Need to Bulletproof this PHP include. Getting Failed to Open Stream - php

I've got some functions in my file that require taxonomy.php to execute. I'm attempting to include the file like so...(this is called from functions.php, which is located in wp_content/themes/mytheme/
include($_SERVER['DOCUMENT_ROOT'] .'/wp-admin/includes/taxonomy.php');
However, depending on the particular server setup, its hit or miss (mostly hit) whether the include will be found. In the case its not found, I get this error...
Warning: include(/home/user/domainname.com/wp-admin/includes/taxonomy.php) [function.include]: failed to open stream: No such file or directory in /home/user/domainname.com/testing123/wp-content/themes/mytheme/functions.php on line 10
UPDATE: Assuming I'm already doing about as much as I can by using DOCUMENT_ROOT, is there a means of avoiding the error that occurs when the file is not found? And I will be checking for function_exists in any functions that require taxonomy.php so as to suppress errors...

Well, the only way to bulletproof this is to actually configure it on each server you deploy it on. If you can't assume document_root is a reliable factor, I can't imagine any other variable that could give you a better result.
You could start searching for taxonomy.php but that is expensive, and horribly prone to failure or picking the wrong file (what happens if my neighbor has wordpress installed in /home/user/domainname2.com?

If your application depends on a particular file, you should be using require/require_once to ensure your application does not partially load despite missing the required file.
As for making sure that file always exists and is in a place you need it, you could move that to a configuration file and allow the user running the software to set it, along with auto-attempting to find the find in the event the user is clueless.

Related

PHP allow_url_include alternative for Wordpress Plugin

I'm on a XAMPP for Windows 8.0.3 installation, developing a payments gateway plugin for my ecommerce site made via Wordpress. I moved some of my code to an includes directory, and then used require_once plugins_url('/includes/class-wc-payment-gateway-elavon.php', __FILE__ ); to require the file from my includes directory.
In my website, I'm now receiving a fatal error, telling me "Failed to open stream: no suitable wrapper could be found" on that line that I just mentioned. It also gives me a warning which states "require_once(): https:// wrapper is disabled in the server configuration by allow_url_include=0", which to me means that the method to fix this error would be to change allow_url_include to yes in my php.ini file. To my understanding, it's bad practice to have allow_url_include set to YES in your php.ini file, as it poses security risks. Also, in Wordpress by default, the function "plugins_url" retrieves a URL within the plugins or mu-plugins directory, which is the directory where my plugin resides. Here is a reference to the function in the developer documentation for Wordpress: https://developer.wordpress.org/reference/functions/plugins_url/
So, my questions are as follows. Why is my file failing to be retrieved with this method? Why would it mention that the https:// wrapper is disabled in the server configuration if I'm trying to access a file locally? Is there a better way to require this include than the method that I am using? I'm relatively new to PHP and coding as a whole, so I'd appreciate if you are verbose, or point me to other resources I may use to learn. Thank you for any responses or help.
The reason that your code doesn't work with plugins_url is because that returns a URL such as https://www.example.com/wp-content/plugins/your-plugin/includes/class-wc-payment-gateway-elavon.php which will be executed on the server as PHP and the result of that execution return, not the code itself.
My recommendation is in your main plugin entry file do something like this:
define('MY_AWESOME_PLUGIN_PATH', __DIR__);
Replace that constant name as you see fit.
Then, whenever you need to include something you can just use:
require_once MY_AWESOME_PLUGIN_PATH . '/includes/class-wc-payment-gateway-elavon.php';
In the longer run, if you have more classes you might want to explore using an autoloader instead.

I want to let others use my functions like registration password validation, email validation etc.. in php

I'm a php developer, whenever i'm creating a websites that contains a login/rgistration functionality, simply using few php functions and jquery ajax validation codes by including it to the working site. Now i have copied those reusing functions into a file and kept into my website somewhere, i have tried to access it but some error popped out as
"Warning: include() [function.include]: http:// wrapper is disabled in
the server configuration by allow_url_include=0 in
C:\xampp\htdocs\88db\vsm\admin\includes\functions.php"
and
"Warning: include() [function.include]: Failed opening
'http://desireit.in/codes/includes/resize.php' for inclusion
(include_path='.;C:\xampp\php\PEAR') in
C:\xampp\htdocs\88db\vsm\admin\includes\functions.php on line 9"
desireit.in is my website where i have kept the resize.php file which contains my reusable functions.
Please give me some advice regarding this problem.
You must use the path to the file you want to include, not the http:// location.
so your includes string could be something like:
<?php include($_SERVER['DOCUMENT_ROOT']."/includes/functions.php"); ?>
Where the path is adjusted to the correction location for your server files.
Be aware that $_SERVER['DOCUMENT_ROOT'] is not always set in some servers and may deliver unexpected results in others. Best to test before depending upon it.
If you do not get the expected results from the above, you can do this instead:
<?php include dirname(__FILE__) . '/your_path_to_the_include_file/includes.php';?>
Again, where the path is adjusted to the correction location for your server files.
You do have the option of enabling the ability to call include files with http:// in your PHP .ini file, but it creates security risks and delivers no real value as compared to the above solutions.

failed to open stream: no suitable wrapper could be found

hello i am implementing php files from one website into another and here is the following error message i am getting when trying to open the following page with implemented php files:
http://www.holidaysavers.ca/europe-destinations-canada.php
basically the php files i am importing from one website into another are identical , however they work on the original website but when i implement them into a new website it does not work anymore.
could you assist me in trying to get this resolved?
thank you
You can't include a PHP script that is on an external website/server into your local script - unless you enable allow_url_include on your php.ini (if you have access to it)
Instead, you can let that website/server render the page and get the resulting html output on your local script.
Replace this line in your script:
include('http://www.holidaysavers.ca/europe-canada.php?detour');
With this:
echo file_get_contents('http://www.holidaysavers.ca/europe-canada.php?detour');
Could you post the code from "europe-destinations-canada.php"? It looks like the script is asking to do stuff that's not configured in your php setup on this new site/server
I don't really know what kind of host you are using or if you are using Xampp, I do have an easy fix to it, for xampp and possibly other web server software. Go to your php.ini file, which you can search for or just look for it in c:\\xampp\php\php.ini, the php.ini should be in the php folder in the server software folder. Now search for allow_url_include in the php.ini file and than replace Off with On, if it isn't already on or something. This is most likely the fix because it worked for me.
I might be able to help further if I know if you are using a hosting or home server. If you are using a hosting website than please share what kind of hosting service you are using so I could inspect it further.
Using as example a random remote php file.
The goal is to use this remote file locally, make sure it hasn't change or be altered. The remote file will be downloaded one time only.
Hard coding the sha256 signature avoid to use the network on startup. This is just a base that can be turned to many scenarios, like checking for updates, depending your needs.
<?php
$lib_url = "https://raw.githubusercontent.com/getopt-php/getopt-php/master/src/CommandInterface.php";
$lib_filename = basename($lib_url);
// SHA256 signature
$lib_signature = hash_file("sha256",$lib_url); // "dba0b3fe70b52adbb8376be6a256d2cc371b2fe49ef35f0c6e15cd6d60c319dd"
// Hardcode the signature to avoid a network call on startup:
//$lib_signature = "dba0b3fe70b52adbb8376be6a256d2cc371b2fe49ef35f0c6e15cd6d60c319dd";
if (!is_file($lib_filename) || $lib_signature != hash_file("sha256",$lib_filename)){
// No local copy found, or file signature invalid, get a copy
copy($lib_url, $lib_filename);
}
require $lib_filename;
It is very useful if you intent to share a program as a single file, without composer.
For the case of a file hosted on Github, an ETag HTTP header is provided, it can be used to avoid to download the whole file.
php -r 'var_dump(json_decode(get_headers("https://raw.githubusercontent.com/getopt-php/getopt-php/master/src/CommandInterface.php", 1)["ETag"]));'
//string(64) "c0153dbd04652cc11cddb0876c5abcc9950cac7378960223cbbe6cf4833a0d6b"
The ETag HTTP response header is an identifier for a specific version
of a resource. It lets caches be more efficient and save bandwidth, as
a web server does not need to resend a full response if the content
has not changed.
Warning: include() [function.include]: URL file-access is disabled in the server configuration in /home/content/91/8151691/html/HolidaySavers.ca/europe-destinations-canada.php on line 52
says it all. I believe this is called XXS. It appears you're attempting to include a URL based file which is denied in your server configuration which is either one of two things.
You're attempting to include the file on site B from site A which you would then use instead of include('WhateverFile'); file_get_contents('WhateverFile'); however this will only return the client side data as it is an HTTP request;
You've duplicated the file on site B and forgot to update the domain configuration. Be sure that the include path reflects the site you're running the script on ie.
include(dir($_SERVER['SCRIPT_FILENAME']) . DIRECTORY_SEPARATOR . 'WhateverFile.php');
In any case. I would have to actually examine the line 52 on the said file to see why PHP is complaining to you in detail lol

PHP Suddenly stop searching for files in current directory

So I came up against something really strange today.
I've updated my PHP APC to the latest version and restarted apache. And then suddenly all scripts in apache starting complaining about not being able to find required files.
I would usually have:
require_once 'Abstract.php'
considering that Abstract.php is on the same directory as the other script.
The errors where:
PHP Warning:
require_once(Abstract.php) [function.require-once]:
failed to open stream: No such file or
directory in data.php on line 411 PHP
Fatal error: require_once() [function.require]:
Failed opening required 'Abstract.php'
(include_path='/var/www/application/../library:/var/www/library:.:/usr/share/php:/usr/share/pear')
in data.php on line 411
As you can see the current directory (.) is included in the include_path of the execution. Why did this happen? Has anyone seen it before?
AFAIK, the . denotes the directory where the PHP binary resides. require* and include* functions take into account the current working directory, which can be modified via chdir().
As was suggested by cwallenpoole, try using the __DIR__ constant:
require_once __DIR__ . '/Abstract.php';
If that also fails, it means there's a misconfiguration elsewhere. If it works, it probably means the current executing PHP thread has its working directory set to a different and you need to either change the current working directory or modify the require statements to use absolute paths.
Also, have you considered using an autoload callback? That way you have a single point of entry for searching for classes.
Ok, I figured it out eventually and though I should share in case anyone else gets in the same trouble as me.
I used to have APC 3.0.x and upgraded to 3.1.8. As it seems APC on 3.1.8 has a bug that breaks include/requires of PHP.
See relative link here: http://pecl.php.net/bugs/bug.php?id=22687
Thanks everyone for the quick feedback :)

Why am I getting include() and require() errors from one directory of my site and not another?

Total newbie here, so take it as you will...
I'm doing a site upgrade right now, and everything works fine except...
I have a WordPress installation in a subdirectory, and now that I've brought the main site live, I'm getting
include(/settings.php) [function.include]: failed to open stream: No such file or directory
and
include() [function.include]: Failed opening '/settings.php' for inclusion (include_path='.:')
on includes from within the subdirectory. I've played with setting different include_path settings, I know for sure the files are there (they are being included with no problems from the root directory), and I'm changed no permissions or anything during the rollout of the site.
Please let me know if this question is improper, or misplaced, or too vague, or what have you - first post after months of googling and lurking.
thanks in advance!
You're likely using php in a chrooted environment, so the root path of the server doesnt match that of the script.
Regarding the variables scope issue, could you post some sample code?
"/settings.php" points to the root of your server. It should be "settings.php" if it is on the same path and it should be in quotes.
Cheers
I would recommend adding define('WP_DEBUG', true); to your wp-config.php file and report back with more information. Make sure to undo this any you grab the info for debugging as having this on a live site could be a security risk. I just search my whole WP directory for include( "/settings.php" ); and could not find anything, which makes me think that it make be an issue with a plugin, theme, or other custom code. You could troubleshoot this by disabling all of your plugins, seeing if the site works again, and then painstakingly enabling your plugins individually until you find the culprit.
Does the error message you get point to a specific file and line number? That can help debug the problem.

Categories