5

I applied the patch correctly, but trying to log (admin) in is giving the following error:

error_log: PHP Fatal error: Call to undefined function hash_equals() in /app/code/core/Mage/Core/Model/Encryption.php on line 103

Encryption.php on line 103

/**
 * Validate hash against hashing method (with or without salt)
 *
 * @param string $password
 * @param string $hash
 * @return bool
 * @throws Exception
 */
public function validateHash($password, $hash)
{
    $hashArr = explode(':', $hash);
    switch (count($hashArr)) {
        case 1:
            return hash_equals($this->hash($password), $hash);
        case 2:
            return hash_equals($this->hash($hashArr[1] . $password),  $hashArr[0]);
    }
    Mage::throwException('Invalid hash.');
}

I use the following version:

PHP Version 5.3.29

Magento Version 1.9.2.4

I've already done what was suggested in this post, but the problem at the time of logging remains.

Security Patch SUPEE-8788 - Possible Problems?

  • 1
    Your problem is PHP version, see this link, encryption is deprecated – St3phan Nov 8 '16 at 12:34
  • I can not update php because I have another system that depends on this version. The problem only started to appear because I applied the patch. – Wilson Eugenio Nov 8 '16 at 13:53
  • you can put multiple versions of PHP on the same server and can be set for each site which version to load, see link – St3phan Nov 8 '16 at 19:38
  • Cool, I did not know that. My site is hosted in a CEntos, VPS in godaddy, is it possible for me to define a PHP version for two hosted sites? – Wilson Eugenio Nov 8 '16 at 23:37
  • 1
    Possible duplicate of Security Patch SUPEE-8788 - Possible Problems? – Teja Bhagavan Kollepara Dec 4 '17 at 11:05
5

Function hash_equals emerged in php from version 5.6. Look here http://php.net/manual/ru/function.hash-equals.php.

But this Patch SUPEE-8788 patched file app/code/core/Mage/Core/functions.php and add this code to the end of file for old versions of PHP :

if (!function_exists('hash_equals')) {
    /**
     * Compares two strings using the same time whether they're equal or not.
     * A difference in length will leak
     *
     * @param string $known_string
     * @param string $user_string
     * @return boolean Returns true when the two strings are equal, false otherwise.
     */
    function hash_equals($known_string, $user_string)
    {
        $result = 0;

        if (!is_string($known_string)) {
            trigger_error("hash_equals(): Expected known_string to be a string", E_USER_WARNING);
            return false;
        }

        if (!is_string($user_string)) {
            trigger_error("hash_equals(): Expected user_string to be a string", E_USER_WARNING);
            return false;
        }

        if (strlen($known_string) != strlen($user_string)) {
            return false;
        }

        for ($i = 0; $i < strlen($known_string); $i++) {
            $result |= (ord($known_string[$i]) ^ ord($user_string[$i]));
        }

        return 0 === $result;
    }
}

Please make sure, that patch was applied correctly and this file was patched.

Also check file app/etc/applied.patches.list and try to find there 'SUPEE-8788'

UPDATE:

Even if your patch was successful then it may mean that you have copied functions.php in app/code/local/Mage/Core.

You will have to insert that function there too because that file overwrites the core one.

So insert in app/code/local/Mage/Core/functions.php at the end.

  • Hello, thank you very much for the help, but I have already changed the functions.php file, as you said, but I can not login. – Wilson Eugenio Nov 8 '16 at 13:27
1

Most probably you have copied functions.php in app/code/local/Mage/Core.

You will have to insert that function there too because that file overwrites the core one.

So insert in app/code/local/Mage/Core/functions.php at the end:

if (!function_exists('hash_equals')) {
    /**
     * Compares two strings using the same time whether they're equal or not.
     * A difference in length will leak
     *
     * @param string $known_string
     * @param string $user_string
     * @return boolean Returns true when the two strings are equal, false otherwise.
     */
    function hash_equals($known_string, $user_string)
    {
        $result = 0;

        if (!is_string($known_string)) {
            trigger_error("hash_equals(): Expected known_string to be a string", E_USER_WARNING);
            return false;
        }

        if (!is_string($user_string)) {
            trigger_error("hash_equals(): Expected user_string to be a string", E_USER_WARNING);
            return false;
        }

        if (strlen($known_string) != strlen($user_string)) {
            return false;
        }

        for ($i = 0; $i < strlen($known_string); $i++) {
            $result |= (ord($known_string[$i]) ^ ord($user_string[$i]));
        }

        return 0 === $result;
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.