Conmfig.php rewritten incorrectly

  • Resolved chaa_OKC

    (@chaa_okc)


    9 years, 2 months ago

    Your “debug” plugin seems to fill a need that I have (for easy toggling of debug moide while customizing templates on several sites), but I have not yet been able to get it to work at my test site on localhost.

    Initially, it prevented me from logging into the site after the first time I saved the settings. Changing the permissions in the “chmod” line of functions.php from 0600 to 0644 cured that problem, apparently due to the fact that the copy written by the plugin was owned by “root” rather than by “www.data” as are the other files in my document root directory. Since the debianized config.php wound up in a non-standard location, I’ve had permissions problems with much of WordPress which is why I made “www-data” the owner of all the configuration files.

    However today I ran into another problem that has me puzzled: what follows is the entire report after I attempted to save the settings. I’ve added “—>” markers in the left margin to indicate what it’s doing wrong. Apparently the “add_option” function is not locating the correct spot to make its changes!

    Debug Settings

    Warning: error_log(/usr/share/wordpress/wp-config.php): failed to open stream: Permission denied in /usr/share/wordpress/wp-content/plugins/debug/functions/function.php on line 12

    Your wp-config file not updated. Copy and paste following code in your wp-config.php file.

    <?php
    /***
    * WordPress’s Debianised default master config file
    * Please do NOT edit and learn how the configuration works in
    * /usr/share/doc/wordpress/README.Debian
    ***/

    /* Look up a host-specific config file in
    * /etc/wordpress/config-<host>.php or /etc/wordpress/config-<domain>.php
    */
    $debian_server = preg_replace(‘/:.*/’, “”, $_SERVER[‘HTTP_HOST’]);
    $debian_server = preg_replace(“/[^a-zA-Z0-9.\-]/”, “”, $debian_server);
    $debian_file = ‘/etc/wordpress/config-‘.strtolower($debian_server).’.php’;
    /* Main site in case of multisite with subdomains */
    $debian_main_server = preg_replace(“/^[^.]*\./”, “”, $debian_server);
    $debian_main_file = ‘/etc/wordpress/config-‘.strtolower($debian_main_server).’.php’;

    if (file_exists($debian_file)) {
    require_once($debian_file);
    define(‘DEBIAN_FILE’, $debian_file);
    } elseif (file_exists($debian_main_file)) {
    require_once($debian_main_file);
    define(‘DEBIAN_FILE’, $debian_main_file);
    } elseif (file_exists(“/etc/wordpress/config-default.php”)) {
    require_once(“/etc/wordpress/config-default.php”);
    define(‘DEBIAN_FILE’, “/etc/wordpress/config-default.php”);
    } else {
    header(“HTTP/1.0 404 Not Found”);
    echo “Neither <b>$debian_file</b> nor <b>$debian_main_file</b> could be found.
    Ensure one of them exists, is readable by the webserver and contains the right password/username.”;
    exit(1);
    }

    /* debugging settings added 8-23-2015 jk
    change line 35 to enable/disable debugging. */
    define(‘WP_DEBUG’, true);
    define(‘WP_DEBUG_DISPLAY’, WP_DEBUG);
    define(‘WP_DEBUG_LOG’, WP_DEBUG);
    define(‘SCRIPT_DEBUG’, WP_DEBUG);
    define(‘SAVEQUERIES’, false);

    /* Default value for some constants if they have not yet been set
    by the host-specific config files */
    if (!defined(‘ABSPATH’))
    define(‘ABSPATH’, ‘/usr/share/wordpress/’);
    if (!defined(‘WP_CORE_UPDATE’))
    define(‘WP_CORE_UPDATE’, false);
    if (!defined(‘WP_ALLOW_MULTISITE’))
    define(‘WP_ALLOW_MULTISITE’, true);
    if (!defined(‘DB_NAME’))
    define(‘DB_NAME’, ‘wordpress’);
    if (!defined(‘DB_USER’))
    define(‘DB_USER’, ‘wordpress’);
    if (!defined(‘DB_HOST’))
    define(‘DB_HOST’, ‘localhost’);
    if (!defined(‘WP_CONTENT_DIR’) && !defined(‘DONT_SET_WP_CONTENT_DIR’))
    define(‘WP_CONTENT_DIR’, ‘/var/lib/wordpress/wp-content’);

    –> /* Default value for the table_prefix variable so that it doesn’t need to
    –> be put in every host-specific config file */
    –> if (!isset(define(‘WP_DEBUG_LOG’, true);
    –> define(‘WP_DEBUG_DISPLAY’, true);
    –> $table_prefix)) {
    –> define(‘WP_DEBUG_LOG’, true);
    –> define(‘WP_DEBUG_DISPLAY’, true);
    –> $table_prefix = ‘wp_’;
    –> }

    define( ‘WP_POST_REVISIONS’, 5 );

    if (isset($_SERVER[‘HTTP_X_FORWARDED_PROTO’]) && $_SERVER[‘HTTP_X_FORWARDED_PROTO’] == ‘https’)
    $_SERVER[‘HTTPS’] = ‘on’;

    require_once(ABSPATH . ‘wp-settings.php’);
    define(‘FS_METHOD’, ‘direct’);
    ?>

    https://www.ads-software.com/plugins/debug/

Viewing 4 replies - 1 through 4 (of 4 total)

  • Changing the permissions in the “chmod” line of functions.php from 0600 to 0644 cured that problem

    That sounds like a poor idea. Your database password is stored in wp-config.php. Making that file world-readable creates a security gap.

    apparently due to the fact that the copy written by the plugin was owned by “root” rather than by “www.data”

    This means WordPress, running under PHP running under Apache, is running as root. Which is a giant security issue. The web user should be www.data.

    Thread Starter chaa_OKC

    (@chaa_okc)

    I agree that this would be a huge security issue, were the site in contact with the outside world at all. However, it’s a test site, on a system that does not allow ANY new incoming traffic on Port 80, and it’s configured to forbid any connection to the Apache server other than by “localhost” — not even from the other machine on my tiny LAN.

    I’m fairly new to Apache configuration, so haven’t yet learned how to verify which user the server runs as. I’d appreciate tips on how to check this, and configure it properly. (I’m quite comfortable at the command line, and even working inside the kernel code.) Once I get past the ownership problem I’ll definitely configure the document root directory and all its contents to be properly owned, and will then be able to set permissions back to 0600.

    Meanwhile, the failure to replace the existing DEBUG control lines, and putting them into the table_prefix definition instead, remains the primary puzzle!

    Thanks very much for the quick response!

    Thread Starter chaa_OKC

    (@chaa_okc)

    Thanks to Jason’s comment, I’ve spent the past several hours verifying that Apache is NOT running as root, then checking ownership of all files in my /usr/share/wordpress directory. It turns out that more than half of them were owned by root; this was apparently the cause of my permissions problem.

    That probably happened because I originally installed WordPress from the Ubuntu repository, which meant I had a woefully out-of-date copy. To update it I had to run manual updating via “sudo” which caused the new copy to be owned by root.

    A “chown -R” to the wordpress directory made everything consistent again, and when I tried the Debug plugin again, it reported success.

    Unfortunately, it still put two superfluous lines into the “table_prefix” definition. Detailed analysis of the functions involved indicates that the count of replacements is zero, and the code that’s executed in that case looks extremely suspicious. Is there really any reason for the plugin to be making changes involving $table_prefix?

    Thread Starter chaa_OKC

    (@chaa_okc)

    Replacing “$table_prefix” two places in line 76 of function.php fixed the problem. Line 76 now reads:

    $fileContent = str_replace(‘/* Default value for the table_prefix’, “define(‘”.$define.”‘, true);” . “\r\n” . ‘/* Default value for the table_prefix’, $fileContent);

    I chose that phrase for the insertion point because it only appears once and isn’t a parameter to a function; any other unique string that begins a line before the call to “wp_settings.php” should work as well, however.

    I’m tagging this thread as resolved, but I do hope for an official update of the plugin soon, to prevent others from having such an unusual problem. What caused it to surface for me was that I had replaced the “true”/”false” parameters in all the constants following WP_DEBUG itself with a reference to WP_DEBUG, to minimize the num ber of changes I had to make manually — and this caused the count of 0 on each call to debug_add_option after the first!

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Conmfig.php rewritten incorrectly’ is closed to new replies.