CRITICAL Uncaught TypeError in Crypto.php(148)

  • 2021-04-10T19:31:30+00:00 CRITICAL Uncaught TypeError: Key expected for argument 2. String given instead. in /usr/local/var/www/wordpress/wp-content/plugins/license-manager-for-woocommerce/vendor/defuse/php-encryption/src/Crypto.php:103
    Stack trace:
    #0 /usr/local/var/www/wordpress/wp-content/plugins/license-manager-for-woocommerce/includes/Crypto.php(148): Defuse\Crypto\Crypto::decrypt(‘def502004cd9fe2…’, ”)
    #1 /usr/local/var/www/wordpress/wp-includes/class-wp-hook.php(292): LicenseManagerForWooCommerce\Crypto->decrypt(‘def502004cd9fe2…’)
    #2 /usr/local/var/www/wordpress/wp-includes/plugin.php(212): WP_Hook->apply_filters(‘def502004cd9fe2…’, Array)
    #3 /usr/local/var/www/wordpress/wp-content/plugins/license-manager-for-woocommerce/includes/models/resources/License.php(207): apply_filters(‘lmfwc_decrypt’, ‘def502004cd9fe2…’)
    #4 /usr/local/var/www/wordpress/wp-content/plugins/license-manager-for-woocommerce/includes/controllers/License.php(340): LicenseManagerForWooCommerce\Models\Resources\License->getDecryptedLicenseKey()
    #5 /usr/local/ in /usr/local/var/www/wordpress/wp-content/plugins/license-manager-for-woocommerce/vendor/defuse/php-encryption/src/Crypto.php on line 103

Viewing 8 replies - 1 through 8 (of 8 total)
  • Thread Starter oneteamsoftware

    (@oneteamsoftware)

    Are you planing to fix critical issues? Your plugin is not usable as it is right now.

    I can confirm this issue on one of my client’s websites, after having updated to WooCommerce 5.3.0.

    Thread Starter oneteamsoftware

    (@oneteamsoftware)

    Yesterday I’ve tried to uninstall and then re-install the plugin and issue is gone as well as all the license keys ?? which is kind of shocking.

    Hello @oneteamsoftware and @mezzomedia

    I will need some more information on how this happened, it sounds to me like you’ve deleted the cryptographic secrets:

    https://www.licensemanager.at/docs/handbook/setup/cryptographic-secrets

    These files are used to encrypt and decrypt the license keys, if they’re gone then all the encrypted license keys in your database can never be decrypted again. Have you maybe moved these files around? Do you have a backup?

    Thread Starter oneteamsoftware

    (@oneteamsoftware)

    Nothing has been moved, it has happened after plugin update.
    What can wipe the keys? How are they stored and why would they be deleted on plugin update?

    @oneteamsoftware

    Well, the keys are stored in the wp-content/uploads/lmfwc-files folder, perhaps a manual cleanup or a file/database migration?

    If that’s not the case, then I really don’t know. If you have a staging environment I would be willing to take a look myself.

    Thread Starter oneteamsoftware

    (@oneteamsoftware)

    It has happened in local dev environment after mass plugins update.

    The sequence of events is about like that:
    – Cloned production to local maybe around 1 year ago (everything was fine, all licenses worked)
    – Updated various plugins from time to time (all good)
    – Then on a version change of lmfwc we have decided to verify that everything will continue to work and updated all the plugins including lmfwc

    At this point it stopped working.

    I’m wondering if plugin might be trying to look for the key and if it does not see one then it will regenerate it or anything else might conditionally change these files?

    At the point of my comment (from 3 weeks ago), I have tried to uninstall plugin and reinstall it which lead to all the licenses to completely disappear. But new ones are working fine.

    So the main concern points for me are:
    1. Possible vulnerability of the way how secret keys are stored
    2. Database of licenses might be wiped out on uninstall / re-install

    In relation to (1) can secret keys be store with update_option instead ?

    @oneteamsoftware

    Did you upgrade from a very old version (1.x)? If so, then that might be the issue. The old 1.x version had the cryptographic secrets stored in the plugin folder, which was a major mistake. The plugin folder gets deleted on every plugin update, and this might have happened to you.

    The new versions store the files in the wp-content/uploads/lmfwc-files folder, which is not touched when any plugin is updated.

    I would highly recommend storing the crpytographic secret and key in a constant inside the wp-config.php. This is described on the website, here’s the link:

    https://www.licensemanager.at/docs/handbook/setup/security

    Let me know if you need further help.

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘CRITICAL Uncaught TypeError in Crypto.php(148)’ is closed to new replies.

Tags