When logging into https://www/slbackup-php/ (after enabling password
login for root) on DebianEdu the server returns HTTP error 500.

The following is logged in error.log:

[Tue Aug 01 14:37:40.377047 2023] [php:error] [pid 508014] [client 10.0.2.2:47888] PHP Fatal error:  Uncaught ArgumentCountError: crypt() expects exactly 2 arguments, 1 given in /usr/share/slbackup-php/web/index.php:698\nStack trace:\n#0 /usr/share/slbackup-php/web/index.php(698): crypt()\n#1 {main}\n  thrown in /usr/share/slbackup-php/web/index.php on line 698, referer: https://www/slbackup-php/index.php

There are actually two critical problems causing logins to fail:

1. usage of crypt() without a salt (not actually used for passwords
   but as a hash function for some homemade encryption, see
https://salsa.debian.org/debian-edu-pkg-team/slbackup-php/-/blob/8eb0d468422cb3e06eed0092643d1bb4082f9b1c/src/index.php#L698)
2. a typo where the key is switched with the value while looping over
   an associative array which causes an exception with PHP 8 since
   the key is a string accessed as an associative array (see
https://salsa.debian.org/debian-edu-pkg-team/slbackup-php/-/blob/8eb0d468422cb3e06eed0092643d1bb4082f9b1c/src/index.php#L48)

We believe that the bug you reported is fixed in the latest version of
slbackup-php, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1042824@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mike Gabriel <sunweaver@debian.org> (supplier of updated slbackup-php package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 10 Aug 2023 18:02:58 +0200
Source: slbackup-php
Architecture: source
Version: 0.4.5-4+deb12u1
Distribution: bookworm
Urgency: medium
Maintainer: Debian Edu Packaging Team <debian-edu-pkg-team@lists.alioth.debian.org>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Closes: 1042824
Changes:
 slbackup-php (0.4.5-4+deb12u1) bookworm; urgency=medium
 .
   [ Guido Berhörster ]
   * debian/patches:
     + Add 1007_log_remote_commands_to_stderr.patch in order to log to stderr.
     + Add 1006_disable-ssh-known-hosts.patch disabling SSH known hosts files.
     + Add 1005_fix-typo.patch fixing an exception on login. (Closes: #1042824).
     + Add 1004_fix-php-warnings.patch fixing PHP warnings.
     + Add 1003_php8-compat.patch fixing PHP 8 compatibility.
     + Fix string splitting in 1002_php7-compat.patch. Use explode() instead of
       preg_split(), the latter needs delimiters for the regex and returns false
       if there was no match which breaks the existing code.
Checksums-Sha1:
 b4de55c4b963626fffd7795ff0ce27bd594a9d3b 2075 slbackup-php_0.4.5-4+deb12u1.dsc
 14a7596cdc690e619ecd01c7ab4a8ef8ba089e88 23080 slbackup-php_0.4.5-4+deb12u1.debian.tar.xz
 de47e4f9051f47211f54cd089b8ee4bb2da98cc8 7257 slbackup-php_0.4.5-4+deb12u1_source.buildinfo
Checksums-Sha256:
 52de97c1811e75caf64c9033a4540ce706412e600d38f05c83b9e131c13ce3ec 2075 slbackup-php_0.4.5-4+deb12u1.dsc
 a517218fbf899d967dd2cb5707f762d69cbb0677413471728778286d1c99c5f4 23080 slbackup-php_0.4.5-4+deb12u1.debian.tar.xz
 674fb2718a9b74bbf9162177a57c0012519f30bcf80814c87581874804f5c690 7257 slbackup-php_0.4.5-4+deb12u1_source.buildinfo
Files:
 9c2653b9f888b6386cb66bf30ba9aaea 2075 misc optional slbackup-php_0.4.5-4+deb12u1.dsc
 a27c6bab7b1a00969a27df40e85954ef 23080 misc optional slbackup-php_0.4.5-4+deb12u1.debian.tar.xz
 7ecce6209030840797bd988b73a94ec2 7257 misc optional slbackup-php_0.4.5-4+deb12u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJJBAEBCAAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmTV2uMVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsx4BwQAINxs9G++bJOiqV7FHabPd1DSvpM
CVHeLDPFDVum0GxCUPWp+ycN77DCLhur5e8rRyrY40+ty9Nwqeox/46aNxJGFnsB
+Ctl/oAOAQUwvvBY6S06uw2viLmJPj+KrLTSGGQRBxUDXKLMKulzqH4ggHTbeVfL
UDUWyyM9bC+rxEJNA2eo/K3qlPnLH6C7GFVpL5Bn9nBQ4apbsz3DOy5IsL2+qfcQ
eEA53o56QT5UpJ3aIsCnmJjJLgMSuz9++0dLSkmtkNzZ4iKTYJdrFB7iuD/DdhbM
JK1aOXTqLRd46D2xESwcvPqfHynHUF+XoprE9cDDqoW6nlxyhEl4HkGC4hoJKNca
TBu8UYBuu7oyrYwg6RUTuNqlD6JvPfD8yhkEd8EifuxSG2d1tQNOdTi5onJm1FIW
mXKt8vZosmvs/3lPb+udMfWF4Rh6nw8e6z9wpOIyNhEhqP0ZeRJlT6UQCdm80cIW
BORw965tA/AwzfrIWcS1DC6Y0TiZJyMsAGFG/lZJgTLxYG1Gcd8bhYe2EP52kFXQ
tlT/BNjUEO2lQqr9xub+rQzFEmdasNYbaFYqSaQRD8q4rJQV1Q3GOOOs9QqEt5sO
fqBlDutJ5qZzdoHXsn7ZsEFTOhuGNR3le8GJAeu+ujfk5yHgYIxd5HbRyAAiMHo2
LD6LgY6Fz1u0ZDOQ
=rzwo
-----END PGP SIGNATURE-----