Subject: [Pkg-cacti-maint] Processed: Re: Bug#815987: libphp-adodb requires porting to php7.0; mysql_pconnect is removed

From: [email-masked] (Debian Bug Tracking System)
Date: Thu, 31 Mar 2016 14:51:07 +0000

Processing control commands:

> reassign 815987 cacti
Bug #815987 [libphp-adodb] libphp-adodb requires porting to php7.0; mysql_pconnect is removed
Bug reassigned from package 'libphp-adodb' to 'cacti'.
No longer marked as found in versions libphp-adodb/5.15-1.
Ignoring request to alter fixed versions of bug #815987 to the same values previously set
> retitle 815987 cacti requires porting to php7.0; mysql removed
Bug #815987 [cacti] libphp-adodb requires porting to php7.0; mysql_pconnect is removed
Changed Bug title to 'cacti requires porting to php7.0; mysql removed' from 'libphp-adodb requires porting to php7.0; mysql_pconnect is removed'.

-- 
815987: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815987
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: TheSin <[email-masked]>
Date: Mon, 4 Apr 2016 10:46:23 -0600

I believe the real issue isn’t with adodb, it’s line 38 of /usr/share/cacti/site/lib/database.php

$dsn = "$db_type://" . rawurlencode($user) . ":" . rawurlencode($pass) . "@" . rawurlencode($host) . "/" . rawurlencode($db_name) . "?persist”;

I believe we must remove the persist, so it no longer uses _pconnect in adodb, and it’ll switch to using _connect instead.

This is untested though I plan to test it in a bit, but I believe this should fix it.

---

From: Paul Gevers <[email-masked]>
Date: Mon, 4 Apr 2016 20:37:13 +0200

Hi TheSin,

> I believe the real issue isn’t with adodb, it’s line 38 of /usr/share/cacti/site/lib/database.php

Without any change except for database_type, my testing was already
successful. Do you have any idea when and how this code would be triggered?

> This is untested though I plan to test it in a bit, but I believe this should fix it.

As said, switching from mysql to mysqli already fixed issues. Are you
sure there is more that needs fixing?

Paul

---

From: TheSin <[email-masked]>
Date: Mon, 4 Apr 2016 12:56:04 -0600

I agree using mysqli will fix it without change.

I just meant if mysql + php7 is used then you need to remove the persist on the dsn, according to the adodb code base that is what forces _pconnect with mysql driver, with mysqli persist is ignored.

I just wanted to put that info incase it was an easier option then trying to get everyone to update config to use mysqli.  I to am just using mysqli, but I wanted to figure out the why and how of it all.

> On Apr 4, 2016, at 12:37 PM, Paul Gevers <[email-masked]> wrote:
> 
> Hi TheSin,
>

---

From: Paul Gevers <[email-masked]>
Date: Mon, 4 Apr 2016 21:06:14 +0200

Hi TheSin,

Your feedback is much appreciated.

> I agree using mysqli will fix it without change.

Great, that confirms my testing.

> I just wanted to put that info incase it was an easier option then
> trying to get everyone to update config to use mysqli.  I to am just
> using mysqli, but I wanted to figure out the why and how of it all.

Well, changing the default properly to mysqli AND making this change is
then a good way forward I believe. Cacti SHOULD be calling libphp-adodb
with mysqli, but if some admin forgets to make the change in an already
installed setup, having the package behave properly is extremely nice.

Thanks again.

Paul

---

From: [email-masked] (Debian Bug Tracking System)
Date: Sun, 17 Apr 2016 18:36:14 +0000

Your message dated Sun, 17 Apr 2016 18:34:27 +0000
with message-id <[email-masked]>
and subject line Bug#815987: fixed in cacti 0.8.8g+ds1-2
has caused the Debian Bug report #815987,
regarding cacti requires porting to php7.0; mysql removed
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

Subject: libphp-adodb requires porting to php7.0; mysql_pconnect is removed
From: Paul Gevers <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Fri, 26 Feb 2016 13:23:29 +0100

Package: libphp-adodb
Version: 5.15-1
Severity: important

In response to the announcement¹ that strech will ship with php7.0 I tested my
package cacti (which depends on libphp-adodb) with php7.0 in a clean sid lxc
container. However, the error logs report (password not stripped, I don't care
in this case):

[Fri Feb 26 11:16:31.154718 2016] [:error] [pid 24140] [client ::1:35672] PHP Fatal error:  Uncaught Error: Call to undefined function mysql_pconnect() in /usr/share/php/adodb/drivers/adodb-mysql.inc.php:480\nStack trace:\n#0 /usr/share/php/adodb/adodb.inc.php(733): ADODB_mysql->_pconnect('localhost', 'cacti', 'AoCcMn8ZNg48', 'cacti')\n#1 /usr/share/php/adodb/adodb.inc.php(4799): ADOConnection->PConnect('localhost', 'cacti', 'AoCcMn8ZNg48', 'cacti')\n#2 /usr/share/cacti/site/lib/database.php(51): ADONewConnection('mysql')\n#3 /usr/share/cacti/site/include/global.php(212): db_connect_real('localhost', 'cacti', 'AoCcMn8ZNg48', 'cacti', 'mysql', '', false)\n#4 /usr/share/cacti/site/include/auth.php(25): include('/usr/share/cact...')\n#5 /usr/share/cacti/site/index.php(25): include('/usr/share/cact...')\n#6 {main}\n  thrown in /usr/share/php/adodb/drivers/adodb-mysql.inc.php on line 480

When I use codesearch.d.n to search for where mysql_pconnect is implemented, I
find a lot of hits in the php5 package (test suite) which say:

Deprecated: mysql_pconnect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in %s on line %d

My understanding is that mysql_pconnect got removed from the php package and
libphp-adodb needs to be ported to php7.0 by using mysqli instead of
mysql_pconnect.

Thanks for considering.
Paul

¹ https://lists.debian.org/debian-devel-announce/2016/01/msg00002.html

Subject: Bug#815987: fixed in cacti 0.8.8g+ds1-2
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Sun, 17 Apr 2016 18:34:27 +0000

Source: cacti
Source-Version: 0.8.8g+ds1-2

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Sun, 17 Apr 2016 19:55:43 +0200
Source: cacti
Binary: cacti
Architecture: source
Version: 0.8.8g+ds1-2
Distribution: unstable
Urgency: medium
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description:
 cacti      - web interface for graphing of monitoring systems
Closes: 783446 783447 815987 816962 818647
Changes:
 cacti (0.8.8g+ds1-2) unstable; urgency=medium
 .
   [ Paul Gevers ]
   * Next upstream version, strip include/js/jquery.js from source
   * Make sure the web-interface doesn't ask unnecessary questions after
     install (Closes: #783447)
   * Use the MySQL connection password as initial password for the admin
     user (Closes: #783446) and mention this in the NEWS.Debian file
   * Improve fix for CVE-2016-2313 such that it doesn't cause a regression
     for setups that rely on http authentication of users unknown to cacti.
     - Add improve_fix_for_CVE-2016-2313.patch
   * Full update of README.Debian
   * CVE-2016-3172
     - Add CVE-2016-3172_sql-injection-in-tree.php.patch (Closes: #818647)
   * Update Brazilian Portuguese, thanks to Diego Neves (Closes: #816962)
   * Drop old code in postinst to (re)move old configuration files this is
     already fixed in jessie
   * Bump version for libphp-adodb as mysqli doesn't work otherwise
   * Add new php-xml & php-mbstring to Depends for php7.0
   * Add add_rrdtool-1.5_to_utilities.php.patch to prevent error in
     utilities.php with rrdtool version 1.5
   * Remove Mahyuddin from uploaders (thanks for the fish)
 .
   [ Nishanth Aravamudan ]
   * Update to PHP7.0 dependencies (LP: #1544352)
   * Default to mysqli driver for database connection, as the mysql driver
     has been removed in PHP7.0 (LP: #1544352) (Closes: #815987)
Checksums-Sha1:
 6886b225b9df2e688c0b177d0a89c5baf3c7ae73 1571 cacti_0.8.8g+ds1-2.dsc
 8c1b1c46caa858521cca1e9f676aad7b5ef500cb 47472 cacti_0.8.8g+ds1-2.debian.tar.xz
Checksums-Sha256:
 ea004d0269efdf957984ae13c1bf4040dd6e0416f4b66629fdbf261deddf3c39 1571 cacti_0.8.8g+ds1-2.dsc
 20cd1269b804126cb83f3be15d77e4baea8e29df0751f0addb01ef5c6a2e9f0a 47472 cacti_0.8.8g+ds1-2.debian.tar.xz
Files:
 9b7bbe22e077f97f3ba6091f551aa2ab 1571 web extra cacti_0.8.8g+ds1-2.dsc
 5e8b3d0cbd7a75a39fad62514fdb8824 47472 web extra cacti_0.8.8g+ds1-2.debian.tar.xz

---

From: Paul Gevers <[email-masked]>
Date: Sun, 17 Apr 2016 20:39:59 +0200

Hi TheSin,

On 04-04-16 20:56, TheSin wrote:

> I just meant if mysql + php7 is used then you need to remove the
> persist on the dsn, according to the adodb code base that is what
> forces _pconnect with mysql driver, with mysqli persist is ignored.
>

I tested cacti with the persist removed and the connection failed (with
mysqli). So I decided to just switch the driver.

Paul