Answers.Body: <p>As the author of that message, let me try and clarify ...</p>
  
  <p>The mcrypt extension is (only) used to encrypt selected passwords, and "selected" as far as I know usually only includes the smtp password, (which you may not even be using).</p>
  
  <p>The message is there that so that if you upgrade your php version and the new one doesn't include mcrypt, you are aware that your encrypted passwd(s) won't be unencryptable, and you'll have to re-input them. </p>
  
  <p>Civi doesn't encrypt all passwds, and it's not a terrible thing not to encrypt them (these aren't user passwds, btw!), so the warning is just a convenience to avoid confusion and delay.</p>
  
  <p>Now that mcrypt is no longer included in php, the message should get updated.</p>
  
  <p>Conclusion: I'd stay on 7.2 if it's working otherwise.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-24T18:57:00.283Z
Answers.LastActivityDate: 2018-07-25T21:17:41.017Z
Answers.LastEditDate: 2018-07-25T21:17:41.017Z
Answers.UserDisplayName: Alan Dixon
Answers.Body: <p>I believe you can install php mcrypt extension for 7.2 </p>
  
  <p><a href="https://lukasmestan.com/install-mcrypt-extension-in-php7-2/" rel="nofollow noreferrer">https://lukasmestan.com/install-mcrypt-extension-in-php7-2/</a></p>
  
  <p><a href="https://www.techrepublic.com/article/how-to-install-mcrypt-for-php-7-2/" rel="nofollow noreferrer">https://www.techrepublic.com/article/how-to-install-mcrypt-for-php-7-2/</a></p>
  
  <p>Install using PECL:</p>
  
  <pre><code>sudo apt-get -y install gcc make autoconf libc-dev pkg-config
  sudo apt-get -y install php7.2-dev
  sudo apt-get -y install libmcrypt-dev
  sudo pecl install mcrypt-1.0.1
  </code></pre>
  
  <p>HTH</p>
  
  <p>Pradeep</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-17T21:50:59.970Z
Answers.Text: Thanks. I was already doing the first tutorial when I ran into issues that lead me to discover that it's deprecated. The 2nd one has the same steps. I get an error that it is "uninstallable" and I hold broken packages. If it's deprecated, how do I know if I need it and can I use something else?
Answers.UserDisplayName: Christia
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-17T22:02:40.347Z
Answers.Text: Mcrypt extension is used by CiviCRM  to speed up a wide variety of cryptographic operations. I think payment processor, pdf etc uses this extensions.
Answers.UserDisplayName: Pradeep Nayak
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-17T22:04:11.233Z
Answers.Text: Good to know thanks! My issue must be unrelated to deprecation then.
Answers.UserDisplayName: Christia
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-20T06:22:38.860Z
Answers.Text: Updated my answer as this suggestion doesn't solve the issue. Drupal 7 nor Civicrm 5.x are compatible with php 7.2 as of today, with or without mcrypt.
Answers.UserDisplayName: Leo Gallego
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-03-07T15:36:23.163Z
Answers.Text: When I try Pradeep's suggestion I get an error that the module was complied using a different API than PHP.
Answers.UserDisplayName: Stephen Sloan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-17T21:49:15.323Z
Answers.LastActivityDate: 2018-07-17T22:09:36.673Z
Answers.LastEditDate: 2018-07-17T22:09:36.673Z
Answers.UserDisplayName: Pradeep Nayak
Answers.Body: <p>After further investigation I'm extending my answer and splitting it in two. First addressing the mcrypt and php 7.2 issue and then the drupal/civicrm and php 7.2 compatibility. </p>
  
  <h2>Php 7.2 and mcrypt</h2>
  
  <p>As stated above, and citing the <a href="https://lukasmestan.com/install-mcrypt-extension-in-php7-2/" rel="nofollow noreferrer">link with the install instructions for mcrypt</a>:</p>
  
  <blockquote>
    <p>Because of the end of the mcrypt extension’s development, the
    extention was also removed from PHP 7.2 and moved to an unofficial
    PECL repository. However, you can still find the mcrypt extention in
    PHP 5.4 through PHP 7.1. The arrival of PHP 7.2 has been announced but
    it won’t contain mcrypt extention. For PHP 7.2+, PHP instead uses
    libsodium as a cryptography library.</p>
  </blockquote>
  
  <p>There is <a href="https://wiki.php.net/rfc/mcrypt-viking-funeral" rel="nofollow noreferrer">a reason why mcrypt was removed</a> from php 7.2, installing it on your own is not a good idea.</p>
  
  <blockquote>
    <p>If libmcrypt were still being maintained, we could work with the
    libmcrypt team to improve it. Unfortunately, it was abandoned in 2007,
    and contains unfixed bugs and patches that will never be merged.</p>
  </blockquote>
  
  <p>Also, <strong><em>libsodium</em></strong> was used to replace <strong><em>mcrypt</em></strong> in the latest php release (7.2). In the case of Drupal, you can read the following comment <a href="https://www.drupal.org/project/aes/issues/2572241" rel="nofollow noreferrer">in this issue</a>, where you also have the option of using <strong><em>phpseclib</em></strong>:</p>
  
  <blockquote>
    <p>For 7.x-1.x version default option changed to use PHPSecLib. So to
    avoid using mcrypt within larger profiles/bundles like Commerce one
    should add the Libraries module and download PHPSecLib into proper
    location. This can be easily achieved using Drupal Profiles.</p>
  </blockquote>
  
  <p>So, with php 7.2 you could use libsodium, phpseclib or openssl if you care about the security of your application and take the time to implement it.</p>
  
  <h2>Drupal / Civicrm and php 7.2</h2>
  
  <p><a href="https://www.drupal.org/project/drupal/issues/2947772" rel="nofollow noreferrer">Drupal 7 doesn't support php 7. 2 in its current 7.59 release, it will from version 7.60 onwards</a>.</p>
  
  <p><a href="https://docs.civicrm.org/sysadmin/en/latest/requirements/" rel="nofollow noreferrer">CiviCRM 5.x supports up to php 7.1</a></p>
  
  <p>As you can see, they both support php 7.1,so I would advise you to install that version instead of 7.2 and everything should work as expected. </p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-18T04:43:09.663Z
Answers.Text: Thank you! So it's okay to use something else and CiviCRM doesn't require it? That's what I was trying to figure out.
Answers.UserDisplayName: Christia
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-18T04:46:40.147Z
Answers.Text: No problem, some times there is no option, but usually there is an alternative, although it's time more consuming to resolve the issue. I will soon have this issue myself, so I'm looking into it. If I have a step-by-step when I do, I will post a comment about it.
Answers.UserDisplayName: Leo Gallego
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-20T06:20:57.243Z
Answers.Text: I have extended my answer. Nor Drupal 7 or Civicrm are compatible with php 7.2 for the moment. The best course is to downgrade to 7.1
Answers.UserDisplayName: Leo Gallego
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-24T00:14:07.103Z
Answers.Text: Christia there is some discussion about mcrypt here: https://lab.civicrm.org/dev/core/issues/236 As it stands, CiviCRM still requires it. FWIW I have been using Civi a bit on Fedora 28 with PHP 7.2 for testing. Apart from needing to install php-mcrypt there was a warning related to the PEAR DB package but easily worked around.
Answers.UserDisplayName: Andrew Thompson
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-07-18T04:41:43.123Z
Answers.LastActivityDate: 2018-07-20T06:19:55.203Z
Answers.LastEditDate: 2018-07-20T06:19:55.203Z
Answers.UserDisplayName: Leo Gallego
Body: <p>What should I do about the following message in my CiviCRM status page, after upgrading to CiviCRM 5.3.0, PHP 7.2 from 5.6, and also upgrading my OS from Debian 8 to Debian 9:</p>
  
  <blockquote>
    <p>PHP Missing Extension "mcrypt". Your PHP does not include the
    recommended encryption functions. Some passwords will not be stored
    encrypted, and if you have recently upgraded from a PHP that does
    include these functions, your encrypted passwords will not be
    decrypted correctly. If you are using PHP 7.0 or earlier, you probably
    want to include the "mcrypt" extension.</p>
  </blockquote>
  
  <p>Rather than downgrade to PHP 7.0, how do I know if I need this extension, if I was using it before, and what I can do to make sure I'm taken care of with regard to encryption? If I am on PHP 7.2, can I just ignore this message? Can I use something else since it was deprecated in 7.1 and removed in 7.2?</p>
  
  <p>Upon trying to install it with the PECL library, I get:</p>
  
  <blockquote>
    <p>php-mcrypt : Depends: php7.2-mcrypt but it is not installable
    E: Unable to correct problems, you have held broken packages.</p>
  </blockquote>
  
  <p>What is throwing me off is that part that says, </p>
  
  <blockquote>
    <p>"If you are using PHP 7.0 or earlier"</p>
  </blockquote>
  
  <p>And if I'm not on PHP 7.0 or earlier, what should I do, install it anyway? Thanks!</p>
  
Tags: <drupal><php>
Title: What to do with "mcrypt" message after upgrading to PHP 7.2
ThreadText: # What to do with "mcrypt" message after upgrading to PHP 7.2
  
  (Asked by: username_0 on 2018-07-17)
  
  What should I do about the following message in my CiviCRM status page, after upgrading to CiviCRM 5.3.0, PHP 7.2 from 5.6, and also upgrading my OS from Debian 8 to Debian 9:
  
  > PHP Missing Extension "mcrypt". Your PHP does not include the
  > recommended encryption functions. Some passwords will not be stored
  > encrypted, and if you have recently upgraded from a PHP that does
  > include these functions, your encrypted passwords will not be
  > decrypted correctly. If you are using PHP 7.0 or earlier, you probably
  > want to include the "mcrypt" extension.
  
  Rather than downgrade to PHP 7.0, how do I know if I need this extension, if I was using it before, and what I can do to make sure I'm taken care of with regard to encryption? If I am on PHP 7.2, can I just ignore this message? Can I use something else since it was deprecated in 7.1 and removed in 7.2?
  
  Upon trying to install it with the PECL library, I get:
  
  > php-mcrypt : Depends: php7.2-mcrypt but it is not installable
  > E: Unable to correct problems, you have held broken packages.
  
  What is throwing me off is that part that says,
  
  > "If you are using PHP 7.0 or earlier"
  
  And if I'm not on PHP 7.0 or earlier, what should I do, install it anyway? Thanks!
  
  **Tags:** drupal, php
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_3 on 2018-07-18. Score: 4 | Accepted answer
  
  After further investigation I'm extending my answer and splitting it in two. First addressing the mcrypt and php 7.2 issue and then the drupal/civicrm and php 7.2 compatibility.
  
  ## Php 7.2 and mcrypt
  
  As stated above, and citing the [link with the install instructions for mcrypt](https://lukasmestan.com/install-mcrypt-extension-in-php7-2/):
  
  > Because of the end of the mcrypt extension’s development, the
  > extention was also removed from PHP 7.2 and moved to an unofficial
  > PECL repository. However, you can still find the mcrypt extention in
  > PHP 5.4 through PHP 7.1. The arrival of PHP 7.2 has been announced but
  > it won’t contain mcrypt extention. For PHP 7.2+, PHP instead uses
  > libsodium as a cryptography library.
  
  There is [a reason why mcrypt was removed](https://wiki.php.net/rfc/mcrypt-viking-funeral) from php 7.2, installing it on your own is not a good idea.
  
  > If libmcrypt were still being maintained, we could work with the
  > libmcrypt team to improve it. Unfortunately, it was abandoned in 2007,
  > and contains unfixed bugs and patches that will never be merged.
  
  Also, ***libsodium*** was used to replace ***mcrypt*** in the latest php release (7.2). In the case of Drupal, you can read the following comment [in this issue](https://www.drupal.org/project/aes/issues/2572241), where you also have the option of using ***phpseclib***:
  
  > For 7.x-1.x version default option changed to use PHPSecLib. So to
  > avoid using mcrypt within larger profiles/bundles like Commerce one
  > should add the Libraries module and download PHPSecLib into proper
  > location. This can be easily achieved using Drupal Profiles.
  
  So, with php 7.2 you could use libsodium, phpseclib or openssl if you care about the security of your application and take the time to implement it.
  
  ## Drupal / Civicrm and php 7.2
  
  [Drupal 7 doesn't support php 7. 2 in its current 7.59 release, it will from version 7.60 onwards](https://www.drupal.org/project/drupal/issues/2947772).
  
  [CiviCRM 5.x supports up to php 7.1](https://docs.civicrm.org/sysadmin/en/latest/requirements/)
  
  As you can see, they both support php 7.1,so I would advise you to install that version instead of 7.2 and everything should work as expected.
  
  > **Comments:**
  > **username_0**: Thank you! So it's okay to use something else and CiviCRM doesn't require it? That's what I was trying to figure out.  
  > **username_3**: No problem, some times there is no option, but usually there is an alternative, although it's time more consuming to resolve the issue. I will soon have this issue myself, so I'm looking into it. If I have a step-by-step when I do, I will post a comment about it.  
  > **username_3**: I have extended my answer. Nor Drupal 7 or Civicrm are compatible with php 7.2 for the moment. The best course is to downgrade to 7.1  
  > **username_5**: username_0 there is some discussion about mcrypt here: https://lab.civicrm.org/dev/core/issues/236 As it stands, CiviCRM still requires it. FWIW I have been using Civi a bit on Fedora 28 with PHP 7.2 for testing. Apart from needing to install php-mcrypt there was a warning related to the PEAR DB package but easily worked around.  
  
  ---
  
  ### Answer by username_1 on 2018-07-24. Score: 8
  
  As the author of that message, let me try and clarify ...
  
  The mcrypt extension is (only) used to encrypt selected passwords, and "selected" as far as I know usually only includes the smtp password, (which you may not even be using).
  
  The message is there that so that if you upgrade your php version and the new one doesn't include mcrypt, you are aware that your encrypted passwd(s) won't be unencryptable, and you'll have to re-input them.
  
  Civi doesn't encrypt all passwds, and it's not a terrible thing not to encrypt them (these aren't user passwds, btw!), so the warning is just a convenience to avoid confusion and delay.
  
  Now that mcrypt is no longer included in php, the message should get updated.
  
  Conclusion: I'd stay on 7.2 if it's working otherwise.
  
  
  ---
  
  ### Answer by username_2 on 2018-07-17. Score: 1
  
  I believe you can install php mcrypt extension for 7.2
  
  <https://lukasmestan.com/install-mcrypt-extension-in-php7-2/>
  
  <https://www.techrepublic.com/article/how-to-install-mcrypt-for-php-7-2/>
  
  Install using PECL:
  
  ```
  sudo apt-get -y install gcc make autoconf libc-dev pkg-config
  sudo apt-get -y install php7.2-dev
  sudo apt-get -y install libmcrypt-dev
  sudo pecl install mcrypt-1.0.1
  
  ```
  
  HTH
  
  username_2
  
  > **Comments:**
  > **username_0**: Thanks. I was already doing the first tutorial when I ran into issues that lead me to discover that it's deprecated. The 2nd one has the same steps. I get an error that it is "uninstallable" and I hold broken packages. If it's deprecated, how do I know if I need it and can I use something else?  
  > **username_2**: Mcrypt extension is used by CiviCRM  to speed up a wide variety of cryptographic operations. I think payment processor, pdf etc uses this extensions.  
  > **username_0**: Good to know thanks! My issue must be unrelated to deprecation then.  
  > **username_3**: Updated my answer as this suggestion doesn't solve the issue. Drupal 7 nor Civicrm 5.x are compatible with php 7.2 as of today, with or without mcrypt.  
  > **username_4**: When I try username_2's suggestion I get an error that the module was complied using a different API than PHP.  
  
  ---
  
  