Clipperz Community Edition stopped working

104 views
Skip to first unread message

Pieter Edelman

unread,
Aug 21, 2008, 2:46:02 AM8/21/08
to Clipperz
Dear Clipperz community,

The strangest thing happened to me in the last couple of days. I have
been using Clipperz Community Edition for some time now on my home
computer, and it used to work just fine. However, I'm not able to log
in into my account anymore. Even stranger, I can't make a new account
either, I get the following error:
Clipperz.PM.DataModel.User.exception.LoginFailed
I tested this with several browsers (Firefox with different profiles
and settings, Opera, IE) on two computers, but the result is always
the same. Therefore, I expect the problem to be a server issue.

However, on the server side everything seems to be working as it
should be. I run Arch Linux with Apache and MySQL. PHP is able to
connect to MySQL and BCmath, JSON and PDO are enabled. Moreover, there
aren't any PHP errors from Clipperz in my error log (with full logging
enabled). I also tried to re-install Clipperz with a completely empty
database, but this didn't solve the problem I also tried downgrading
my PHP version, but that didn't matter either. Lastly, I tried the
procedure with SSL disabled, but to no avail.

I don't really recall when was the last time I logged in to Clipperz
and what has changed on my computer in the meantime. Probably, my
server software has been upgraded.

So I'm basically stuck. I captured the traffic between the browser and
the server with Firebug during the creation of a new account. On two
occasions, the server response is {"error":"?"}. This doesn't really
tell me anything, but I hope someone here can interpret these messages
posted below.

Thanks for any help,

Pieter

===REQUEST===
POST http://localhost/clippy/php/index.php
http://localhost/clippy/php/index.php
26ms clippy (line 6991)
ParamsHeadersPostPutResponseCache
Response Headers
Request Headers
method registration
parameters {"credentials":
{"C":"9a984e219b07f9b645ef35f4de938b4741abe2e0b4adc88b40e9367170c91cc8",
"s":"5c3aa962337146b6b78722cce97fa56f2ce6a4a698193a2599fa49dd4ede118b",
"v":"6066a1783402d2b283e097dd8fda204e38ee8bbcbe378d7a6ca6f921470e90f0",
"version":"0.2"}, "user":{"header":"{\"records\":{\"index\":{}, \"data
\":\"QbpuasdOMPr3OgXHM0Vox3Qo\"}, \"directLogins\":{\"index\":{},
\"data\":\"yDBhJxbRVxDbcMFQ1poqTwsz\"}, \"preferences\":{\"data\":
\"4rm0DPc9eyPVT0vD7I8jf3S6\"}, \"oneTimePasswords\":{\"data\":\"+Adyn/
h94pehZYF1cpKiHr4z\"}, \"version\":\"0.1\"}", "statistics":"ZmpeW/+
+GnFY5skXZFxMU3i6", "version":"0.3", "lock":"new lock"},
"version":"0.2", "message":"completeRegistration"}

===RESPONSE===
{"lock":"new lock","result":"done"}

===REQUEST===
POST http://localhost/clippy/php/index.php
http://localhost/clippy/php/index.php
58ms clippy (line 6991)
ParamsHeadersPostPutResponseCache
Response Headers
Request Headers
method handshake
parameters {"message":"connect", "version":"0.2", "parameters":
{"C":"9a984e219b07f9b645ef35f4de938b4741abe2e0b4adc88b40e9367170c91cc8",
"A":"3fec658cdea77984bcd2ddccdcde47f43c7f9e364e6377378bff6e88932663d"}}

===RESPONSE===
{"s":"112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00","B":"35b2ed7d105df16afb49d5bfb7e5d477c05a5265e99302c069f594b9c2ae39d2"

}

===REQUEST===
POST http://localhost/clippy/php/index.php
http://localhost/clippy/php/index.php
47ms clippy (line 6991)
ParamsHeadersPostPutResponseCache
Response Headers
Request Headers
method handshake
parameters {"message":"credentialCheck", "version":"0.2", "parameters":
{"M1":"d9451b86ccab72834114398a385001df6ca1535fd9a1fa749de4f886e0ac6b3d"}}

===RESPONSE===
{"error":"?"}

===REQUEST===
POST http://localhost/clippy/php/index.php
http://localhost/clippy/php/index.php
12ms clippy (line 6991)
ParamsHeadersPostPutResponseCache
Response Headers
Request Headers
method handshake
parameters {"message":"connect", "version":"0.1", "parameters":
{"C":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"A":"6956e2155d3e08123e4d04dad6463edc7004a08e1551bd47f72848ff4f12f3b8"}}

===RESPONSE===
{"s":"112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00","B":"12598c9b0b3a1d559468c593691ccbaa2cf18e2b1a2c8d5f62f3dc68843f5740d"

}

===REQUEST===
POST http://localhost/clippy/php/index.php
http://localhost/clippy/php/index.php
52ms clippy (line 6991)
ParamsHeadersPostPutResponseCache
Response Headers
Request Headers
method handshake
parameters {"message":"credentialCheck", "version":"0.1", "parameters":
{"M1":"8b1c44457a2c6fe83ecfd1e8e501d5676fa33c6ccd2c19d00442f17a141fe15c"}}

===RESPONSE===
{"error":"?"}

Giulio Cesare Solaroli

unread,
Aug 21, 2008, 3:50:10 AM8/21/08
to p.ed...@gmail.com, Clipperz
Hello Pieter,

in the logs you see first a registration request that seems to succeed.

Later, you have the regular login procedure that fails probably
because the server can not find the data on the DB and it is returning
fake data in order to avoid an early failure that could speed up a
dictionary attack.

Have you tried to run the POG setup/test procedure? As it looks like
the PHP script has some issues writing or reading from the DB.

Hope this helps.

Best regards,

Giulio Cesare

Rol!

unread,
Aug 21, 2008, 5:20:39 AM8/21/08
to Clipperz
Hello Pieter, Giulio

I have the same error as Pieter. it looks like the problem comes from
base64 plugin.
if i made an installation without base64 then everthing works fine.

@Pieter, perhaps you could also made a test without base64.


On Aug 21, 9:50 am, "Giulio Cesare Solaroli" <giulio.ces...@gmail.com>
wrote:
> Hello Pieter,
>
> in the logs you see first a registration request that seems to succeed.
>
> Later, you have the regular login procedure that fails probably
> because the server can not find the data on the DB and it is returning
> fake data in order to avoid an early failure that could speed up a
> dictionary attack.
>
> Have you tried to run the POG setup/test procedure? As it looks like
> the PHP script has some issues writing or reading from the DB.
>
> Hope this helps.
>
> Best regards,
>
> Giulio Cesare
>
> > POSThttp://localhost/clippy/php/index.php
> >http://localhost/clippy/php/index.php
> >                        26ms    clippy (line 6991)
> > ParamsHeadersPostPutResponseCache
> > Response Headers
> > Request Headers
> > method  registration
> > parameters      {"credentials":
> > {"C":"9a984e219b07f9b645ef35f4de938b4741abe2e0b4adc88b40e9367170c91cc8",
> > "s":"5c3aa962337146b6b78722cce97fa56f2ce6a4a698193a2599fa49dd4ede118b",
> > "v":"6066a1783402d2b283e097dd8fda204e38ee8bbcbe378d7a6ca6f921470e90f0",
> > "version":"0.2"}, "user":{"header":"{\"records\":{\"index\":{}, \"data
> > \":\"QbpuasdOMPr3OgXHM0Vox3Qo\"}, \"directLogins\":{\"index\":{},
> > \"data\":\"yDBhJxbRVxDbcMFQ1poqTwsz\"}, \"preferences\":{\"data\":
> > \"4rm0DPc9eyPVT0vD7I8jf3S6\"}, \"oneTimePasswords\":{\"data\":\"+Adyn/
> > h94pehZYF1cpKiHr4z\"}, \"version\":\"0.1\"}", "statistics":"ZmpeW/+
> > +GnFY5skXZFxMU3i6", "version":"0.3", "lock":"new lock"},
> > "version":"0.2", "message":"completeRegistration"}
>
> > ===RESPONSE===
> > {"lock":"new lock","result":"done"}
>
> > ===REQUEST===
> > POSThttp://localhost/clippy/php/index.php
> >http://localhost/clippy/php/index.php
> >                        58ms    clippy (line 6991)
> > ParamsHeadersPostPutResponseCache
> > Response Headers
> > Request Headers
> > method  handshake
> > parameters      {"message":"connect", "version":"0.2", "parameters":
> > {"C":"9a984e219b07f9b645ef35f4de938b4741abe2e0b4adc88b40e9367170c91cc8",
> > "A":"3fec658cdea77984bcd2ddccdcde47f43c7f9e364e6377378bff6e88932663d"}}
>
> > ===RESPONSE===
> > {"s":"112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00","B":"35b2ed7d105df16afb49d5bfb7e5d477c05a5265e99302c069f594b9c2ae39d2"
>
> > }
>
> > ===REQUEST===
> > POSThttp://localhost/clippy/php/index.php
> >http://localhost/clippy/php/index.php
> >                        47ms    clippy (line 6991)
> > ParamsHeadersPostPutResponseCache
> > Response Headers
> > Request Headers
> > method  handshake
> > parameters      {"message":"credentialCheck", "version":"0.2", "parameters":
> > {"M1":"d9451b86ccab72834114398a385001df6ca1535fd9a1fa749de4f886e0ac6b3d"}}
>
> > ===RESPONSE===
> > {"error":"?"}
>
> > ===REQUEST===
> > POSThttp://localhost/clippy/php/index.php
> >http://localhost/clippy/php/index.php
> >                        12ms    clippy (line 6991)
> > ParamsHeadersPostPutResponseCache
> > Response Headers
> > Request Headers
> > method  handshake
> > parameters      {"message":"connect", "version":"0.1", "parameters":
> > {"C":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
> > "A":"6956e2155d3e08123e4d04dad6463edc7004a08e1551bd47f72848ff4f12f3b8"}}
>
> > ===RESPONSE===
> > {"s":"112233445566778899aabbccddeeff00112233445566778899aabbccddeeff00","B":"12598c9b0b3a1d559468c593691ccbaa2cf18e2b1a2c8d5f62f3dc68843f5740d"
>
> > }
>
> > ===REQUEST===
> > POSThttp://localhost/clippy/php/index.php

Giulio Cesare Solaroli

unread,
Aug 21, 2008, 5:29:08 AM8/21/08
to rke...@gmail.com, Clipperz
Rol, thanks for the update!!!

It is very nice from my point of view to see other people providing
some relevant feedback on this forum.

It really helps improving the "community" feeling that we are trying
to fuel. :-)

Ciao,

Giulio Cesare

Rol!

unread,
Aug 21, 2008, 7:25:29 AM8/21/08
to Clipperz
your welcome ;)

@Giulio: did you have an idea where the problem could be with the
base64? as i understand it right this will only be used for a secure
db communication/connection.
but i think this is not implicitly required if the database and the
website is on the same server (localhost connection) right?


On Aug 21, 11:29 am, "Giulio Cesare Solaroli"
<giulio.ces...@gmail.com> wrote:
> Rol, thanks for the update!!!
>
> It is very nice from my point of view to see other people providing
> some relevant feedback on this forum.
>
> It really helps improving the "community" feeling that we are trying
> to fuel. :-)
>
> Ciao,
>
> Giulio Cesare
>

Giulio Cesare Solaroli

unread,
Aug 21, 2008, 8:01:02 AM8/21/08
to rke...@gmail.com, Clipperz
Hello Rol,

I am not a POG nor a PHP expert and can not answer your question.

I feel like many different shortcomings in the current code base (for
example the requirement for a given quote settings on php.ini) could
be easily solvable in the code itself, but I wouldn't know how to do
it.

So if some PHP developer with some experience on POG could provide
some improvements, we will be very happy to include them.

To be totally true, one of our users actually submitted some code on
the previous Google Code project related to the installation
procedure, but I have never managed to inspect the changes he
submitted. :-(

If someone is willing to take care of our Source Forge Community
Edition project, I would be very interested in starting tutoring some
members hoping to be able to have a few more commiters onboard.
The PHP part would be definitely the simplest to delegate to someone,
but I am also willing to help people getting up to speed on the
Javascript side.

Giulio Cesare

Pieter Edelman

unread,
Aug 21, 2008, 12:14:21 PM8/21/08
to Clipperz
Hi Rol, Gulio,

Thanks for the quick response, and good to hear that there might be a
solution. I'd like to try this out, but I just have to answer a stupid
question first: what is the base64 plugin. I can't find any reference
to it in php.ini or phpinfo().

Pieter

Giulio Cesare Solaroli

unread,
Aug 21, 2008, 1:44:03 PM8/21/08
to p.ed...@gmail.com, Clipperz
Hello Pieter,

it should be one of the option of the POG engine. During the POG setup
there should be a check to specify wether or not to install the base64
plugin.

Giulio Cesare

Pieter Edelman

unread,
Aug 22, 2008, 8:19:27 AM8/22/08
to Clipperz
Ok, I try the complete setup procedure by going to the php/setup url.
There I click "Pog me up" and get the following report:

"""
Initializing POG Setup....OK!
File Structure....OK!
Configuration Info....OK!

Storage Status
Aligning [recordversion] with table 'recordversion'....OK!
Aligning [user] with table 'user'....OK!
Aligning [record] with table 'record'....OK!
Aligning [onetimepasswordstatus] with table
'onetimepasswordstatus'....OK!
Aligning [onetimepassword] with table 'onetimepassword'....OK!

POG Essentials
[recordversion]
Save()....OK!
SaveNew()....OK!
Delete()....OK!
GetList()
Limit....OK!
Sorting....OK!
DeleteList()....OK!
Optimizing....OK!
***
[user]
Save()....OK!
SaveNew()....OK!
Delete()....OK!
GetList()
Limit....OK!
Sorting....OK!
DeleteList()....OK!
Optimizing....OK!
***
[record]
Save()....OK!
SaveNew()....OK!
Delete()....OK!
GetList()
Limit....OK!
Sorting....OK!
DeleteList()....OK!
Optimizing....OK!
***
[onetimepasswordstatus]
Save()....OK!
SaveNew()....OK!
Delete()....OK!
GetList()
Limit....OK!
Sorting....OK!
DeleteList()....OK!
Optimizing....OK!
***
[onetimepassword]
Save()....OK!
SaveNew()....OK!
Delete()....OK!
GetList()
Limit....OK!
Sorting....OK!
DeleteList()....OK!
Optimizing....OK!

POG Relations PreRequisites
[recordversion]
Is properly connected (OK)
***
[user]
Is properly connected (OK)
***
[record]
Is properly connected (OK)
***
[onetimepasswordstatus]
Is properly connected (OK)
***
[onetimepassword]
Is properly connected (OK)

POG Relations
[recordversion]
Setrecord()....OK!
Getrecord()....OK!
***
[user]
Addrecord()....OK!
Addonetimepassword()....OK!
GetrecordList()....OK!
GetonetimepasswordList()....OK!
Delete(record)....OK!
Delete(onetimepassword)....OK!
Save(record)....OK!
Save(onetimepassword)....OK!
Set(record)List....OK!
Set(onetimepassword)List....OK!
***
[record]
Addrecordversion()....OK!
GetrecordversionList()....OK!
Delete(recordversion)....OK!
Save(recordversion)....OK!
Set(recordversion)List....OK!
Setuser()....OK!
Getuser()....OK!
***
[onetimepasswordstatus]
Addonetimepassword()....OK!
GetonetimepasswordList()....OK!
Delete(onetimepassword)....OK!
Save(onetimepassword)....OK!
Set(onetimepassword)List....OK!
***
[onetimepassword]
Setuser()....OK!
Setonetimepasswordstatus()....OK!
Getuser()....OK!
Getonetimepasswordstatus()....OK!

CHECKED 5 OBJECT(S). FOUND 0 ERROR(S). HURRAY!
---------------------------------------------------
"""

Next, I click "Proceed" and get an empty database. Then I click on the
"Manage Plugins" tab and get the following message:

"""
BASE64 Status
Checking MySQL function....NOT INSTALLED
Checking db_encoding status ignored

---------------------------------------------------
Click the INSTALL button below to install the base64 function to your
database.
"""

Which of course I don't do.

So it seems that the Base64 plugin is not installed. Still, the
problem persists.
If I try to make a new account, I see a record being added in the user
table. So your original statement that the data cannot be retrieved
from MySQL is probably true.

On Aug 21, 7:44 pm, "Giulio Cesare Solaroli" <giulio.ces...@gmail.com>
wrote:
> Hello Pieter,
>
> it should be one of the option of the POG engine. During the POG setup
> there should be a check to specify wether or not to install the base64
> plugin.
>
> Giulio Cesare
>

Giulio Cesare Solaroli

unread,
Aug 22, 2008, 11:21:09 AM8/22/08
to p.ed...@gmail.com, Clipperz
Hello Pieter,

if the data can be written, but the login can not be performed, it may
be an issue with the BCMath library.

During the registration the server side code does not perform any
computation, while during the login phase, SRP requires that also the
server perform some computation using BigInt arithmetics (and this is
what the BCMath library is there for).

Could you double check you phpinfo() output (just load the
php/test.php page on your clipperz installation folder) to see if the
BCMath module is correctly loaded?

Best regards,

Giulio Cesare

Pieter Edelman

unread,
Aug 22, 2008, 2:25:57 PM8/22/08
to Clipperz
Ok,

According tot phpinfo(), the configure command contains the switch '--
enable-bcmath=shared'. About the bcmath module, it says: BCMath
support: enabled
In my php.ini, bcmath is configured with the following lines:
[bcmath]
; Number of decimal digits for all bcmath functions.
bcmath.scale = 0

I suspect my server is somehow borked and I hate to bother you guys
with that. Does anybody know if there's a test suite for bcmath which
I can try? Otherwise, I can install Apache and PHP from another source
first.

Thanks,

Pieter

On Aug 22, 5:21 pm, "Giulio Cesare Solaroli" <giulio.ces...@gmail.com>
wrote:
> Hello Pieter,
>
> if the data can be written, but the login can not be performed, it may
> be an issue with the BCMath library.
>
> During the registration the server side code does not perform any
> computation, while during the login phase, SRP requires that also the
> server perform some computation using BigInt arithmetics (and this is
> what the BCMath library is there for).
>
> Could you double check you phpinfo() output (just load the
> php/test.php page on your clipperz installation folder) to see if the
> BCMath module is correctly loaded?
>
> Best regards,
>
> Giulio Cesare
>
> ...
>
> read more »

Giulio Cesare Solaroli

unread,
Aug 23, 2008, 4:26:21 AM8/23/08
to p.ed...@gmail.com, Clipperz
Hello Pieter,

have you take a look at the PHP logs produced on the server to see if
there is some hint there on what is going wrong?

Giulio Cesare

Pieter Edelman

unread,
Aug 26, 2008, 4:52:56 AM8/26/08
to Clipperz
Well, I wrote before that I can't find PHP errors relating to this
problem, but that's not entirely true. Occasionally, but not always, I
get the following message:
PHP Notice: Undefined index: otpId in /home/httpd/html/clippy/php/
index.php on line 263

For the rest, there are no PHP errors coming from Clipperz in my logs.

Pieter

On Aug 23, 10:26 am, "Giulio Cesare Solaroli"
<giulio.ces...@gmail.com> wrote:
> Hello Pieter,
>
> have you take a look at the PHP logs produced on the server to see if
> there is some hint there on what is going wrong?
>
> Giulio Cesare
>
> ...
>
> read more »

Pieter Edelman

unread,
Aug 27, 2008, 3:27:34 PM8/27/08
to Clipperz
Ok, tonight I finally found some time for experimenting. So I compiled
PHP from sources with minimal options, and Clipperz started working
again!
The I compiled PHP from sources with the same compile flags as the PHP
from my distro, and bingo, Clipperz shows the same erroneous behaviour
as before.
I'm now trying to single out the offending compile flag. If I succeed,
I will post it here.

Thanks for your patience,

Pieter
> ...
>
> read more »

Giulio Cesare Solaroli

unread,
Aug 27, 2008, 3:42:45 PM8/27/08
to p.ed...@gmail.com, Clipperz
Pieter,

thank you very much for your valuable feedback. I am really waiting to
see the outcome of your experiments!

Regards,

Giulio Cesare

sam.b...@gmail.com

unread,
Aug 28, 2008, 6:38:11 PM8/28/08
to Clipperz
Hi,
I am new to using Clipperrz.It is fantastic software,sadly I cannot
seem to get it working.
I am facing the same problem as Pieter.
While creating new account,the data base entry is getting created but
when loggin in it throws an exception(with firefox),or with it hangs
while doing SRP authentication(with IE).There are no errors in the log
and when I use fire bug,I get the same error as Pieter.

Could anyone please email be a build of PHP which works with
Clipperz.I have tried a lot with different versions of PHP but cannot
seems to get it working.I think its correct to say Clipperz is having
trouble with PHP5.2.6.Please correct me if I am working.

Regards,
Sam

On Aug 28, 5:42 am, "Giulio Cesare Solaroli" <giulio.ces...@gmail.com>
wrote:
> Pieter,
>
> thank you very much for your valuable feedback. I am really waiting to
> see the outcome of your experiments!
>
> Regards,
>
> Giulio Cesare
>
> ...
>
> read more »

Pieter Edelman

unread,
Aug 31, 2008, 8:21:43 AM8/31/08
to Clipperz, sam.b...@gmail.com
So, I finally found the culprit. It turned out the configuration flags
didn't have anything to do with it, but instead the different php.ini
was the reason it started working again. In my php.ini, I had the
following two options enabled to debug a website I was building:
error_reporting = E_ALL
display_errors = On

The former line causes PHP to report all of it's errors and warnings.
The latter one causes the PHP messages being displayed in the HTML
stream that is being sent from the server. With regular webpages, this
is not a problem, because in the worst case you would only see some
cryptic messages on your page. However, when querying the server in
the Ajax calls, apparently there is also some warning inserted in the
response, on which the client app subsequently chokes. The only
strange thing is that I don't see the offending warning back in my
logs consequently.

After I set the display_errors option to off again, I could restore
the MySQL tables from a backup and access my passwords again.

With hindsight, it was quite a stupid mistake of me, but hey,
hindsight is always 20/20.

Thanks for all of your help,
Pieter
> ...
>
> read more »

Giulio Cesare Solaroli

unread,
Aug 31, 2008, 9:06:19 AM8/31/08
to p.ed...@gmail.com, Clipperz
Pieter,

thank you very much for the very clear recap of the problem.

Is there anyone knowledgeable about PHP willing to fix the application
in order to be able to handle this kind of "miss configurations" more
gracefully?

Regards,

Giulio Cesare
Reply all
Reply to author
Forward
0 new messages