file_get_contents(): http:// wrapper is disabled in the server configuration

28 Jul 2016, 11:49 PM

#1

Totally Zenned

Join Date:: Aug 2009
Location:: North Idaho, USA
Posts:: 2,015
Plugin Contributions:: 0

file_get_contents(): http:// wrapper is disabled in the server configuration

I just notices several instances of the same myDEBUG files since July 7. Since I have no record of making any changes this month.

No hosting upgrades/updates have been admitted to being made.
Stuff doesn't start happening by itself.

I appreciate any suggestions for starting places.

MyDEBUG-ADM

[19-Jul-2016 07:35:13 America/Los_Angeles] Request URI: /CrypticAdmin/modules.php?set=shipping&module=usps, IP address: MYSTATICIP 
#1  file_get_contents() called at [/home/cpanelID/public_html/includes/functions/plugin_support.php:38] 
#2  plugin_version_check_for_updates() called at [/home/cpanelID/public_html/includes/modules/shipping/usps.php:117] 
#3  usps->__construct() called at [/home/cpanelID/public_html/CrypticAdmin/modules.php:190]  

[19-Jul-2016 07:35:13 America/Los_Angeles] PHP Warning:  file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /home/cpanelID/public_html/includes/functions/plugin_support.php on line 38 
[19-Jul-2016 07:35:13 America/Los_Angeles] Request URI: /CrypticAdmin/modules.php?set=shipping&module=usps, IP address: MYSTATICIP
#1  file_get_contents() called at [/home/cpanelID/public_html/includes/functions/plugin_support.php:38] 
#2  plugin_version_check_for_updates() called at [/home/cpanelID/public_html/includes/modules/shipping/usps.php:117] 
#3  usps->__construct() called at [/home/cpanelID/public_html/CrypticAdmin/modules.php:190]  

[19-Jul-2016 07:35:13 America/Los_Angeles] PHP Warning:  file_get_contents(http://www.zen-cart.com/downloads.php?do=versioncheck&id=1292): failed to open stream: no suitable wrapper could be found in /home/cpanelID/public_html/includes/functions/plugin_support.php on line 38 [19-Jul-2016 07:35:13 America/Los_Angeles] Request URI: /CrypticAdmin/modules.php?set=shipping&module=usps, IP address: MYSTATICIP 
#1  in_array() called at [/home/cpanelID/public_html/includes/functions/plugin_support.php:42] 
#2  plugin_version_check_for_updates() called at [/home/cpanelID/public_html/includes/modules/shipping/usps.php:117] 
#3  usps->__construct() called at [/home/cpanelID/public_html/CrypticAdmin/modules.php:190]  
[19-Jul-2016 07:35:13 America/Los_Angeles] PHP Warning:  in_array() expects parameter 2 to be array, null given in /home/cpanelID/public_html/includes/functions/plugin_support.php on line 42

MyDEBUG
Code repeats 10 times per myDEBUG file

[07-Jul-2016 23:10:14 America/Los_Angeles] Request URI: /index.php?main_page=product_info&products_id=14:4bde1cede2eba37305096f5094d56aa7, IP address: 83.209.95.201 
#1  mysqli_connect() called at [/home/cpanelID/public_html/includes/classes/db/mysql/query_factory.php:62] 
#2  queryFactory->connect() called at [/home/cpanelID/public_html/includes/init_includes/init_database.php:23] 
#3  require(/home/cpanelID/public_html/includes/init_includes/init_database.php) called at [/home/cpanelID/public_html/includes/autoload_func.php:48] 
#4  require(/home/cpanelID/public_html/includes/autoload_func.php) called at [/home/cpanelID/public_html/includes/application_top.php:158] 
#5  require(/home/cpanelID/public_html/includes/application_top.php) called at [/home/cpanelID/public_html/index.php:26]

29 Jul 2016, 8:43 AM

#2

mc12345678

Totally Zenned

Join Date:: Jul 2012
Posts:: 16,908
Plugin Contributions:: 2

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

Well, hopefully it is only happening when an authorized admin is known to be logged in otherwise the activity is highly suspect.

It looks to me like the usps.php shipping module is having difficulty identifying that there is an update available to it either by software inspection permissions or by Internet communication/response restrictions. I believe there have been some reports about various version check code and how even though there are alternate methods built in to prevent total failure, some of the alternate methods fail as well.

The store front/2nd message doesn't seem to make much sense as it looks incomplete. There's no warning, no error, etc. Reported just a bunch of lines of code basically. Perhaps a self directed error log?

29 Jul 2016, 1:05 PM

#3

lat9

Administrator

Join Date:: Sep 2009
Location:: Stuart, FL
Posts:: 14,097
Plugin Contributions:: 56

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

The pertinent bit is:

file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 i

Your site is configured (via the base php.ini) to disable the use of the PHP function file_get_contents on an external (i.e. accessed via http vs. direct file-system) file.

That's why the usps.php module is failing; you'll get the same behavior for any other plugins (and the Zen Cart version check used in the admin header) that do that "is there a new version" check.

29 Jul 2016, 1:40 PM

#4

rixstix

Totally Zenned

Join Date:: Aug 2009
Location:: North Idaho, USA
Posts:: 2,015
Plugin Contributions:: 0

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

mc12345678:

Well, hopefully it is only happening when an authorized admin is known to be logged in otherwise the activity is highly suspect.

Yes, that is why I replaced the actual IP address with the text MYSTATICIP shown in the myDEBUG-adm file contents

mc12345678:

It looks to me like the usps.php shipping module is having difficulty identifying that there is an update available to it either by software inspection permissions or by Internet communication/response restrictions. I believe there have been some reports about various version check code and how even though there are alternate methods built in to prevent total failure, some of the alternate methods fail as well.

The last update to USPS shipping was back in Jan 2016 unless Ajeh snuck one in on me.

mc12345678:

The store front/2nd message doesn't seem to make much sense as it looks incomplete. There's no warning, no error, etc. Reported just a bunch of lines of code basically. Perhaps a self directed error log?

Darn. The 10 repeated sections looked the same but there is a bit difference. I just didn't want to clutter the post with a codepaste that scrolled for 3-4 screens. I'll put the entire file content at the end of this post. Sorry.

lat9:

The pertinent bit is:

file_get_contents(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 i

> Your site is configured (via the base php.ini) to disable the use of the PHP function ***file_get_contents*** on an external (i.e. accessed via http vs. direct file-system) file.  
> 
> That's why the usps.php module is failing; you'll get the same behavior for any other plugins (and the Zen Cart version check used in the admin header) that do that "is there a new version" check.

Sorry Cindy.  That went right over the top of my head before first cup of coffee.  Are you saying that a server configuration has been changed, a ZC setting has been changed or Rick had a brainfart and changed something & forgot to record the change in my notes?


Entire myDEBUG contents.  I checked the IP addresses in the various files.  MSFT, Google and "this one"
I forgot this one (or similar) was [answered by DrByte](https://www.zen-cart.com/showthread.php?219516-PHP-Warning-mysqli_connect%28%29-%28HY000-2002%29-No-such-file-or-directory) a few months ago and I forgot to delete the files.
**Storefront myDEBUG under control and explained.**

[07-Jul-2016 23:10:19 America/Los_Angeles] Request URI: /index.php?main_page=shopping_cart, IP address: 83.209.95.201
#1 mysqli_connect() called at [/home/chainwea/public_html/includes/classes/db/mysql/query_factory.php:62]
#2 queryFactory->connect() called at [/home/chainwea/public_html/includes/init_includes/init_database.php:23]
#3 require(/home/chainwea/public_html/includes/init_includes/init_database.php) called at [/home/chainwea/public_html/includes/autoload_func.php:48]
#4 require(/home/chainwea/public_html/includes/autoload_func.php) called at [/home/chainwea/public_html/includes/application_top.php:158]
#5 require(/home/chainwea/public_html/includes/application_top.php) called at [/home/chainwea/public_html/index.php:26]

[07-Jul-2016 23:10:19 America/Los_Angeles] PHP Warning: mysqli_connect(): (HY000/2002): No such file or directory in /home/chainwea/public_html/includes/classes/db/mysql/query_factory.php on line 62
[07-Jul-2016 23:10:19 America/Los_Angeles] Request URI: /index.php?main_page=shopping_cart, IP address: 83.209.95.201
#1 mysqli_connect() called at [/home/chainwea/public_html/includes/classes/db/mysql/query_factory.php:62]
#2 queryFactory->connect() called at [/home/chainwea/public_html/includes/init_includes/init_database.php:23]
#3 require(/home/chainwea/public_html/includes/init_includes/init_database.php) called at [/home/chainwea/public_html/includes/autoload_func.php:48]
#4 require(/home/chainwea/public_html/includes/autoload_func.php) called at [/home/chainwea/public_html/includes/application_top.php:158]
#5 require(/home/chainwea/public_html/includes/application_top.php) called at [/home/chainwea/public_html/index.php:26]

[07-Jul-2016 23:10:19 America/Los_Angeles] PHP Warning: mysqli_connect(): (HY000/2002): No such file or directory in /home/chainwea/public_html/includes/classes/db/mysql/query_factory.php on line 62

29 Jul 2016, 1:53 PM

#5

rixstix

Totally Zenned

Join Date:: Aug 2009
Location:: North Idaho, USA
Posts:: 2,015
Plugin Contributions:: 0

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

Just figured out that the myDEBUG-adm files are generated by:

Opening the USPS shipping screen for editing. Actually, 2 or 3 myDEBUG files are generated when either the UPDATE or CANCEL button is clicked.

Also found that clicking the "Check for updates" button on the Admin Home page, causes a single, similar or identical myDEBUG to be generated. lat9 suggestion :smile:
The result displayed is

Your version of Zen Cart® appears to be current.
(You are presently using: v1.5.4)

29 Jul 2016, 3:24 PM

#6

lat9

Administrator

Join Date:: Sep 2009
Location:: Stuart, FL
Posts:: 14,097
Plugin Contributions:: 56

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

Rick, in answer to your question:

Sorry Cindy. That went right over the top of my head before first cup of coffee. Are you saying that a server configuration has been changed, a ZC setting has been changed or Rick had a brainfart and changed something & forgot to record the change in my notes?

If you've *just *started receiving these messages, then the server's configuration has changed. Check your admin's Tools->Server/Version Info and search for allow_url_fopen; you'll see that it's currently Off. No brainfarts involved!

Some webhosts allow you to override their default php.ini values via cPanel and some require that you sprinkle php.ini overrides in each folder where the override should be applied.

29 Jul 2016, 6:37 PM

#7

rixstix

Totally Zenned

Join Date:: Aug 2009
Location:: North Idaho, USA
Posts:: 2,015
Plugin Contributions:: 0

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

TNX Cindy,

I will ask the questions. The server is a managed VPS and the host usually asks before making changes other than a cpanel update.

Not sure why they would have changed a setting but you are correct

allow_url_fopen: OFF/OFF

29 Jul 2016, 7:38 PM

#8

drbyte

Sensei

Join Date:: Jan 2004
Posts:: 63,513
Plugin Contributions:: 176

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

RixStix:

Not sure why they would have changed a setting but you are correct

allow_url_fopen: OFF/OFF
Hosts often lock that down in the interest of thinking they're providing security protections. It'a s low-hanging-fruit measure often taken prematurely. And while it "does" do that, there are better ways to provide the same protections without crippling legit use.

30 Jul 2016, 12:10 AM

#9

rixstix

Totally Zenned

Join Date:: Aug 2009
Location:: North Idaho, USA
Posts:: 2,015
Plugin Contributions:: 0

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

Thanks DrByte. for the comment and for renaming the thread.

Host has re-enabled the function but strongly prefers to have it disabled due to recent zero day incidents.

Just to throw fuel on a p.ssing contest....

Zencart is behind the times if they think allow_url_fopen isn't a potential security issue. It's not a matter of if, it's a matter of when. In fact, we have had it enabled for years because we understand that old way of thinking. But there was recently a vulnerability for it that affected wordpress, and we turned it off on all servers to prevent that from harming customer sites. Ultimately, your server got included in the change, and I'm sorry for that. But, it's hard to keep it separate in the automated tools.
In fact, this is only the 3rd complaint we've had about it, so I'm not sure that there's a reason anyone should still be developing software that needs it enabled.

In case you are curious, an article of interest:
https://goo.gl/BxKX08

And a general summary on why this allow_url_fopen is not something to ignore:

"If enabled, allow_url_fopen allows PHP's file functions -- such as
file_get_contents() and the include and require statements -- can retrieve data from remote locations, like an FTP or web site. Programmers frequently forget this and don't do proper input filtering when passing user-provided data to these functions, opening them up to code injection vulnerabilities. A large number of code injection vulnerabilities reported in PHP-based web applications are caused by the combination of enabling allow_url_fopen and bad input filtering."

30 Jul 2016, 12:35 AM

#10

drbyte

Sensei

Join Date:: Jan 2004
Posts:: 63,513
Plugin Contributions:: 176

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

The input-filtering risk is well understood -- and equally well handled within Zen Cart.

More and more we're moving towards using CURL ... but those same hosts turn it off citing the same alarmist reasons.

An ecommerce site is NOT a wordpress site. They're different beasts. Hosts may not understand this, which is all too often a sad inconvenience for storeowners.

30 Jul 2016, 1:08 AM

#11

rixstix

Totally Zenned

Join Date:: Aug 2009
Location:: North Idaho, USA
Posts:: 2,015
Plugin Contributions:: 0

Re: file_get_contents(): http:// wrapper is disabled in the server configuration

Thank you and I understand both sides of the fence. I am lucky to have a host who also understands and will make the changes requested but provides info so that I can understand why they made the change to protect those who haven't a clue. Sometimes automated software must be utilized and then manually "undo" those accounts that were negatively affected.