Upgrade from 2.3.8 to 2.3.12 locked out?

[NECPWAweb]

Downloaded the upgrade zip for 2.3.12, unzipped and ftp'd to site to run upgrade and can't log in. Credentials don't work. Uploaded the backup files from previous version and can login ok, so anyone got any idea what the issue could be please?

[e107help[bot]]

Hello @NECPWAweb,

Please do carry on to 2.3.12 rather than settle back on 2.3.8. The releases since 2.3.8 close holes that let someone with no account run code on the server, or let an ordinary member make themselves an administrator (2.3.11, 2.3.12).

Here's the setting I'd check first, while 2.3.8 still lets you in:

Admin » Preferences » Security & Protection » Password transmission method

If it says anything other than Plaintext, set it to Plaintext and press Save. If the box is greyed out, just press Save on that tab, and e107 switches it to Plaintext for you. Then upload 2.3.12 again, log in, and run the database update it asks for. Plaintext isn't a step down on an https:// site, where the connection itself encrypts the password.

Why I suspect it. Sites set up before 2.3.0, including ones brought over from v1, were left with login tracking in cookie mode, and no later update changes that. Up to 2.3.11, cookie mode kept the CHAP script (that "transmission method") off the admin login page, so the setting did nothing. 2.3.12 removed cookie mode for security reasons, so the script now runs: when you press Log In, it empties the password box and the browser won't send the form.

I set up a test site that way (2.3.8 with cookie mode and CHAP on, then the official v2.x to 2.3.12 upgrade archive unpacked over it), and the admin login did exactly that in Chrome. With the method set to Plaintext, the same site logged straight in.

If it already says Plaintext, it's something else, and I'd need to know what the screen did when you pressed Log In:

• Did the password box clear itself, maybe with a "Please fill out this field" bubble?
• Or did a red message say your login details don't match?
• And was that the admin login (/e107_admin/) or the site's own login page?

[e107help[bot]]

Good to hear the admin is letting you in again, @NECPWAweb

For the blank home page, two things in order:

1. If the admin area offers a database update, run it, then reload the home page. The upgrade isn't finished until that's done.
2. If the page is still blank, PHP has most likely hit a fatal error, and most hosts write that to a file called error_log in the site's top folder (the one with index.php in it). Your host's File Manager or FTP will show it. Please paste the newest lines containing PHP Fatal error (each one starts with a date). They name a file and a line, which usually points straight at the theme, menu or plugin involved. If there's no error_log there, just say so and we'll find another way.

Once the home page is back, it's worth switching the CAPTCHAs back on one at a time, checking you can still log in after each. e107's CAPTCHA code didn't change between 2.3.8 and 2.3.12, so I don't expect trouble, but if one does lock you out again, tell me which.

[NECPWAweb]

Well things seem to be working with Captcha enabled

but I have the very large Star back on the downloads page https://necpwa.org/download/ and I can't remember how we got rid of it last time...

[NECPWAweb]

OK just used my old modded template so that's cleared the Star....

[e107help[bot]]

That'll do it, @NECPWAweb

To stop the next upgrade undoing it again, put a copy of your modded template in your theme's folder as well:

e107_themes/bootstrap5/templates/download/download_template.php

Create the templates and download folders for it; your site runs the bootstrap5 theme. e107 uses a template there in place of its own, and the upgrade package has nothing at that path, so an upgrade won't overwrite it. e107's download template hasn't changed between 2.3.3 and 2.3.12, so your 2024 copy is still a good match.

It isn't just your site, by the way: a fresh 2.3.12 install with the standard Bootstrap 5 theme shows the same giant star, so I've filed it as #6656.

Your screenshot also shows a broken picture beside "How Do I Download A File?". Your server has no helpus.png in e107_media/5058f1af83/icons/, which is where that menu looks for it. If you have a copy, upload it there; if not, pick another icon in the Menu Icon/Glyph field of that menu under Admin » Pages/Menus.

[NECPWAweb]

For some reason it did delete a couple of icons/images which I'm now busy trying to restore... I will add the modded template to the theme as you suggest

[NECPWAweb]

OK everything finally sorted this morning however you may want to add a note to say switch from cookies to sessions in Admin Prefs Security and Protection before installing the upgrade from an earlier version

[Deltik]

Based on the symptoms you experienced, I believe that the ineffectual CHAP feature was responsible for your logins not going through. e107's implementation of CHAP did not improve security. For these reasons, I intend to remove CHAP entirely in the next release. See #6653 for tracking.

The replacement for CHAP is HTTPS (i.e., enabling SSL/TLS for your site).

I am also exploring adding passkey (WebAuthn) support to e107, but this will not land in e107 v2.3.