HTTP ERROR 500 after login when BetterPassword plugin is enabled

[ambarishrc]

When the BetterPassword plugin is enabled, logging in to OJS immediately results in an HTTP ERROR 500. Disabling the plugin restores normal login functionality.

No related entries appear in the Apache (httpd) or PHP error logs at the time of the failure.

OJS version: 3.4.0.9
BetterPassword Plugin Version: 1.3.0.2
PHP: 8.4.10

Could you please check if this is a known compatibility issue or advise on additional debugging steps?

[wopsononock]

Thanks for the report! Any chance you can get me the text of the error message from your web server's error log?

[ambarishrc]

Here are the apache error logs

[Wed Aug 13 08:42:30.405896 2025] [systemd:notice] [pid 165961:tid 165961] AH10497: SELinux is enabled; httpd running as context system_u:system_r:httpd_t:s0

[Wed Aug 13 08:42:30.414063 2025] [mpm_event:notice] [pid 165961:tid 165961] AH00489: Apache/2.4.64 (Amazon Linux) OpenSSL/3.2.2 configured -- resuming normal operations

[Wed Aug 13 08:42:30.414087 2025] [core:notice] [pid 165961:tid 165961] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'

[Wed Aug 13 09:04:56.081912 2025] [mpm_event:notice] [pid 165961:tid 165961] AH00492: caught SIGWINCH, shutting down gracefully

[Wed Aug 13 09:04:57.224687 2025] [suexec:notice] [pid 167498:tid 167498] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

[Wed Aug 13 09:04:57.253063 2025] [lbmethod_heartbeat:notice] [pid 167498:tid 167498] AH02282: No slotmem from mod_heartmonitor

[Wed Aug 13 09:04:57.254832 2025] [systemd:notice] [pid 167498:tid 167498] AH10497: SELinux is enabled; httpd running as context system_u:system_r:httpd_t:s0

[Wed Aug 13 09:04:57.261102 2025] [mpm_event:notice] [pid 167498:tid 167498] AH00489: Apache/2.4.64 (Amazon Linux) OpenSSL/3.2.2 configured -- resuming normal operations

[Wed Aug 13 09:04:57.261122 2025] [core:notice] [pid 167498:tid 167498] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'

[Wed Aug 13 10:57:57.393299 2025] [mpm_event:notice] [pid 167498:tid 167498] AH00492: caught SIGWINCH, shutting down gracefully

[Wed Aug 13 10:57:58.566094 2025] [suexec:notice] [pid 174919:tid 174919] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

[Wed Aug 13 10:57:58.594139 2025] [lbmethod_heartbeat:notice] [pid 174919:tid 174919] AH02282: No slotmem from mod_heartmonitor

[Wed Aug 13 10:57:58.595924 2025] [systemd:notice] [pid 174919:tid 174919] AH10497: SELinux is enabled; httpd running as context system_u:system_r:httpd_t:s0

[Wed Aug 13 10:57:58.603221 2025] [mpm_event:notice] [pid 174919:tid 174919] AH00489: Apache/2.4.64 (Amazon Linux) OpenSSL/3.2.2 configured -- resuming normal operations

[Wed Aug 13 10:57:58.603241 2025] [core:notice] [pid 174919:tid 174919] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'

[Wed Aug 13 11:28:04.111044 2025] [mpm_event:notice] [pid 174919:tid 174919] AH00492: caught SIGWINCH, shutting down gracefully

[Wed Aug 13 11:28:05.286143 2025] [suexec:notice] [pid 176946:tid 176946] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)

[Wed Aug 13 11:28:05.313638 2025] [lbmethod_heartbeat:notice] [pid 176946:tid 176946] AH02282: No slotmem from mod_heartmonitor

[Wed Aug 13 11:28:05.315409 2025] [systemd:notice] [pid 176946:tid 176946] AH10497: SELinux is enabled; httpd running as context system_u:system_r:httpd_t:s0

[Wed Aug 13 11:28:05.321022 2025] [mpm_event:notice] [pid 176946:tid 176946] AH00489: Apache/2.4.64 (Amazon Linux) OpenSSL/3.2.2 configured -- resuming normal operations

[ctgraham]

@ambarishrc , there aren't any PHP messages in this log, so you may find a dedicated log for PHP errors (e.g. via php-fpm, or via the php error_log directive). If you have a development server, you can also output the error directly to the user with the config.inc.php directives:

display_errors = On
show_stack_trace = On

[wopsononock]

I was not able to reproduce this behavior running similar versions. OJS 3.4.0.3 with PHP 8.4.11. As ctgraham mentioned, the text of the (fatal) PHP error would be most helpful.

[ambarishrc]

After disabling the Password Invalidation section from settings, the BetterPassword plugin is now working correctly, but only on the registration page. It is still not validating or filtering passwords on the reset password page.
We also didn't find anything in the PHP error logs.

[etouceda]

The problem is the table stored_passwords is empty and when activate plugin with invalidation passwords options go to

$storedPasswordsDao = DAORegistry::getDAO('StoredPasswordsDAO');
if ($user) {
$storedPasswords = $storedPasswordsDao->getByUserId($user->getId());
if ($storedPasswords) {
$storedPasswords->setChangeTime(new \DateTime('now'));
$storedPasswordsDao->update($storedPasswords);
} else {
$storedPasswords = $storedPasswordsDao->newDataObject();
$storedPasswords->setUserId($user->getId());
$storedPasswords->setChangeTime(now());
var_dump('cuatro');
die();
$storedPasswordsDao->insert($storedPasswords);

And 1364 Field 'password' doesn't have a default value in my case

[wopsononock]

I was able to replicate the problem by setting a value for force expiration, while leaving limit reuse unset and attempting to change my password. I made the password hash field in the stored_passwords table nullable, which allowed me to complete my password change. I've released version 1.3.1-0 with these changes.