Bug, invalid path in freemius causes PHP Warnings

  • Getting lots of these warnings in debug.log when in backend:

    [04-Feb-2024 22:28:09 UTC] PHP Deprecated:  strpos(): Passing null to parameter #1 ($haystack) of type string is deprecated in ../wp-includes/functions.php on line 7247
[04-Feb-2024 22:28:09 UTC] PHP Deprecated:  str_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated in ../wp-includes/functions.php on line 2187

    Reason is invalid path passed to realpath() in freemius/start.php in line 60 which causes false to be passed on to wp_normalize_path()/ wp_is_stream() in WordPress core where a string is expected and which triggers the above warnings.

    Current freemius code:

    $themes_directory         = get_theme_root( get_stylesheet() );
$themes_directory_name    = basename( $themes_directory );
$theme_candidate_basename = basename( dirname( $fs_root_path ) ) . '/' . basename( $fs_root_path );

if ( $file_path == fs_normalize_path( realpath( trailingslashit( $themes_directory ) . $theme_candidate_basename . '/' . basename( $file_path ) ) )
	) {

    It creates an invalid path (to themes folder!) similar to this:

    /homepages/28/d[...]/htdocs/wp-content/themes/password-protected/freemius/start.php

    Result of realpath() should be checked before normalizing it further.

    Debug backtrace:

    #0 ../wp-includes/functions.php(2180): wp_is_stream(false)
#1 ../wp-content/plugins/password-protected/freemius/includes/fs-essential-functions.php(27): wp_normalize_path(false)
#2 ../wp-content/plugins/password-protected/freemius/start.php(60): fs_normalize_path(false)
#3 ../wp-content/plugins/password-protected/includes/freemius.php(21): require_once('/homepages/28/d...')
#4 ../wp-content/plugins/password-protected/includes/freemius.php(46): pp_free_fs()
#5 ../wp-content/plugins/password-protected/password-protected.php(36): require_once('/homepages/28/d...')
#6 ../wp-settings.php(473): include_once('/homepages/28/d...')
#7 ../wp-config.php(136): require_once('/homepages/28/d...')
#8 ../wp-load.php(50): require_once('/homepages/28/d...')
#9 ../wp-blog-header.php(13): require_once('/homepages/28/d...')
#10 ../index.php(17): require('/homepages/28/d...')

    Password Protected 2.6.6 with Freemius 2.5.10, WordPress 6.4.3, PHP 8.1.x

Viewing 8 replies - 1 through 8 (of 8 total)

  • Hi @ov3rfly,

    I hope you are doing good.

    Thank you for providing us with the detailed information. Let us reproduce this case on our end and will get back to you.

    Thank you for considering the plugin and supporting us.

    Thanks and regards,
    Support Team – WPExperts

    Hi @ov3rfl,

    I hope you are doing well.

    I tried to replicate your case on my end but no issue is found. Please create a ticket on our technical support channel so I can connect you directly with our technical team.

    Looking forward to getting your issue resolved.

    Thanks and regards,
    Support Team – WPExperts  

    • This reply was modified 1 year, 1 month ago by furqanfazal.
    Thread Starter Ov3rfly

    (@ov3rfly)

    Maybe you did not use PHP 8.1.x and WP_DEBUG_LOG to enable debug.log

    Thread Starter Ov3rfly

    (@ov3rfly)

    Found the reason for your replication problem.

    The PHP warning is not triggered if false is passed on to wp_normalize_path()/ wp_is_stream() in WordPress core but only if null is passed on.

    Our backtrace trap caught your Password Protected plugin when it passend on false while the PHP warning in debug.log is for null which obviously coincidentally happened at the same time from another source.

    The fremius code in your plugin is still wrong, it should check result of realpath() for not false before normalizing it further.

    Hi @ov3rfly,

    I hope you are doing good.

    I replicated your case with PHP version 8.1 and above, and WordPress version 6.4.3 with debug.log enabled but unfortunately found no issue. Could you please share the details of the theme and plugin activated on your site so I can try it with the theme and plugins you have?

    Thank you for the information you have provided so far.

    Thanks and regards,
    Support Team – WPExperts??

    Thread Starter Ov3rfly

    (@ov3rfly)

    Found the reason for your replication problem.

    The PHP warning is not triggered if false is passed on to wp_normalize_path()/ wp_is_stream() in WordPress core but only if null is passed on.

    Our backtrace trap caught your Password Protected plugin when it passend on false while the PHP warning in debug.log is for null which obviously coincidentally happened at the same time from another source.

    The fremius code in your plugin is still wrong, it should check result of realpath() for not false before normalizing it further.

    February 7, 2024 at 11:06 pm
    furqanfazal

    (@furqanfazal)

    Hi @ov3rfly,

    Your case has been transferred to our technical team and they are looking into it. If they find something they will fix it.

    Thank you for your patience and understating’s.

    Thanks and regards,
    Support Team – WPExperts??

    Thread Starter Ov3rfly

    (@ov3rfly)

    Stop marking this issue as ‘resolved’ every other day.

    Feel free to do so after a plugin update with a fix has been released.

    The issue is still there.

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Bug, invalid path in freemius causes PHP Warnings’ is closed to new replies.