6

What should I do about the following message in my CiviCRM status page, after upgrading to CiviCRM 5.3.0, PHP 7.2 from 5.6, and also upgrading my OS from Debian 8 to Debian 9:

PHP Missing Extension "mcrypt". Your PHP does not include the recommended encryption functions. Some passwords will not be stored encrypted, and if you have recently upgraded from a PHP that does include these functions, your encrypted passwords will not be decrypted correctly. If you are using PHP 7.0 or earlier, you probably want to include the "mcrypt" extension.

Rather than downgrade to PHP 7.0, how do I know if I need this extension, if I was using it before, and what I can do to make sure I'm taken care of with regard to encryption? If I am on PHP 7.2, can I just ignore this message? Can I use something else since it was deprecated in 7.1 and removed in 7.2?

Upon trying to install it with the PECL library, I get:

php-mcrypt : Depends: php7.2-mcrypt but it is not installable E: Unable to correct problems, you have held broken packages.

What is throwing me off is that part that says,

"If you are using PHP 7.0 or earlier"

And if I'm not on PHP 7.0 or earlier, what should I do, install it anyway? Thanks!

Improve this question

3 Answers 3

Reset to default
4

After further investigation I'm extending my answer and splitting it in two. First addressing the mcrypt and php 7.2 issue and then the drupal/civicrm and php 7.2 compatibility.

Php 7.2 and mcrypt

As stated above, and citing the link with the install instructions for mcrypt:

Because of the end of the mcrypt extension’s development, the extention was also removed from PHP 7.2 and moved to an unofficial PECL repository. However, you can still find the mcrypt extention in PHP 5.4 through PHP 7.1. The arrival of PHP 7.2 has been announced but it won’t contain mcrypt extention. For PHP 7.2+, PHP instead uses libsodium as a cryptography library.

There is a reason why mcrypt was removed from php 7.2, installing it on your own is not a good idea.

If libmcrypt were still being maintained, we could work with the libmcrypt team to improve it. Unfortunately, it was abandoned in 2007, and contains unfixed bugs and patches that will never be merged.

Also, libsodium was used to replace mcrypt in the latest php release (7.2). In the case of Drupal, you can read the following comment in this issue, where you also have the option of using phpseclib:

For 7.x-1.x version default option changed to use PHPSecLib. So to avoid using mcrypt within larger profiles/bundles like Commerce one should add the Libraries module and download PHPSecLib into proper location. This can be easily achieved using Drupal Profiles.

So, with php 7.2 you could use libsodium, phpseclib or openssl if you care about the security of your application and take the time to implement it.

Drupal / Civicrm and php 7.2

Drupal 7 doesn't support php 7. 2 in its current 7.59 release, it will from version 7.60 onwards.

CiviCRM 5.x supports up to php 7.1

As you can see, they both support php 7.1,so I would advise you to install that version instead of 7.2 and everything should work as expected.

Improve this answer
4
  • Thank you! So it's okay to use something else and CiviCRM doesn't require it? That's what I was trying to figure out.
    – Christia
    Jul 18, 2018 at 4:43
  • 1
    No problem, some times there is no option, but usually there is an alternative, although it's time more consuming to resolve the issue. I will soon have this issue myself, so I'm looking into it. If I have a step-by-step when I do, I will post a comment about it.
    – Leo Gallego
    Jul 18, 2018 at 4:46
  • I have extended my answer. Nor Drupal 7 or Civicrm are compatible with php 7.2 for the moment. The best course is to downgrade to 7.1
    – Leo Gallego
    Jul 20, 2018 at 6:20
  • Christia there is some discussion about mcrypt here: lab.civicrm.org/dev/core/issues/236 As it stands, CiviCRM still requires it. FWIW I have been using Civi a bit on Fedora 28 with PHP 7.2 for testing. Apart from needing to install php-mcrypt there was a warning related to the PEAR DB package but easily worked around.
    – Andrew Thompson
    Jul 24, 2018 at 0:14
8

As the author of that message, let me try and clarify ...

The mcrypt extension is (only) used to encrypt selected passwords, and "selected" as far as I know usually only includes the smtp password, (which you may not even be using).

The message is there that so that if you upgrade your php version and the new one doesn't include mcrypt, you are aware that your encrypted passwd(s) won't be unencryptable, and you'll have to re-input them.

Civi doesn't encrypt all passwds, and it's not a terrible thing not to encrypt them (these aren't user passwds, btw!), so the warning is just a convenience to avoid confusion and delay.

Now that mcrypt is no longer included in php, the message should get updated.

Conclusion: I'd stay on 7.2 if it's working otherwise.

Improve this answer
2

I believe you can install php mcrypt extension for 7.2

https://lukasmestan.com/install-mcrypt-extension-in-php7-2/

https://www.techrepublic.com/article/how-to-install-mcrypt-for-php-7-2/

Install using PECL:

sudo apt-get -y install gcc make autoconf libc-dev pkg-config
sudo apt-get -y install php7.2-dev
sudo apt-get -y install libmcrypt-dev
sudo pecl install mcrypt-1.0.1

HTH

Pradeep

Improve this answer
5
  • Thanks. I was already doing the first tutorial when I ran into issues that lead me to discover that it's deprecated. The 2nd one has the same steps. I get an error that it is "uninstallable" and I hold broken packages. If it's deprecated, how do I know if I need it and can I use something else?
    – Christia
    Jul 17, 2018 at 21:50
  • 2
    Mcrypt extension is used by CiviCRM to speed up a wide variety of cryptographic operations. I think payment processor, pdf etc uses this extensions.
    – Pradeep Nayak
    Jul 17, 2018 at 22:02
  • Good to know thanks! My issue must be unrelated to deprecation then.
    – Christia
    Jul 17, 2018 at 22:04
  • 1
    Updated my answer as this suggestion doesn't solve the issue. Drupal 7 nor Civicrm 5.x are compatible with php 7.2 as of today, with or without mcrypt.
    – Leo Gallego
    Jul 20, 2018 at 6:22
  • When I try Pradeep's suggestion I get an error that the module was complied using a different API than PHP.
    – Stephen Sloan
    Mar 7, 2019 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.