Strange Error in Logs

[Robert]

Hi Guys

I am using BB 4.0.8 with a child theme. I am getting this error in my logs that I am trying to chase down. Any ideas?

12/18/2014 12:46:46 AM - www: PHP Warning: getimagesize(): http:// wrapper is disabled in the server configuration by allow_url_fopen=0 in /var/www/lightstalking.com/wp-content/themes/buddyboss/buddyboss-inc/theme-functions.php on line 918

Now, when I was talking to my host (Websynthesis), I did get this reply which might be a clue?

– You will want to verify with the buddyboss plugin author because the url_fopen function has been disabled on Synthesis hosting for security reasons.

We do support CURL as an alternative to url_fopen. Your plugin author should know if they are using these functions or not.

Any ideas?

[Alyssa]

@straniero we need url_fopen on, WordPress does not use curl. I suggest changing hosts, most hosts will allow you to turn this on.

[Robert]

Thanks @tjchester – What does it actually do / allow?

[Alyssa]

@straniero This option enables the URL-aware fopen wrappers that enable accessing URL object like files.

If enabled, allow_url_fopen allows PHP’s file functions — such as file_get_contents() and the include and require statements — can retrieve data from remote locations, like an FTP or web site. Programmers frequently forget this and don’t do proper input filtering when passing user-provided data to these functions, opening them up to code injection vulnerabilities. A large number of code injection vulnerabilities reported in PHP-based web applications are caused by the combination of enabling allow_url_fopen and bad input filtering.

[Robert]

Ok, thanks. So seeing as my host blocks it, and seeing as the site still seems to work properly (other than the serve errors) I have 2 more questions.

1) Is it possible to remove it from Buddyboss?
2) Would removing it have any effects for users that are not already apparent?

Thanks for your help on this as I am between a rock and a hard place here.

[Robert]

PS – I am with WebSynthesis who have been amazing (I have tried about 15 hosts in the past) and are specifically a WordPress host.

[Robert]

Alternatively, is it feasible (or possible) to get my coder to change the theme from using url_fopen to CURL?

[Alyssa]

@straniero this is a WordPress function we just so happen to use. I’m not sure of the full extent of not being able to use it. I think you may need to contact WordPress support so see if there is an alternative.

[Robert]

In how many files in Buddyboss is it used?

[Robert]

Too hard I guess.

Seems both you guys and my host are happy to throw me in that basket.

[Alyssa]

@straniero sorry, I did respond, not sure why it didn’t post.
It is in one buddyboss file: buddyboss-inc/theme-functions.php
BuddyPress has it located in 4 files, and I’m not sure how many files WordPress uses.

[Robert]

Thanks TJ. Sorry for being grumpy.

[Alyssa]

No problem, I know how frustrating web design and coding can be 🙂