RWall

Well spotted – thank you. I’ve updated to V4.9.4 and I’m pleased to say it went without a hitch and everything’s back to normal now.

So a thank-you from me to those who pointed everybody in the right direction, and especially to the WordPress maintainers too. I think I can mark this as resolved.

Have you any idea how solid that alpha version is?

I’ve no control over the PHP or PCRE version, and my hosting povider is going to get around to a fix some time early this year! So I’m torn between waiting for them and risking a running site with an alpha version. I’m running WordFence, so I’m not feeling paranoid, but at the same time I don’t want to stay with an old WordPress any longer than necessary.

But that’s nevertheless good information, thank you, and I’ll use it to try to poke them into action sooner rather than later.

.

@otto42

Samuel Wood (Otto) (@otto42)
www.ads-software.com Admin

Try doing a phpinfo and getting all the relevant versions for everything. PHP, PCRE, any libraries, anything with a version.

Here is what I hope is sufficient (and not enough to give hackers too much help):

PHP Version: 5.5.17
System: Linux lws03.ldn5.groupnbt.net 2.6.18-194.32.1.el5PAE #1 SMP Wed Jan 5 18:43:13 EST 2011 i686
Build Date: Sep 23 2014 13:43:39
PHP API: 20121113
PHP Extension: 20121212
Zend Extension: 220121212
Zend Extension Build: API220121212,NTS
PHP Extension Build: API20121212,NTS
cURL Information: 7.15.5
EXIF Version: 1.4
MySQL Client API version: 5.0.77
MySQLi Client API library version 5.0.77
OpenSSL Library Version: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
OpenSSL Header Version: OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
PCRE Library Version: 6.6 06-Feb-2006
Phar EXT version: 2.0.2
Phar API version: 1.1.1
SQLite Library: 3.8.4.3
SERVER_SOFTWARE: Apache/2.2.3 (CentOS)

• This reply was modified 7 years, 3 months ago by RWall.
• This reply was modified 7 years, 3 months ago by RWall.

We have a response from Easily. Not the best news, but at least something might happen:

Hello,

I would like to take this opportunity to apologise for the inconvenience caused.
We would like to advise you that Easily does not currently support the latest version of WordPress 4.9. Affected customers should therefore, not upgrade to WordPress 4.9 due to a risk that your websites will not work. We apologise for the inconvenience caused if you have already attempted to upgrade. Easily will be able to support WordPress Installation Version 4.9 in 2018 when we introduce our new service improvements in early 2018.

If you have attempted to upgrade to WordPress 4.9, we recommend you revert back to the previous version until we have confirmed we are able to support the new version.

Once again, we would like to take this opportunity to apologise for any inconvenience this may cause.

Regards,

[redacted]

• This reply was modified 7 years, 3 months ago by Marius L. J.. Reason: Removed personal contact details

@swansonphotos
Thank you for rejoining the discussion. I’m afraid some of your points are lost on me too. The issue appeared immediately I updated to V4.9 – therefore at first sight it had to be a problem either with the version or with the process of updating. When I found a similar (maybe identical) report in the other place, I posted here requesting help. Isn’t that part of the function of a forum? It certainly is over at OEM.

I reviewed the links in your post on page 1 but frankly, to me they seemed irrelevant. After all, I’m a user, not a developer or even a keen bodger, of WordPress.

As for your recent points:

1. Each time a major release is made available, the dashboard (along with well known site responsibilities), includes important warnings about backing up your site(s).

I saw someone make that mistake many decades ago, in the days of the PDP11 and 15″ platters. I run an automatic backup nightly.

2. www.ads-software.com is not your hosting provider. If a specific host has issues, please review the hosting recommendations.

Nobody ever said www.ads-software.com is a hosting provider, and only when it became clear that mainly, maybe only, sites hosted at Easily were having problems (and I for one am grateful to the www.ads-software.com forum for providing this platform) was it becoming evident that there was some degree of certainty that the fault might lie with a specific hosting provider. Before then, it was experience or an educated guess – and there’s nothing wrong with either, but they’re insufficient to apportion blame.

3. If you think this is an issue with a WordPress Plugin, then the proper support channel for help with such issues is at their support page. A simple search will find the plugin of question.

I think I actually ruled out a plug-in fairly early on.

Please help yourself and your site clients by finding a web host that starts with Job One (Security).

I can’t find the hosting provider Job One. The hosting I use has functioned satisfactorily with WordPress for about 7 years, so what changed?

WordPress is not based simply on files. Simply changing a set of files does not affect the MySQL DB. Please all review the Codex for proper details. It’s also not new.

My understanding of WordPress is it is a huge piece of PHP, spread across very many files, that uses MySQL to manage the data. Once again, I don’t think anyone has mentioned MySQL until now, and I’m struggling to see how it is relevant. Where in the Codex should I start looking?

@crkm
It does look as if you’ve found the problem, but my Easily is running PHP 5.5.17, and according to the way I (hurriedly) read the manual earlier, it appears that it should accept both versions. The comment in your snippet is revealing: “however the above form is recommended for backwards compatibility”.

Having our own version of one file is fundamentally wrong and dangerous, so I’m still looking to the maintainer of wp-db.php and to Easily for a proper solution, and won’t implement your patch just yet.

Very interestingly, Wordfence is reporting a directory traversal attack on the faulty file – attacks started on 18th November at 21:23 and continued over the weekend and today.

My update too seemed suspect, but it didn’t leave the “maintenance” file behind. I’ve no idea whether the ‘no content’ (from memory ?) parameter uploads everything that t-p instructed, or whether it is more selective, so I don’t think the time it took is a reliable indication.

My site owner says she has just raised a ticket too.

@pete5000
I get the impression that a fix from www.ads-software.com is unlikely, even though it looks very much like a backwards-compatibility issue.

My personal recommendation is to download V4.8.3 from https://www.ads-software.com/wordpress-4.8.3.zip, and upload to your site the directories wp-admin, wp-includes and the root files but excluding your wp-config.php and your wp-content directory, as t-p instructed for V4.9 on page 1 of this thread.

Can everyone then please raise a ticket with Easily and refer them to this thread, as there’s strength in numbers.

@crkm
Can you raise a ticket with Easily? I can’t because the owner has changed the control panel password and hasn’t come back to me yet with the new one. You can point them to https://www.hannahleightonboyce.com if it helps (not that it’s likely to as we have the identical problem).

@crkm
You’re not “drt102” who asked at the WordPress.com forum and got told to go away? If you aren’t, then there are three known instances of this problem, and it’s hard to believe that three of us use the same hosting provider, or are using the hosting providers that send the same wrongly constructed headers.
I use Easily.co.uk.

[Edit]
I wrote “three known instances” – wrong! Try a Google search for “wp-db.php on line 1657”.
There are at least 5 more instances there – that weren’t there when I first posted. So they are crawling out of the woodwork as more people update, and it’s not quite as isolated as first appeared.

• This reply was modified 7 years, 3 months ago by RWall.

@crkm

Have gone back to 4.8.3 by replacing wp-admin and wp-includes directories along with wp-settings.php with the 4.8.3 equivalents.

That’s exactly what I had to do.

I’m one of the moderators of the community forum over at https://www.openenergymonitor.org, and there I think I can rightly say that we go a little further in our efforts to help people who are struggling with something that is foreign to them, that they don’t fully understand.

I’m a Chartered Engineer, not a programmer. I know a little PHP, but I don’t have – and honestly I don’t have the time to acquire – the in-depth knowledge of WordPress that’s likely to be required to untangle this. Like you, I’ve been forced to take the safe (but I hope, temporary) option of reverting to the working version. What I don’t want to do is waste time and effort to convert to one of the other CMS offerings, so I’m hoping that someone else will see this and be able to help.

(And over at OEM, I just dive in and tidy up the posts for those who haven’t learned all the presentation tricks – and we don’t berate the poster. I quite often correct spelling and grammatical mistakes too – particularly, but not exclusively, for those whose first language is not English.)

Can you review with your host, your install with the issue, that nothing is affected the referrer headers?

I’ve changed nothing there – are you saying that the hosting company has added/changed the header and it was compatible with V4.8.3 and it’s incompatible with V4.9?

I don’t think it’s a PHP version issue

I concur. I looked at the PHP manual and sprintf is in V5 upwards, and no mention of any change.

You may want to move to a host that offers PHP 7 regardless of the outcome of this issue.

I don’t own the site, I only maintain it technically; so that’s not an option.

So, having replaced everything with the V4.9 versions (except as noted), disabled all plugins and running on the Twenty Seventeen Theme, I’ve still got the problem.

I did have a “dummy” V4.9 running locally with the database but without any content, and that appeared to be ‘clean’. Whether that reinforces @crkm’s suggestion of a PHP version issue, I don’t know enough PHP to say.

[Edit]
I’m not sure what you were saying about mics.php The V4.9 version has, and V4.8.3 does not have, the function wp_admin_headers() which is where the error is being generated at line 1114: “header( sprintf( ‘Referrer-Policy: %s’, $policy ) );”

• This reply was modified 7 years, 3 months ago by RWall. Reason: Addition

However, it would be better to solve your current problem.

I agree totally. I downloaded the content and I shall set up WordPress V4.9 locally and see if I can reproduce the problem, meanwhile thank you all for the suggestions. If the local install does not show the fault, then I’ll try as you suggest.

Could this be a php version issue?

That’s surely one to consider. The version I have is 5.5.17 (but I cannot control that – that’s set by the hosting). Locally, I have 7.0.22.

Thanks, but I tried that – it provoked even more reports from different places of the same error. V4.8.3 is now re-loaded and showing no error.