php warning with sessions

[vanhorn_s]

I recently upgraded to zc 1.5.6, php 7.0.33
I have slowly been getting rid of errors in the log folder, and I have had warnings set by sessions a few times now. I cleared out the log folder this morning, after fixing a few things, and it's currently the only file in there.

[17-Dec-2019 18:30:47 UTC] Request URI: /?worx=oxq, IP address: 69.163.224.109
#1 session_save_path() called at [/home1/redsauto/public_html/includes/functions/sessions.php:164]
#2 zen_session_save_path() called at [/home1/redsauto/public_html/includes/init_includes/init_sessions.php:33]
#3 require(/home1/redsauto/public_html/includes/init_includes/init_sessions.php) called at [/home1/redsauto/public_html/includes/autoload_func.php:48]
#4 require(/home1/redsauto/public_html/includes/autoload_func.php) called at [/home1/redsauto/public_html/includes/application_top.php:170]
#5 require(/home1/redsauto/public_html/includes/application_top.php) called at [/home1/redsauto/public_html/index.php:32]
--> PHP Warning: session_save_path(): Cannot change save path when headers already sent in /home1/redsauto/public_html/includes/functions/sessions.php on line 164.

[17-Dec-2019 18:30:47 UTC] Request URI: /?worx=oxq, IP address: 69.163.224.109
#1 session_set_cookie_params() called at [/home1/redsauto/public_html/includes/init_includes/init_sessions.php:44]
#2 require(/home1/redsauto/public_html/includes/init_includes/init_sessions.php) called at [/home1/redsauto/public_html/includes/autoload_func.php:48]
#3 require(/home1/redsauto/public_html/includes/autoload_func.php) called at [/home1/redsauto/public_html/includes/application_top.php:170]
#4 require(/home1/redsauto/public_html/includes/application_top.php) called at [/home1/redsauto/public_html/index.php:32]
--> PHP Warning: session_set_cookie_params(): Cannot change session cookie parameters when headers already sent in /home1/redsauto/public_html/includes/init_includes/init_sessions.php on line 44.

[17-Dec-2019 18:30:47 UTC] Request URI: /?worx=oxq, IP address: 69.163.224.109
#1 session_start() called at [/home1/redsauto/public_html/includes/functions/sessions.php:117]
#2 zen_session_start() called at [/home1/redsauto/public_html/includes/init_includes/init_sessions.php:89]
#3 require(/home1/redsauto/public_html/includes/init_includes/init_sessions.php) called at [/home1/redsauto/public_html/includes/autoload_func.php:48]
#4 require(/home1/redsauto/public_html/includes/autoload_func.php) called at [/home1/redsauto/public_html/includes/application_top.php:170]
#5 require(/home1/redsauto/public_html/includes/application_top.php) called at [/home1/redsauto/public_html/index.php:32]
--> PHP Warning: session_start(): Cannot start session when headers already sent in /home1/redsauto/public_html/includes/functions/sessions.php on line 117.

[17-Dec-2019 18:30:47 UTC] Request URI: /?worx=oxq, IP address: 69.163.224.109
#1 header() called at [/home1/redsauto/public_html/includes/init_includes/init_templates.php:70]
#2 require(/home1/redsauto/public_html/includes/init_includes/init_templates.php) called at [/home1/redsauto/public_html/includes/autoload_func.php:48]
#3 require(/home1/redsauto/public_html/includes/autoload_func.php) called at [/home1/redsauto/public_html/includes/application_top.php:170]
#4 require(/home1/redsauto/public_html/includes/application_top.php) called at [/home1/redsauto/public_html/index.php:32]
--> PHP Warning: Cannot modify header information - headers already sent by (output started at /home1/redsauto/public_html/**************/includes/init_includes/.1f7be16b.ico(2) : runtime-created function(4) : eval()'d code:300) in /home1/redsauto/public_html/includes/init_includes/init_templates.php on line 70.

[17-Dec-2019 18:30:47 UTC] Request URI: /?worx=oxq, IP address: 69.163.224.109
#1 header() called at [/home1/redsauto/public_html/includes/templates/responsive_classic/common/html_header.php:17]
#2 require(/home1/redsauto/public_html/includes/templates/responsive_classic/common/html_header.php) called at [/home1/redsauto/public_html/index.php:49]
--> PHP Warning: Cannot modify header information - headers already sent by (output started at /home1/redsauto/public_html/WhynotMake_thisreallyHardtohack12675/includes/init_includes/.1f7be16b.ico(2) : runtime-created function(4) : eval()'d code:300) in /home1/redsauto/public_html/includes/templates/responsive_classic/common/html_header.php on line 17.

I've tried researching this issue, but have come up with no clues.
Any ideas on how to fix this one? I understand it's just a warning, but I would like to eventually see the log folder empty.

[mc12345678]

Is this just ZC 1.5.6 or the latest sub-version of ZC 1.5.6c? I believe there were some changes made to that sessions file or at least sessions handling to address something like that. Otherwise, based on the report of headers already being sent that there possibly is a file loaded before this point that has output information to the browser that should not have (ie. A space or other special character before the opening <?php or perhaps similar after a closing ?> at the end of whatever file is causing the issue...)

[vanhorn_s]

1.5.6c Downloaded about 2 weeks ago.

If it is something before, or after the php tags, how would I go about tracking that down?

[vanhorn_s]

What is the purpose of admin/includes/init_includes/.1f7be16b.ico(2)? I's one of the files that headers were already sent by.

[mc12345678]

What is the purpose of admin/includes/init_includes/.1f7be16b.ico(2)? I's one of the files that headers were already sent by.

Got me, it's not a part of the base install and not anything normal...

If you don't know what it is, then it probably shouldn't exist and would suggest review of the files for possible hacking.

Otherwise, the FAQ for header like issues is/was: https://www.zen-cart.com/content.php...s-already-sent

[vanhorn_s]

[QUOTE=mc12345678;1364252]Got me, it's not a part of the base install and not anything normal...

If you don't know what it is, then it probably shouldn't exist and would suggest review of the files for possible hacking.

Not sure where it came from. I deleted it, and I'll see if any of the php warnings come back. It wasn't in with any of the plugins I tried.

I tried opening the file in notepad++, and it couldn't open it. Notepad refused to open it, stating something about a possible virus. The last modified date was the 12th, I did some editing that day, but I can't remember what.

[mc12345678]

Make sure to check that the catalog side is still working. If the file is loaded as "normal" then there is usually a file that calls it out and will stop operations. But, still should go look at this: http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

[lindasdd]

Considering the error log includes mention of 'eval', I would set up and run SysCheck as step 1: https://www.zen-cart.com/downloads.php?do=file&id=980

[lat9]

I'd also check the site's raw access logs for accesses made by 69.163.224.109, since that IP appears to be using a wonky URL (e.g. example.com/?worx=oxq) to access the site.