Noah's Classifieds - Anyone successful?

[dwa]

I've been through several installations of Noah's Classifieds via the Fantastico tools and none have worked. The installation goes just fine, no error messages or indications of problems. However, I'm unable to login with the id and password (confirmed by the setup email summary). A request for a new password yields an email with an address that does not work. Trying to set up a new account as a public user gives an error message - "The length of the form field "Password" must be maximum 32" - no matter how few characters you put in the password field.

Has anyone else been successful in setting up Noah's Classifieds? Anyone on box 84?

Does anyone have a suggestion for an alternative classified ad system?

Thanks.

Don Abrams

[wholcomb]

Oops, I should have read this before I made my post. I am glad to see that I am not the only one having this problem. It seems that there is an issue with mysql's password() function. It will write the password encrypted but does not unencrypt it correctly. I had the same problem with a login system I have and now I am seeing the same behavior with Noah's classified. I think Bluehost has some investigating to do.

[wholcomb]

I think I found the solution to this.

From http://classifieds.phpoutsourcing.com/faq.php

Q: The user authentication doesn't work. I can't log in, can't register. I am running MySql 4.x. What is wrong?

A: There are more than one solutions for the problem. The two which may be the fastest ways:

* If you own the server yourselves (or at least have a helpful server support), you can restart the MySql daemon with the --old-passwords option, or alternatively put this setting in the MySql startup file. This will force MySql to treat the passwords as in the older versions.
* If the above is not possible, you can try to 'patch' one of the Php files: open 'gorum/dbproperty.php' in a text editor and go to the end of the file - you can find there a 'getPassword' function. There is a line in that function which looks like this:

$data = mysql_query("select password('$s')");

Rewrite this line the following way:
$data = mysql_query("select old_password('$s')");

Save the file and try to log into the program. This will help.

[alligosh]

* If you own the server yourselves (or at least have a helpful server support), you can restart the MySql daemon with the --old-passwords option, or alternatively put this setting in the MySql startup file. This will force MySql to treat the passwords as in the older versions.


We run the mysql servers with old_passwords.

The issue is if the application uses the mysql PASSWORD() function, but expects the OLD_PASSWORD() style of passwords, you will have an issue. Basically, the old version of mysql used 16 charager hash passwords, whule the new version uses a 40 character hash.

Setting --old-passwords will only allow the programs to use the OLD_PASSWORD() function, it will not magically make the new and old be the same. If they use the new PASWORD() function, they will still get the new style hash.

see:

http://dev.mysql.com/doc/refman/4.1/en/application-password-use.html

and

http://dev.mysql.com/doc/refman/4.1/en/password-hashing.html

[wholcomb]

So, to be able to log into Noah's Classified we should ...?

[jacauc]

I'm interested too.... just posted another topic about Noah being removed from Fantastico.

Anything we can do here?

Thanks
jacauc

[wholcomb]

Just wondering if this is part of the problem. If the new password function creates a 40 character hash then that won't fit in the 32 characters allotted in the database. I was going to test this by increasing the size for that value in the database but it seems that there is another problem because I can't create a new user. I keep getting an error saying the maximum length of the password is 32 characters. I was getting this error before I modified the database too.

[alligosh]

I will have one of my guys investigate noah's classified and see if the fantastico version works, or if it will have to be a manual install for customers to get working (fantastico is a third party software package, and sometimes they take a while to get up to date on versions of less used software; if they older versions break, we notify them and disable the package untill it works again)

Please remember that everything in fantastico is free software. We will support it as best as we can, but bugs, old code, etc, is still the demesne of the writers/owners.

[JoeP]

Are you aware of Noah's security issues and complete lack of further development and support? I had assumed that was the reason for its removal from fantastico.
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-0882
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-0881
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-0880
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-0879
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-0878
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2005-2980

I was going to use this script until I found these issues and was told by the developer that they do not intend to work on this product. I was also told:
The problem is that we didn't develop Noah in an "open source"-manner (actually it started as a paid project) - this means it is fairly complicated, poorly commented (and mostly in Hungarian) and the code is extremely difficult to understand. It simply wasn't written with the intention in mind to encourage other programmers to rewrite/further develop/change it.


I'm looking elsewhere!
joe

[alligosh]

It seems that noah's classified are not yet depricated from the setups from fantastico the company, but there is a definate issue with the version on mysql 4.1 and short of us rewriting part of their code, it won't work as fantastico would install it.

Also, in light of the previous post about the author not supporting it or fixing it, as wellas security holes, I really don't see it getting re-enabled in fantastico. If it installs in such a way as (1) it will never work out-of-the-box, (2) has security issues, and (3) will not be fixed, ever, then it falls in the category of "way too many headaches for our customers and our support staff".

[rick]

The fix that was posted earlier in the thread does correct the login problem:

$data = mysql_query("select password('$s')");

Rewrite this line the following way:
$data = mysql_query("select old_password('$s')");


Since the fantastico version does not work currently with the default installation, we will not enable it. If there is an update from fantastico it will we re-enabled, but not until then.

[thread_PHP]

http://www.ferienwohnungen81.de

[thread_PHP]

http://www.armchairaccess.com/index.php?option=com_noah&Itemid=52

[Danny]

The fix that was posted earlier in the thread does correct the login problem:

$data = mysql_query("select password('$s')");

Rewrite this line the following way:
$data = mysql_query("select old_password('$s')");


I recently played with the installation with Noah Classified using the Fantastico installation. This is what I did to finally get it to work.

Install Noah Classified using Fantastico

After install go back and edit the the folder/file gorum/dbproperty.php and find a the bottom of the script the code below:

$data = mysql_query("select password('$s')");
Rewrite this line the following way:
$data = mysql_query("select old_password('$s')");

This fix will allow new users to register and log in.

Once completed the above instruction to log in at the admin I had to tell the system to send me a password at the login script. A email will be sent to the email address that you gave on installation. The key is to follow the link provided in the email and use the password that the system gives you to log in. Once you long in you can change your password to what ever you want. Remember you must follow the link in the email to login in the administrator.

I hope this helps and not confuss, but so far it works.

[goodthinkingbatman]

If anyone is still looking for good classified ad software check:

http://www.geodesicsolutions.com