PHP Functions

[Spyyder51]

Found that code that contains PHP's fopen() and fwrite() functions cause an internal 500 error when saving WP page.

[AndiDittrich]

Hi @Spyyder51 ,

For clarification: is your issue related to code you've posted with WordPress or do you get error caused by the WordPress Plugin itself ?

best regards, Andi

[Spyyder51]

We setup a plain-jane, out of the box WordPress (version Version 4.9.8) with the TwentyFifteen theme (also out of the box) to use as an in-house Wiki for our weather model. The plugins we use are: Enlighter - Customizable Syntax Highlighter Version 3.8.1 | By Andi Dittrich | View details | News & Updates | EnlighterJS Website Page Security & Membership Allows admins to create user groups and restrict access to sections of the site by group. Version 1.5.15 | By Veraxus, Contexture | View details Tag Pages Add tags to Pages, just as you would do with Posts With this setup, I added a page. Call it "WeatherModel" On "Edit Page", in the Visual Mode, I type in a bunch of text, descriptions, blah, blah, blah and several uses of EnlighterJS code blocks. I click the "Code Insert", I get the Code Insert screen. I choose PHP for a language (have tried others as well) and paste in the following code: protected function start_output() { @ob_start(); @ob_implicit_flush(true); @ob_end_flush(); if($this->logit) { if(is_dir(PATH_CRON . 'logs/')) { $this->lfhandle = fopen(PATH_CRON . 'logs/' . $this->logfile, "w"); } } } I click "Ok" and I'm back on the Page Edit screen, and the EnlighterJS code box in there as expected, with the code in it. Now comes the problem. When I click "Update" to save my page, I get an Internal Server Error 500. If my code above is changed to: protected function start_output() { @ob_start(); @ob_implicit_flush(true); @ob_end_flush(); if($this->logit) { if(is_dir(PATH_CRON . 'logs/')) { $this->lfhandle = (php file open function)(PATH_CRON . 'logs/' . $this->logfile, "w"); } } } It saves without error. Same holds true with the PHP fwrite() function. If I just type in fopen() or fwrite() directly into the page (without EnlighterJS), there is no error. Hope this clarifies, and hope you can find a fix (or point me in the direction of a setting I should have changed or something). I rather like your plugin, but this might be a deal breaker for using it as this was just the first file to be documented, haven't even got to the complicated stuff yet. And thanks for the quick follow-up. Eric N

…

On 11/6/18, Andi Dittrich ***@***.***> wrote: Hi @Spyyder51 , For clarification: is your issue related to code you've posted with WordPress or do you get error caused by the WordPress Plugin itself ? best regards, Andi -- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #44 (comment)

[AndiDittrich]

Hi Eric,

please try to disable the Enlighter plugin and try to post the same sourcecode which throws the error as pre text.
i assume that the HTTP500 error will still occur - if so i've an idea whats going wrong since "weather model" sounds like you're working in a bigger company / research facility which also host/administrates the servers by their own it department ?

best regards, Andi

[Spyyder51]

Interesting, it did indeed when I wrapped the function in <pre tags. What's your idea? I can change, or get changed, pretty much anything on the servers. Eric N

…

On 11/7/18, Andi Dittrich ***@***.***> wrote: Hi Eric, please try to disable the Enlighter plugin and try to post the same sourcecode which throws the error as `pre` text. i assume that the HTTP500 error will still occur - if so i've an idea whats going wrong since "weather model" sounds like you're working in a bigger company / research facility which also host/administrates the servers by their own it department ? best regards, Andi -- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #44 (comment)

[AndiDittrich]

it sounds like

• a misconfigured IDPS like modsecurity, suricata or snort on your server OR
• an endpoint security suite on your PC OR
• a corporate IDPS on your router, firewall

which blocks the request because it classifies the "PHP code" as malicious

[Spyyder51]

Thanks for the tip/direction, I'll look into it tomorrow. Closed the issue.

…

On 11/8/18, Andi Dittrich ***@***.***> wrote: it sounds like a misconfigured IDPS like modsecurity, suricata or snort on your server **OR** an endpoint security suite on your PC **OR** a corporate IDPS on your router, firewall which blocks the request because it classifies the "PHP code" as malicious -- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #44 (comment)