Support Forum

RSS entity function allow_url_fopen=0 wrapper is disabled because… ..

EG Edward J Gelb
Edward J Gelb
Member

I am on a shared host with Network Solutions.   Recently we have noticed that anyone accessing the forum RSS entity (Group and All) is receiving the following warning.

XML Parsing Error: junk after document element

Location: http://www.exploristforum.com/forums/rss/d8f55f73-9cc6-48a4-9aa8-e3a8a49c2185/

Line Number 2, Column 1:<b>Warning</b>:  getimagesize() [<a href=’function.getimagesize’>function.getimagesize</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in <b>/data/0/0/23/9/23824/user/24314/problem-with-post-edit-buttontdocs/exploristX10/wp-content/plugins/simple-press/sp-api/sp-api-filters.php</b> on line <b>1436</b><br />

^

Contacted Network Solutions Tech Team and they told me that the call “allow_url_fopen=0” is a problem because of hackers.  We are asking them how to disable it .. but so far no help.

Any Suggestions or solutions.

Thanks,

Ed

16 Answers

New Answer

YS Yellow Swordfish
Yellow Swordfish
Member

Are you using version 5.4.1 of Simple:Press? There was an update to this in that version that bypassed the call to getimagesize() if allow_url_fopen was turned off. At least it worked well in testing…

EG Edward J Gelb
Edward J Gelb
Member

Yellow Swordfish said
Are you using version 5.4.1 of Simple:Press? There was an update to this in that version that bypassed the call to getimagesize() if allow_url_fopen was turned off. At least it worked well in testing…

YS, Yes… we are using 5.4.1 .. is it possible that it installed incorrectly?

The feature was working great on 5.4 until we installed 5.4.1…

PS .. we are using WordPress 3.6 .. as we do not trust 3.8.1 until further testing.

Ed

 

EG Edward J Gelb
Edward J Gelb
Member

Edward J Gelb said

Yellow Swordfish said
Are you using version 5.4.1 of Simple:Press? There was an update to this in that version that bypassed the call to getimagesize() if allow_url_fopen was turned off. At least it worked well in testing…

YS, Yes… we are using 5.4.1 .. is it possible that it installed incorrectly?

The feature was working great on 5.4 until we installed 5.4.1…

PS .. we are using WordPress 3.6 .. as we do not trust 3.8.1 until further testing.

Ed

 

YS,  More information that may be of help to you.

In some cases a Group RSS will work.   In other instances, a TOPIC RSS will work but not the FORUM RSS or GROUP RSS.

Does this help your analysis?

Ed

 

YS Yellow Swordfish
Yellow Swordfish
Member

To be honest the main analysis needed here is to try and fathom why you get the message and others do not! While I appreciate the getimagesize() function requires allow_url_fopen it does not, in my experience, usually result in a warning being issued and displayed to the screen. And we will come back to that in a moment.

I can offer you a temporary fix if you are up to make a couple of minor code edits. And then meanwhile we can discuss it here on whether to make those permanent. Let me know if this appeals.

There are two points here. The first is that there would be no need to make the call to getimagesize() – which we would prefer not to do anyway –  if images were inserted into forum posts in a fully valid way. The reason the call is made is because images are getting inserted in posts with no dimensional information. SP needs to know the image width to enable it to function properly and if the width is missing from the image tag it makes a call to find the size.

The second – and the one I wanted to mention – is that it is recommended by everyone, everywhere (with the possible exception of your hosting company!) that php ‘Notice’ and ‘Warning’ messages are turned off on production sites. As you will see from the message ( a ‘Warning’) it displays the full path to your server which is not something you really want to make public. These sort of messages should be logged to an error log file but should never be displayed on a live site and I would personally be having string words with your host top that effect.

EG Edward J Gelb
Edward J Gelb
Member

Yellow Swordfish said
To be honest the main analysis needed here is to try and fathom why you get the message and others do not! While I appreciate the getimagesize() function requires allow_url_fopen it does not, in my experience, usually result in a warning being issued and displayed to the screen. And we will come back to that in a moment.

I can offer you a temporary fix if you are up to make a couple of minor code edits. And then meanwhile we can discuss it here on whether to make those permanent. Let me know if this appeals.

There are two points here. The first is that there would be no need to make the call to getimagesize() – which we would prefer not to do anyway –  if images were inserted into forum posts in a fully valid way. The reason the call is made is because images are getting inserted in posts with no dimensional information. SP needs to know the image width to enable it to function properly and if the width is missing from the image tag it makes a call to find the size.

The second – and the one I wanted to mention – is that it is recommended by everyone, everywhere (with the possible exception of your hosting company!) that php ‘Notice’ and ‘Warning’ messages are turned off on production sites. As you will see from the message ( a ‘Warning’) it displays the full path to your server which is not something you really want to make public. These sort of messages should be logged to an error log file but should never be displayed on a live site and I would personally be having string words with your host top that effect.

YS, I am willing to make the code edits.  Please send me the required information to my email address and I will be happy to test them out.

In the meantime, you are always welcome to enter the website as the messages also would appear to guests.

Ed

YS Yellow Swordfish
Yellow Swordfish
Member

I did visit. And quite seriously – getting the warning messages off you site is the most important thing. The more I think about it the more appalled I am that a host can be picky about something like allow_url_fopen (which most do not turn off) yet allow messages like this to be displayed publicly.

OK – to the edits.

The file in question is /simple-press/sp-api/sp-api-filters.php.

There are 3 calls to the getimagesize() function in this file – current lines numbe4rs are, I believe, 829, 1436 and 1724.

I think as as a temporary measure it would be worth prefixing these with the @ symbol, as in @getimagesize() which suppresses the  warning message.

 

 

EG Edward J Gelb
Edward J Gelb
Member

Edward J Gelb said

Yellow Swordfish said
To be honest the main analysis needed here is to try and fathom why you get the message and others do not! While I appreciate the getimagesize() function requires allow_url_fopen it does not, in my experience, usually result in a warning being issued and displayed to the screen. And we will come back to that in a moment.

I can offer you a temporary fix if you are up to make a couple of minor code edits. And then meanwhile we can discuss it here on whether to make those permanent. Let me know if this appeals.

There are two points here. The first is that there would be no need to make the call to getimagesize() – which we would prefer not to do anyway –  if images were inserted into forum posts in a fully valid way. The reason the call is made is because images are getting inserted in posts with no dimensional information. SP needs to know the image width to enable it to function properly and if the width is missing from the image tag it makes a call to find the size.

The second – and the one I wanted to mention – is that it is recommended by everyone, everywhere (with the possible exception of your hosting company!) that php ‘Notice’ and ‘Warning’ messages are turned off on production sites. As you will see from the message ( a ‘Warning’) it displays the full path to your server which is not something you really want to make public. These sort of messages should be logged to an error log file but should never be displayed on a live site and I would personally be having string words with your host top that effect.

YS, I am willing to make the code edits.  Please send me the required information to my email address and I will be happy to test them out.

In the meantime, you are always welcome to enter the website as the messages also would appear to guests.

Ed

YS, Please forgive my manners, I forgot to say “Thank You!!”

E

 

YS Yellow Swordfish
Yellow Swordfish
Member

No worries! smile

But please do let us know if those edits worked for you.

EG Edward J Gelb
Edward J Gelb
Member

Yellow Swordfish said
No worries! smile

But please do let us know if those edits worked for you.

Problem .. lines 1731 $size = @getimagesize (str_replace … produces error in

Parse error: syntax error, unexpected T_VARIABLE in /data/wp-content/plugins/simple-press/sp-api/sp-api-filters.php on line 1736

Removal of @ in line 1731 produces error

Parse error: syntax error, unexpected T_VARIABLE in /data/wp-content/plugins/simple-press/sp-api/sp-api-filters.php on line 1736

Ed

 

MP Mr Papa
Mr Papa
Member

it appears you have messed up the code, especially if all you did was add an @ and then remove it and still get errors…

can you paste the entire line of code so we can see it?

EG Edward J Gelb
Edward J Gelb
Member

Edward J Gelb said

Yellow Swordfish said

No worries! smile

But please do let us know if those edits worked for you.

Problem .. lines 1731 $size = @getimagesize (str_replace … produces error in

Parse error: syntax error, unexpected T_VARIABLE in /data/wp-content/plugins/simple-press/sp-api/sp-api-filters.php on line 1736

Removal of @ in line 1731 produces error

Parse error: syntax error, unexpected T_VARIABLE in /data/wp-content/plugins/simple-press/sp-api/sp-api-filters.php on line 1736

Ed

 

YS .. I also noticed that if you look at the error message there are additional errors at the bottom addressing a new issue.

Warning: Cannot modify header information – headers already sent by (output started at /data….wp-content/plugins/simple-press/sp-api/sp-api-filters.php:1436) in /data/0/,,, /wp-content/plugins/simple-press/forum/feeds/sp-feeds.php on line 173

Warning: Cannot modify header information – headers already sent by (output started at /data/0/0/23/9/23824/user/24314/problem-with-post-edit-buttontdocs/exploristX10/wp-content/plugins/simple-press/sp-api/sp-api-filters.php:1436) in /data/0/,,,/wp-content/plugins/simple-press/forum/feeds/sp-feeds.php on line 174

And .. raw messages are appearing.

Do appreciate if you can find a solution.

May of the Group RSS, Forum RSS and Topic RSS work.

I also found that Simple:Press does not like Groups to have Forums with the same name. They get mixed up their points are in error.

Ed

 

YS Yellow Swordfish
Yellow Swordfish
Member

Let’s go for the simple question first which is – what on earth did you use to make the file edits?

Clearly something was wrong with the edits you made and if you are still getting parse errors after you remove the changes then something is still wrong. And the headers already sent message might just be because of other errors or it might again be because of the way the file was edited. So – what tool was used is the first question.

EG Edward J Gelb
Edward J Gelb
Member

Mr Papa said
it appears you have messed up the code, especially if all you did was add an @ and then remove it and still get errors…

can you paste the entire line of code so we can see it?

YS and Mr. Papa,

As suggested I preformed that following modifications to the filter file.

May I suggest that it would be much easier if you would make the changes to the file and email me as gelb.com

    if (empty($width[1])) {
        $size = @getimagesize(str_replace(‘ ‘, ‘%20’, $srcfile));
        if ($size) {
            if ($size[0]) {
                $width[1] = $size[0];
            }
        } elseif (ini_get(‘allow_url_fopen’) == true && $size == false) {
            return ‘[‘.sp_text(‘Image Can Not Be Found’).’]’;
        }

============================

if (empty($width[1])) {
        $size = @getimagesize(str_replace(‘ ‘, ‘%20’, $srcfile));
        if ($size) {
            if ($size[0]) {
                $width[1] = $size[0];
                $height[1] = $size[1];
            } else {
                $width[1] = 0;
                $height[1] = 0;
            }
        } elseif (ini_get(‘allow_url_fopen’) == true && $size == false) {
            return ‘[‘.sp_text(‘Image Can Not Be Found’).’]’;
        }
=====================================================

# insepct the image itself
    global $gis_error;
    $gis_error = ”;
    set_error_handler(‘sp_gis_error’);

    $display_width = ”;
    $display_height = ”;
    $size = @getimagesize(str_replace(‘ ‘, ‘%20’, $src[1]));
    restore_error_handler();
    if ($gis_error == ”) {
        # Did image exist?
        if ($size[0] && $size[1]) {
            # check width
            if (isset($width[1]) && ($width[1] <= $sfsigimagesize[‘sfsigwidth’] || $sfsigimagesize[‘sfsigwidth’] == 0)) {# width specified and less than max allowed
                $display_width = ‘ width=”‘.$width[1].'”‘;
            } elseif ($sfsigimagesize[‘sfsigwidth’] > 0 && $size[0] > $sfsigimagesize[‘sfsigwidth’]) {
                $display_width = ‘ width=”‘.$sfsigimagesize[‘sfsigwidth’].'”‘;
            }

Regards,

Ed

 

EG Edward J Gelb
Edward J Gelb
Member

Yellow Swordfish said
Let’s go for the simple question first which is – what on earth did you use to make the file edits?

Clearly something was wrong with the edits you made and if you are still getting parse errors after you remove the changes then something is still wrong. And the headers already sent message might just be because of other errors or it might again be because of the way the file was edited. So – what tool was used is the first question.

YS,

All changes to the PHP file were made with a standard TEXT EDITOR.  I can assure you that after 30 years in programming, I did not make any mistakes.

Here is the message I just sent to Mr. Papa,

YS and Papa,

As suggested I preformed that following modifications to the filter file.

May I suggest that it would be much easier if you would make the changes to the file and email me as gelb.com

    if (empty($width[1])) {
        $size = @getimagesize(str_replace(‘ ‘, ‘%20’, $srcfile));
        if ($size) {
            if ($size[0]) {
                $width[1] = $size[0];
            }
        } elseif (ini_get(‘allow_url_fopen’) == true && $size == false) {
            return ‘[‘.sp_text(‘Image Can Not Be Found’).’]’;
        }

============================

if (empty($width[1])) {
        $size = @getimagesize(str_replace(‘ ‘, ‘%20’, $srcfile));
        if ($size) {
            if ($size[0]) {
                $width[1] = $size[0];
                $height[1] = $size[1];
            } else {
                $width[1] = 0;
                $height[1] = 0;
            }
        } elseif (ini_get(‘allow_url_fopen’) == true && $size == false) {
            return ‘[‘.sp_text(‘Image Can Not Be Found’).’]’;
        }
=====================================================

# insepct the image itself
    global $gis_error;
    $gis_error = ”;
    set_error_handler(‘sp_gis_error’);

    $display_width = ”;
    $display_height = ”;
    $size = @getimagesize(str_replace(‘ ‘, ‘%20’, $src[1]));
    restore_error_handler();
    if ($gis_error == ”) {
        # Did image exist?
        if ($size[0] && $size[1]) {
            # check width
            if (isset($width[1]) && ($width[1] <= $sfsigimagesize[‘sfsigwidth’] || $sfsigimagesize[‘sfsigwidth’] == 0)) {# width specified and less than max allowed
                $display_width = ‘ width=”‘.$width[1].'”‘;
            } elseif ($sfsigimagesize[‘sfsigwidth’] > 0 && $size[0] > $sfsigimagesize[‘sfsigwidth’]) {
                $display_width = ‘ width=”‘.$sfsigimagesize[‘sfsigwidth’].'”‘;
            }

Regards,

Ed