PHP function putenv and WP Engine

As far as I’m aware the putenv() function is not used in our plugin. Definitely not in any of our own code and a search through all our code (including external libraries we use) doesn’t bring any occurrences of the putenv() function up either.

Does the email from WP Engine mention our plugin specifically? We’re hosted at WP Engine ourselves and have not received anything (yet).

Kind regards,
Brecht

I grabbed the copy of the plugin from my server and found a reference to ‘putenv’ commented out on Line #12 of:

/wp-ultimate-recipe/vendor/minify/min/lib/Minify/ClosureCompiler.php
/wp-ultimate-recipe/vendor/minify/min/lib/Minify/YUICompressor.php

/**
 * Compress Javascript using the Closure Compiler
 *
 * You must set $jarFile and $tempDir before calling the minify functions.
 * Also, depending on your shell's environment, you may need to specify
 * the full path to java in $javaExecutable or use putenv() to setup the
 * Java environment.
 *
 * <code>
 * Minify_ClosureCompiler::$jarFile = '/path/to/closure-compiler-20120123.jar';
 * Minify_ClosureCompiler::$tempDir = '/tmp';
 * $code = Minify_ClosureCompiler::minify(
 *   $code,
 *   array('compilation_level' => 'SIMPLE_OPTIMIZATIONS')
 * );
 *
 * --compilation_level WHITESPACE_ONLY, SIMPLE_OPTIMIZATIONS, ADVANCED_OPTIMIZATIONS
 *
 * </code>
 *
 * @todo unit tests, $options docs
 * @todo more options support (or should just passthru them all?)
 *
 * @package Minify
 * @author Stephen Clay <[email protected]>
 * @author Elan Ruusam?e <[email protected]>
 */

It’s also referenced in a very long array in:

/wp-ultimate-recipe/vendor/vafpress/public/js/vendor/ace/mode-php.js

Yes, I found those references as well, but that’s just text in comments, not actual usage of the function.

Did WP Engine mention anything about finding it in our plugin?

Brecht

Here’s a screenshot of the email, which looks automated. I’ve blacked out the name of the site.

https://www.dropbox.com/s/egf40d2xacyt186/Screenshot%202016-07-14%2020.20.07.png?dl=0

Thanks. They probably got triggered on the mention of the function in the comment.

Just to confirm: this will not impact our plugin at all since that function is not actually used.

Brecht

Yeah, thanks for the follow-up. I’m going to open a chat support ticket and let them know that this is a false positive.