View Issue Details

This bug affects 2 person(s).
 24
IDProjectCategoryView StatusLast Update
17482Bug reportsEncryptionpublic2021-08-12 08:46
Reporteraserto Assigned Top_teichmann  
PriorityimmediateSeveritypartial_block 
Status closedResolutionfixed 
Product Version5.x 
Summary17482: Key missmatch for encryption
Description

After updating to version 5.0.11+ yesterday I can't safe sucessfully any of my studies. At the end of every survey I get error 500 - wrong key for encrytion.

I checked some possible reasons, but can't find any wrong configurations:

  1. check my security.php
    and compare with the backup-Version:

    • encryptionkeypair = no differences
    • encyrptionpublickey = no differences
    • encroytionsecretkey = no differences
      NEW since I updted:
    • encryptionnonce
    • encryptionsecretboxkey
  2. I try to export and import my surveys or generat a new one: no differences, same error

  3. I try to test, if there is a difference between surveys with access control and without: no differece

  4. I try to check every question, if there is "encrypted" enabled or not: no differences

Every study can't open "Last page" or "end URL". I always get the erro 500 page.
Do you have any ideas what to do?

Additional Information

Here you can test by yourself:
https://research-aserto.com/index.php/799223?lang=de

TagsNo tags attached.
Bug heat24
Complete LimeSurvey version number (& build)5.0.11+210727
I will donate to the project if issue is resolvedYes
Browser
Database type & versionMySQl 8
Server OS (if known)
Webserver software & version (if known)
PHP Version7.4

Relationships

has duplicate 17483 closedgalads Wrong decryption key! error on survey submission after upgrade to 5.0.11 +210727 

Users monitoring this issue

arpsh

Activities

Mazi

Mazi

2021-07-28 15:06

updater   ~65685

@aserto:

  1. What was the previous version you updated from?
  2. Can you confirm that encryption is turned off everywhere and had not been enabled temporarily?

@p_teichmann, is this a known issue?

arpsh

arpsh

2021-07-28 16:10

reporter   ~65694

We have exactly the same issue - prepared a bug report a couple of hours ago but only just submitted, and saw this - doh!

Bug ID 17332, so please merge them together if you can - all the details of our problem are in that ticket, but largely match aserto. The only difference seems to be that we can't enable or disable encryption in any question design screens (at least one question in a single survey I believe was encrypted.

p_teichmann

p_teichmann

2021-07-28 16:22

administrator   ~65697

Thank you for reporting the issue.
This is not a known issue, but we are investigating the issue right now.
Is this error only happening at the end of every survey or in any other part of the application?

ollehar

ollehar

2021-07-28 16:22

administrator   ~65698

Sorry to hear about that. Can you give us more data? E.g. lsa files or database dump. You can upload them privately.

arpsh

arpsh

2021-07-28 16:43

reporter   ~65702

To reply to p_teichmann, for us it only happening at the end of surveys (all of them), whether they go to the lastpage or the the end url. Everything else we have tried still seems to work fine (other than the aforementioned encryption on/off toggle being greyed out).

ollehar

ollehar

2021-07-28 16:46

administrator   ~65703

@arpsh, is that surveys with token or without?

arpsh

arpsh

2021-07-28 16:50

reporter   ~65704

To ollehar - our surveys all have tokens, but aserto's test link posted above https://research-aserto.com/index.php/799223?lang=de doesn't have tokens, yet also shows the error.

ollehar

ollehar

2021-07-28 16:51

administrator   ~65705

OK, thank you. Can you enable debug => 2 in config.php and try again, please?

ollehar

ollehar

2021-07-28 16:54

administrator   ~65706

Also, what other kind of survey settings do you have enabled? Save timings or IP or similar?

Mazi

Mazi

2021-07-28 17:02

updater   ~65707

@aserto, please attach the test survey as LSS file for further debugging.

aserto

aserto

2021-07-28 17:03

reporter   ~65708

@p_teichmann: "Is this error only happening at the end of every survey or in any other part of the application?"
Yes, only at the end of every survey. Normal "login" with access-token works (non of our questions are encrypted). Same impressions as @arpsh descriped

@ollehar: "@arpsh, is that surveys with token or without? "
Same behavior. With and withou token.

@ollehar: "OK, thank you. Can you enable debug => 2 in config.php and try again, please? "
Is enabled for https://research-aserto.com/index.php/799223?lang=de

@ollehar: "Also, what other kind of survey settings do you have enabled? Save timings or IP or similar? "

  • Date stamp
    only
arpsh

arpsh

2021-07-28 17:07

reporter   ~65709

Debug screenshot attached

arpsh

arpsh

2021-07-28 17:07

reporter   ~65711

Capture.PNG (416,040 bytes)
ollehar

ollehar

2021-07-28 17:08

administrator   ~65712

Last edited: 2021-07-28 17:09

OK, thanks. Yes, this error makes sense. We have to apply another database update to re-encrypt the emailsmtppassword and bounceaccountpass global settings. We could also write a CLI command to apply this re-encryption on demand.

ollehar

ollehar

2021-07-28 17:14

administrator   ~65713

If we write it tonight we can review, test and release it tomorrow during the day.

Mazi

Mazi

2021-07-28 17:19

updater   ~65714

@ollehar, thanks for picking this up so quickly.

ollehar

ollehar

2021-07-28 17:29

administrator   ~65715

How to reproduce:

  1. Checkout e6c087af2b1a82cafdb3235d00ed9b5fde550c00 (5.0.10)
  2. Apply fresh install
  3. Add global settings for emailsmtppassword and bounceaccountpass (they are encrypted)
  4. Create new survey with one group and question
  5. Activate survey
  6. Checkout latest master
  7. Reload admin interface
  8. Apply database update
  9. Execute the previous survey
  10. Submit
  11. Error
ollehar

ollehar

2021-07-29 11:54

administrator   ~65732

The fix is released. Please update and test.

arpsh

arpsh

2021-07-29 14:20

reporter   ~65742

Installed and tested just now - have sucessfully completed two token controlled surveys with both lastpage and end url respectively. Can also toggle encryption where applicable. Therefoe as far as I can judge, the fix is working.

Many thanks for the quick turnaround on this bug!

ollehar

ollehar

2021-07-29 14:21

administrator   ~65743

Glad to hear it, and our apologies for the issue.

I'll mark this as solved.

aserto

aserto

2021-07-29 14:25

reporter   ~65744

Great. Works fine. Good work an thank you!

Issue History

Date Modified Username Field Change
2021-07-28 14:57 aserto New Issue
2021-07-28 15:06 Mazi Note Added: 65685
2021-07-28 16:10 arpsh Note Added: 65694
2021-07-28 16:22 p_teichmann Note Added: 65697
2021-07-28 16:22 ollehar Note Added: 65698
2021-07-28 16:22 p_teichmann Relationship added related to 17483
2021-07-28 16:43 arpsh Note Added: 65702
2021-07-28 16:46 ollehar Note Added: 65703
2021-07-28 16:50 arpsh Note Added: 65704
2021-07-28 16:51 ollehar Note Added: 65705
2021-07-28 16:54 ollehar Note Added: 65706
2021-07-28 17:02 Mazi Note Added: 65707
2021-07-28 17:03 aserto Note Added: 65708
2021-07-28 17:07 arpsh Note Added: 65709
2021-07-28 17:07 arpsh Note Added: 65711
2021-07-28 17:07 arpsh File Added: Capture.PNG
2021-07-28 17:08 ollehar Note Added: 65712
2021-07-28 17:09 ollehar Note Edited: 65712
2021-07-28 17:14 ollehar Note Added: 65713
2021-07-28 17:19 Mazi Note Added: 65714
2021-07-28 17:29 ollehar Note Added: 65715
2021-07-29 08:33 galads Assigned To => p_teichmann
2021-07-29 08:33 galads Status new => assigned
2021-07-29 08:35 galads Relationship replaced has duplicate 17483
2021-07-29 10:01 arpsh Issue Monitored: arpsh
2021-07-29 10:38 ollehar Priority none => immediate
2021-07-29 11:54 ollehar Note Added: 65732
2021-07-29 11:54 ollehar Status assigned => resolved
2021-07-29 11:54 ollehar Resolution open => fixed
2021-07-29 14:20 arpsh Note Added: 65742
2021-07-29 14:21 ollehar Note Added: 65743
2021-07-29 14:25 aserto Note Added: 65744
2021-08-02 16:06 c_schmitz Bug heat 22 => 24
2021-08-12 08:46 c_schmitz Status resolved => closed