rid of a whole libsec (mcrypt) library in osclass).
The Original encryption functions I have commented out in hSecurity as well as part of a rendom generate function, all in same hSecurity file. And as far as I can see, what _CONEJO already mentioned, only 'older' Osclass Payment plugin is using mcrypt as well.
That having said, I have no clue about other commercial plugins.

Okay, here's my encrypt/decrypt function I am using at the moment:

Code: [Select]

/**
* Alternative encryption for osclass alerts, mcrypt will be DEPRECATED in PHP 7.1+
* This function replaces both the need for 'osc_encrypt_alert' & 'osc_decrypt_alert'
* OSC Files effected: /osclass/controller/search.php & /osclass/controller/ajax.php
* Plugins effected: None known
*
* Params:
*
* @action -> 'encrypt' or 'decrypt'
* @data -> string for handling encryption ie. $alert
* @add_to_secret_key         -> optional string to add to key
*/
function osc_encrypt_decrypt($action, $data='', $add_to_secret_key='') {

if($action=='encrypt') {
osc_set_alert_private_key(); // renew private key and
osc_set_alert_public_key();  // public key
}

$output               = '';
$encrypt_method = "AES-256-CBC";
$secret_key         = osc_get_alert_private_key() . $add_to_secret_key;
$key                    = hash('sha256', $secret_key, true);
$secret_iv            = osc_get_alert_private_key();
$iv                      = substr(hash('sha256', $secret_iv), 0, 16);

$eski = array("+","/","=");
$yeni = array("b1X4","x8V7","F3h7");

if( $action == 'encrypt' ) {
$string = osc_genRandomPassword(32) . $data;
$output     = openssl_encrypt($string, $encrypt_method, $key, 0, $iv);
$output     = base64_encode($output);
$output     = str_replace($eski,$yeni,$output);
} elseif( $action == 'decrypt' ) {
$string = str_replace($eski,$yeni,$data);
$output      = openssl_decrypt(base64_decode($string), $encrypt_method, $key, 0, $iv);
$output = trim(substr($output, 32));
}

return $output;
}

Regards,
Eric

[_CONEJO]

We're not able to reproduce the issue in PHP 7.1.2 with bender  + branch hotfixes, could you tell us something more to be able to?

the proposed change : $aItem['photos'][] = Params::getFiles('photos'); doesn't make sense, because you are putting the images in the wrong variable (inside an array), so probably no error, but images will not be uploaded either.

Not really sure what fancybox/jquery has to do with this, if any, it should be fineuploader. We know it's outdated, but new versions are not as compatible as we would like to, and require changes in the HTML/template among other things

[_CONEJO]

Updated the issue at github https://github.com/osclass/Osclass/issues/2139

Looks it's something only happening on master (we were not able to reproduce it on hotfixes branch)

[SmaRTeY]

Hi _CONEJO,

it's been a while, I see your questionmarks and it makes me wonder as well to be honest. I have setup a fully clean system but I can't remember if I made some changes to get around issues so I will renew my dev environment with a new Osclass download from github (expecting those hotfixes to be incorporated) and let you know my findings.

Regards,
Eric

We're not able to reproduce the issue in PHP 7.1.2 with bender  + branch hotfixes, could you tell us something more to be able to?

the proposed change : $aItem['photos'][] = Params::getFiles('photos'); doesn't make sense, because you are putting the images in the wrong variable (inside an array), so probably no error, but images will not be uploaded either.

Not really sure what fancybox/jquery has to do with this, if any, it should be fineuploader. We know it's outdated, but new versions are not as compatible as we would like to, and require changes in the HTML/template among other things

[_CONEJO]

No need to.

We were able to reproduce it on master but not on hotfixes branch on PHP 7.1.2 (we weren't able to reproduce it on previous PHP versions).
hotfixes + 7.1.2 works, so next master/release  should work fine too

[SmaRTeY]

Ah okay, yes previous PHP versions didn't throw error, it started when using PHP 7.1.2.

Thanks