#wordpress 2018-01-11

2018-01-11 UTC
j12t, tantek, wagle, Kyle-K, [mlopatka], [kevinmarks], [mail], jeremycherfas, [pfefferle], [miklb], [colinwalker], chrisaldrich, [keithjgrant] and [dariusdunlap] joined the channel; Kyle-K left the channel
#
[dariusdunlap] Getting an error message on my indieweb-enabled wordpress site, squarepegfoundation.org:
#
[dariusdunlap] Cannot modify header information
#
[dariusdunlap] Specifically:
#
[dariusdunlap] Warning: Cannot modify header information - headers already sent by (output started at /home/squarepegdarius/squarepegfoundation.org/index.php:1) in /home/squarepegdarius/squarepegfoundation.org/wp-content/plugins/webmention/includes/class-webmention-receiver.php on line 633
#
[dariusdunlap] Anyone seen this? I’ve run updates to all plugins and themes, hoping that might resolve it.
#
[dariusdunlap] This site is WordPress 4.9.1 running Twenty Seventeen theme.
#
[miklb] have you edited any theme/plugin files lately? Or your .htaccess file?
#
[dariusdunlap] Nope
#
[dariusdunlap] Haven’t done anything except let it run the auto updates
#
[miklb] I haven’t seen that error before, I have seen that error in WP in the past due to a typo in a file
#
[miklb] but it has been a long time since I’ve seen it personally
#
gRegorLove Hm, since it's line 1, I wonder if that's a BOM on the file.
#
gRegorLove Can you re-save that index.php with UTF8 encoding, no BOM?
#
gRegorLove I've run into issues like that before.
#
[dariusdunlap] Dunno. As far as I know, the only thing that’s happened was my wife made a new post this morning. I’ll check that for funny chars.
#
gRegorLove Though not with a theme out of the box, just oddball text editor settings when updating a file.
#
gRegorLove Oh, I don't think that's the theme index.php, it's the web root index.php
#
gRegorLove Mis-read the file paths
#
gRegorLove If that doesn't do it, and you don't mind showing more error messages on the site for a brief time, you could set WP_DEBUG in your wp-config.php, which should display more PHP errors.
#
gRegorLove https://codex.wordpress.org/WP_DEBUG
#
[dariusdunlap] Yes, I think it’s the web root index. But is the problem there, or in webmention-receiver at line 633?
#
gRegorLove root index, I think. That line in the webmention receiver looks ok, at a glance, but I don't know that plugin well.
#
[dariusdunlap] Since all this stuff has been working for many months, (a couple years?) I was hopeful that it was something simple in the plugin
#
[dariusdunlap] Yeah, me either.
#
gRegorLove Just going off general PHP and WordPress experience. :)
#
[dariusdunlap] I was wondering if webmention-receiver was just stepping in a pile of poop left by something else. Ha ha
#
[dariusdunlap] Hmmm. Full multi-part error message:
#
[dariusdunlap] Warning: Cannot modify header information - headers already sent by (output started at /home/squarepegdarius/squarepegfoundation.org/index.php:1) in /home/squarepegdarius/squarepegfoundation.org/wp-content/plugins/webmention/includes/class-webmention-receiver.php on line 633
#
[dariusdunlap] Warning: Cannot modify header information - headers already sent by (output started at /home/squarepegdarius/squarepegfoundation.org/index.php:1) in /home/squarepegdarius/squarepegfoundation.org/wp-content/plugins/webmention/includes/class-webmention-receiver.php on line 635
#
[dariusdunlap] Warning: Cannot modify header information - headers already sent by (output started at /home/squarepegdarius/squarepegfoundation.org/index.php:1) in /home/squarepegdarius/squarepegfoundation.org/wp-includes/pluggable.php on line 1216
#
[dariusdunlap] So this “Pluggable” is also suspect.
#
gRegorLove That's core WP, so I don't think so. Some plugin is sending headers before webmention-receiver tries to
#
gRegorLove The index.php:1 isn't too helpful in that case
#
gRegorLove will leave it to the WP pros in here
#
[dariusdunlap] Thanks for the help. You both have helped me eliminate some possible dead ends I could have wasted a bunch o time chasing!
#
[miklb] may need to debug the old fashioned way and deactivate plugin by plugin
#
[dariusdunlap] Yeah.
#
[miklb] at least of the ones recently updated
#
Zegnat The “output started at” should really point at the mistake. So this does smell like some whitespace or a BOM snuck into index.php
#
Zegnat See https://stackoverflow.com/a/8028987 for a good rundown of the headers issue.
#
[dariusdunlap] Disabling webmention plugin gets rid of the error. Not sure that really fixes the problem. But I notice the the webmention plugin hasn’t been updated in 7 months. Is there something new I should be using instead?
#
[miklb] no
[eddie] joined the channel
#
Zegnat Hmm, last commit was “8 Dec 2017”, I guess they aren’t ready to cut a new release yet
#
[miklb] the webmention plugin won’t really change much as the spec is solid as is the plugin. Semantic linkbacks is where all of the work is being done on better presentation of the webmention data
#
[miklb] oh
#
Zegnat It is definitely a different plugin (or some accidental whitespace) messing it up, [dariusdunlap]. The webmention plugin tries to sends its headers through WP’s own “send_headers” action hook. The fact that is failing means something is outputting text either inside there or even earlier in the execution.
#
[dariusdunlap] Also, looking at the stackoverflow link provided (Thanks!) it looks like it really some some stray gunk in index.php, line 1... So I’ll have to go look at the theme config and other stuff.
#
Zegnat Commenting out (add // at the start of) line 21 in class-webmention-receiver.php *may* be a stopgap solution. If I am reading the code right, it will stop sending the HTTP headers but your endpoint should still be discoverable through LINK elements in the HEAD of your template.
#
Zegnat (I am coming strictly from code here, I do not run this plugin myself.)
#
[dariusdunlap] Thanks, @Zegnat - great!
#
Zegnat Also start by checking /home/squarepegdarius/squarepegfoundation.org/index.php (the mentioned file). There might be some whitespace or a BOM marker before <?php and removing that should then fix it.
#
[dariusdunlap] Yeah, that’s kind of a black hole. Line 1:
#
[dariusdunlap] <script type='text/javascript'>
#
[dariusdunlap] And then a big ‘var’ on the next line containing all the encoded JS.
#
[dariusdunlap] But I’m still hopeful I’ll find a simple typo or stray character in a theme config setting or something.
[colinwalker] joined the channel
#
[colinwalker] I really don’t like the look of that, there shouldn’t be script there. - Saw it looking at the source of the error page and it sends Safari CPU through the roof.
#
[colinwalker] Looks more like a code injection
#
[dariusdunlap] Ah, that makes more sense, actually.
[kevinmarks] joined the channel
#
[colinwalker] Would normally expect index.php to begin <?php
#
Zegnat Yes, index.php should start with <?php
#
Zegnat For the latest WordPress, this is the entire index file: https://core.trac.wordpress.org/browser/trunk/src/index.php
#
Zegnat If there is anything before the <?php that will break sending headers, but more importantly, is probably a sign of something having modified WordPress.
#
aaronpk uh, <script> with encoded JS sounds like your wordpress has been hacked
#
[dariusdunlap] Yep. That’s the assumption I’m going on @aaronpk. Luckily DB and such as all backed up, but it still takes some time and effort to unravel. Thanks for the help and advice everyone. You saved me many dead ends. Got to run to a meeting now, but I’ll get on this again in a few hours. *sigh*
#
aaronpk yeah that's no fun to deal with for sure
#
Zegnat Good luck [dariusdunlap]. Sad this was the result, but happy to have helped.
#
[colinwalker] Hmmm - JS:Applictaion.BitCoinMiner.YB
#
[colinwalker] Application that should have been
#
[dariusdunlap] Ha ha! Probably. Jackasses.
#
[colinwalker] My browser started running like a dog so did a BitDefender scan
#
[dariusdunlap] Which likely means I’ll have to also clean up this crap from my wife’s laptop and some of the staffs’, too.
#
Zegnat You may also consider running something like https://wpscan.org/ to check if there are any known vulnerabilities in the WP plugins you are currently using.
#
[miklb] Zegnat++
#
Loqi zegnat has 2 karma in this channel (166 overall)
#
gRegorLove Ooh, thanks for wpscan. I'll check that out for some of our work clients.
tantek joined the channel
#
Zegnat I can’t take credit. I think petermolnar showed it to me initially.
#
Zegnat It is available from homebrew on macOS, which makes it easy to play with :)
[mail] and [eddie] joined the channel
#
petermolnar along with slowloris, if I recall correctly
#
Zegnat Yes. To this day I am surprised all those tools ran on Schiphol free WiFi.
#
petermolnar it could be one of those rare things movies were not lieing about: use the airport wifi for hacking :D
sebsel, [kevinmarks] and chrisaldrich joined the channel
#
chrisaldrich GWG++ for some awesome forthcoming support of weather in the Simple Location plugin #cantwait
#
Loqi gwg has 37 karma in this channel (300 overall)