Photo Gallery Forums

Hello, Karl,

Is there a blog or forum thread that you keep updated with the latest PHP version number that X3 is compatible with?

If not, what would be the latest PHP version number that you are aware X3 is capable of?

I have found that X3 works perfectly with PHP up to 8.3.13.  But when I tried PHP 8.4.1, X3 "displays" fine to the public, but I am unable to log into the panels.  The panel login page displays fine, but after entering in my login credentials (username & password), X3 always comes back with: Please check your username or password.  I know the credentials are correct, because my password manager is entering in all my login credentials.

So it would seem that X3 is not quite ready for PHP 8.4.1, but I'm wondering what the highest version of PHP 8.3.x that it is compatible with.

Thank you in advance & have yourself a great day.

Regards,
John

X3 is tested and updated for PHP 8.3. I haven't tested on PHP 8.4 yet. There could be some "deprated" warning, or it could also be there are missing required modules in your PHP 8.4 setup.

mjau-mjau wrote: There could be some "deprated" warning, or it could also be there are missing required modules in your PHP 8.4 setup.

My 8.4.1 is using the same modules as my previous PHP versions, and it also works perfectly with all my other 1/2 dozen PHP scripts, so it must be something in X3 that's causing the hiccup.

Thanks anyway.

JMM wrote: My 8.4.1 is using the same modules as my previous PHP versions, and it also works perfectly with all my other 1/2 dozen PHP scripts, so it must be something in X3 that's causing the hiccup.

As stated in my last reply. X3 has not been tested with PHP 8.4, so it will either by related to a deprecated or changed function in PHP 8.4, or your PHP 8.4 install does not have the same options extensions as your PHP 8.3. If you are sure it's not the latter, then it's the former. Of course, if you had a link to the error, it would be easy to diagnose the error message.

Just like ALL PHP apps, they are officially supported up to specific PHP versions. The app doesn't know what changes new PHP versions bring before they are released, and may or may not work. In X3 releases (see blog), I always add patches to support latest PHP version.

I'm not convinced it's X3 related, especially if you can't see the error log. There should even be an error_log.txt inside the X3 panel dir. What you are reporting, is typical of "sessions" not working, perhaps sessions storage path. Just because your other apps aren't working, probably means they dont use PHP session logins.

JMM wrote:So it would seem that X3 is not quite ready for PHP 8.4.1, but I'm wondering what the highest version of PHP 8.3.x that it is compatible with.

Minor releases *.X.* may introduce breaking changes, but *.*.X revisions won't, so X3 will always work with all PHP 8.3 revisions.

Hi again, Karl.  My apologies, sir, I was in no way complaining... I was just curious, that's all.  I had recently upgraded all my other (non-X3) sites to PHP 8.4.1, and thought I would take a chance & try upgrading my X3 sites as well. I am 100% fine continuing to run my X3 sites on PHP 8.3.12.

mjau-mjau wrote: I'm not convinced it's X3 related, especially if you can't see the error log. There should even be an error_log.txt inside the X3 panel dir. What you are reporting, is typical of "sessions" not working, perhaps sessions storage path. Just because your other apps aren't working, probably means they dont use PHP session logins.

For my test X3 site that I had tried to use PHP 8.4.1 on, I can see a php_errors.log file in the root of that site, but that log file is empty.  I see another php_errors.log file in the \app\parsers\slir folder, but that just has a few slir errors from back in June of this year (when I was on X3.32.0), and nothing since.

mjau-mjau wrote: Of course, if you had a link to the error, it would be easy to diagnose the error message.

I don't want you to waste your time diagnosing the error message, as it's not a problem... I was just curious.  But if you wish to see the error message anyway, I can email you credentials to log into that X3 site.  The public can see that X3 site fine, which is at https://x3.nitrowings.me, and that site's panel login page displays fine, too.  It is only when attempting to log in that the error message is displayed.

Thanks anyway.

Regards,
John

JMM wrote: Hi again, Karl.

I will be looking into PHP 8.4 for next release. It could very well be PHP 8.4, but it could also be if you are running your own servers with "show all error message", it could be a warning "{Some fucntion} used in {context} is deprecated", and that might be blocking progress. Because it's login-related, I have a feeling it's something else. Did you check your /?diagnostics page? Did you check the file /panel/filemanager_error_log.txt?

Feel free to send login link to me for further inspection, although I might not be able to diagnose further just by reviewing the issue.

mjau-mjau wrote: Did you check your /?diagnostics page? Did you check the file /panel/filemanager_error_log.txt?

The diagnostics page for my X3 test site running PHP 8.4.1, and the diagnostics page for one of my X3 sites running PHP 8.3.12, both look basically the same.  I do notice that none of my X3 sites have Session Save Path defined, which you mentioned about the other day.  And there is no error log in the /panel folder.

Just to clarify, it is not a PHP error that is displayed... no PHP error is displayed.  It is an X3 error that is displayed, as shown in the 3rd picture on THIS page.  Apologies for any confusion.

This problem could also possibly be caused by me not using an Apache-type web server.  My web server, Abyss, does not use any .htaccess files, but instead uses rewrite rules to simulate what X3's .htaccess does.  Maybe one of my rewrite rules is the problem, but that wouldn't explain why everything, including Panel logging in, has worked flawlessly over the years up until 8.3.12.

JMM wrote:Just to clarify, it is not a PHP error that is displayed... no PHP error is displayed.  It is an X3 error that is displayed, as shown in the 3rd picture on THIS page.

There is no such thing as an X3 error in this sense. An X3 error is either a PHP error or a javascript error, and this is definitely not a javascript error. Either your login is wrong, or it's a PHP error. Else it would log in.

If there is no error log anywhere about this, it would insinuate, no matter how strange it seems, that the login is actually incorrect. There is no other reason it would return "Please check your username or password".

Now since I'm already on this case, you can feel free to send me FTP details for further diagnosis.

Hi @JMM. I have been updating our servers to PHP 8.4, and I noticed a problem, probably what you are experiencing. Basically PHP 8.4 uses a new hashing algorithm, and therefore your encrypted password saved from an earlier PHP version does not match when checking from PHP 8.4. I'm not sure if there is anything I can do about this, unless I can perhaps lock the algorithm being used.
https://php.watch/versions/8.4/password ... t-increase

The solution would be to 1. open config.user.json and set password there to "temporary", 2. login with "temporary" password and 3. Save your correct password again from inside the panel, in which case it will get saved encrypted according to PHP 8.4.

I might look into a solution, although technically it's not an error. It's just that passwords encrypted with password_hash() in PHP 8.3 (or earlier), do not match with password_verify() in PHP 8.4.

mjau-mjau wrote: The solution would be to 1. open config.user.json and set password there to "temporary", 2. login with "temporary" password and 3. Save your correct password again from inside the panel, in which case it will get saved encrypted according to PHP 8.4.

Your suggested solution fixed the problem, thanks.
Another solution if the user is able to change PHP versions, so as not needing to touch the config.user.json file, is to:

1. Set the X3 host to use a version of PHP that works (such as PHP 8.3.x);
2. Log into X3's panel;
3. While already logged into X3's panel, change that X3 host to use PHP 8.4.x;
4. In X3 that is now using PHP 8.4.x, enter in the password that the user wishes to use (such as the original password used to log in); and
5. After X3 automatically logs the user out after changing the password, log back into X3's panel, which should now work.

Thanks again for finding the problem & work-around.

In new minor release X3.34.1, this has been fixed, and it doesn't matter if current PHP version is different from the PHP version which was originally used to encrypt the password. Now it just uses password_verify() which automatically detects the encryption used in the encrypted password. The problem previously, was that we used password_needs_rehash() to detect if the password was encrypted according to current algorithm before verifying, but this would fail in >= PHP 8.4 when when attempting to verify passwords encrypted in <= PHP 8.3. Ref:
https://php.watch/versions/8.4/password ... t-increase

Conclusion
If you are updating your server from PHP <= 8.3 to PHP >= 8.4, you should first update to X3.34.1 (or higher). *Optionally, use one of the previous suggestions in this post, but the proper solution is to use latest X3 version >= X3.34.1.

Info about latest relese X3.34 was posted here:
https://www.photo.gallery/blog/photo-gallery-x3-34/