PHP Warning in 5.3.1

Yep, same here

Hi,

Thanks for reporting this.

@WebEndev – Can you please share the complete error as well?

The developer is looking into this. If you’d like to temporarily suppress the error, and feel comfortable editing the file you can place an ” @ ” in class-itsec-logger.php on line 34 in front of the file_put_contents.

https://screencast.com/t/BdHdnGLT

I’ll report back here as soon as I know more.

Thanks,

Gerroald

@falk Wussow & @WebEndev

Is there also not a .htaccess file in the logs (and backups) folder(s) ?

Note all (3) commands for the .htaccess file creation are already preceeded by a @.
So if a .htaccess file does not exist in these folders its creation is also failing but you are not getting any warning because the fopen\fwrite\fclose commands are all already preceeded by a @.

dwinden

@gerroald

Here is the message:

<b>Warning</b>: Cannot modify header information - headers already sent by (output started at /home/******/public_html/wp-content/plugins/better-wp-security/core/class-itsec-logger.php:34) in <b>/home/*******/public_html/wp-includes/pluggable.php</b> on line <b>1228</b><br />

I am also getting Sucuri security warning messages as a result of the above. I had to disable Ithemes Security on the site to remove the Sucuri issues.

Thanks.

@dwinden

Yes, there is an .htaccess file in both /logs and /backups. The contents of both are ‘Deny from all’.

Thanks.

@falk Wussow & @WebEndev & @gerroald

The reason why this warning is happening is because the @mkdir() command positioned 2 lines earlier is also failing…
Unfortunately because of the @ we have never been notified of this.

The @mkdir() command is failing because it tries to create a …/ithemes-security/logs subfolder while the parent ithemes-security folder does not yet exist.

Change your code to look like this and the issue will be fixed:

//Make sure the ithemes-security directory and logs subdirectory are created
if ( ! is_dir( $itsec_globals['ithemes_log_dir'] ) ) {
	@mkdir( $itsec_globals['ithemes_dir'] );  // <- Add this new line
	@mkdir( $itsec_globals['ithemes_log_dir'] );
	// Make sure we have an index file to block directory listing
	file_put_contents( path_join( $itsec_globals['ithemes_log_dir'], 'index.php' ), "<?php\n// Silence is golden." );
}

dwinden

@dwinden Works. Even after deleting the folders, they are recreated seconds later. ??

@dwinden

Thanks much for this. I will try it.

I also assume that iThemes will release a patch ??

@WebEndev

I made a quick and dirty fix to illustrate what is wrong and to demonstrate how to fix it. However this code needs some more work.

The original piece of code never worked. The fix makes it work but also revealed a new bug …
For instance with my fix applied there is no .htaccess file created in the logs folder…

I’m sure in the near future iThemes will release an update that will include a more comprehensive fix.

One other thing to consider is the content of the .htaccess file.
‘Deny from all’ is Apache 2.2.x syntax only.
Would make sense to add Apache 2.4.x syntax as well.
‘Require all denied’

Another thing is why is the ITSEC_Logger class so worried about the logs subfolder ? It should only worry about it when the Log Type setting is set to File Only or Both …
Most people use the default, Database Only …
So who cares whether the logs subfolder exists or not ?

dwinden

Hi,

My apologies for the trouble here. A fix is in the works, and should be out later today.

The code no longer generates a .htaccess file as the index.php is more reliable, and does not run into syntax issues.

I’ll update you here as soon as I know more.

Thanks,

Gerroald

@gerroald

No problem. I do feel I need to make one correction.

iTSec 5.3.1 (without my fix) does create .htaccess files in all three (ithemes-security, backups and logs) folders.

I guess the 3 fopen/fwrite/fclose groups of commands that create the .htaccess file(s) should be removed from the activate_execute() function in the class-itsec-setup.php file…

dwinden

Just installed 5.3.1 and got same error but I also cannot access the Media Library – don’t know if this is related or not. Is it possible to download and install the previous version (maybe as 5.3.2) until a fix is available?

Update: Deactivating iTSec allows me to access the media library.

Hey All,

Can you please update to version 5.3.2 and let me know if it resolves this for you?

@dwinden – Apologies. The .htaccess is being created. But the index.php is also being created and is more reliable.

Thanks!

Gerroald

I would if I could But I am locked out of the WordPress login.