search

10up / safe-svg

Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.
https://wordpress.org/plugins/safe-svg/
GNU General Public License v2.0
276 stars 32 forks source link

All wp-cli commands break since v2.1.0 #118

Closed marcoluzi closed 8 months ago

marcoluzi commented 1 year ago

Describe the bug

All wp-cli commands fail with safe-svg >= v2.1.0 installed due to call to undefined function SafeSvg\Blocks\setup().

This is the full error message:

Fatal error: Uncaught Error: Call to undefined function SafeSvg\Blocks\setup() in /Users/marco/repos/valet/lumiere-starter-theme/wp-content/plugins/safe-svg/safe-svg.php:151
Stack trace:
#0 /Users/marco/repos/valet/lumiere-starter-theme/wp-includes/class-wp-hook.php(308): SafeSvg\safe_svg->setup_blocks('')
#1 /Users/marco/repos/valet/lumiere-starter-theme/wp-includes/class-wp-hook.php(332): WP_Hook->apply_filters(NULL, Array)
#2 /Users/marco/repos/valet/lumiere-starter-theme/wp-includes/plugin.php(517): WP_Hook->do_action(Array)
#3 /Users/marco/repos/valet/lumiere-starter-theme/wp-settings.php(623): do_action('init')
#4 phar:///opt/homebrew/Cellar/wp-cli/2.7.1/bin/wp/vendor/wp-cli/wp-cli/php/WP_CLI/Runner.php(1336): require('/Users/marco/re...')
#5 phar:///opt/homebrew/Cellar/wp-cli/2.7.1/bin/wp/vendor/wp-cli/wp-cli/php/WP_CLI/Runner.php(1254): WP_CLI\Runner->load_wordpress()
#6 phar:///opt/homebrew/Cellar/wp-cli/2.7.1/bin/wp/vendor/wp-cli/wp-cli/php/WP_CLI/Bootstrap/LaunchRunner.php(28): WP_CLI\Runner->start()
#7 phar:///opt/homebrew/Cellar/wp-cli/2.7.1/bin/wp/vendor/wp-cli/wp-cli/php/bootstrap.php(78): WP_CLI\Bootstrap\LaunchRunner->process(Object(WP_CLI\Bootstrap\BootstrapState))
#8 phar:///opt/homebrew/Cellar/wp-cli/2.7.1/bin/wp/vendor/wp-cli/wp-cli/php/wp-cli.php(32): WP_CLI\bootstrap()
#9 phar:///opt/homebrew/Cellar/wp-cli/2.7.1/bin/wp/php/boot-phar.php(11): include('phar:///opt/hom...')
#10 /opt/homebrew/Cellar/wp-cli/2.7.1/bin/wp(4): include('phar:///opt/hom...')
#11 {main}
  thrown in /Users/marco/repos/valet/lumiere-starter-theme/wp-content/plugins/safe-svg/safe-svg.php on line 151

Steps to Reproduce

  1. Install and activate safe-svg v2.1.0 or above.
  2. Run any wp-cli command in the terminal.

Screenshots, screen recording, code snippet

No response

Environment information

WordPress information

Site Health info: ### wp-core ### version: 6.2 site_language: en_US user_language: en_US timezone: Europe/Zurich permalink: /%postname%/ https_status: true multisite: false user_registration: 0 blog_public: 0 default_comment_status: undefined environment_type: production user_count: 1 dotorg_communication: true ### wp-paths-sizes ### wordpress_path: /Users/marco/repos/valet/lumiere-starter-theme wordpress_size: loading... uploads_path: /Users/marco/repos/valet/lumiere-starter-theme/wp-content/uploads uploads_size: loading... themes_path: /Users/marco/repos/valet/lumiere-starter-theme/wp-content/themes themes_size: loading... plugins_path: /Users/marco/repos/valet/lumiere-starter-theme/wp-content/plugins plugins_size: loading... database_size: loading... total_size: loading... ### wp-active-theme ### name: Lumiere Theme (lumiere-starter-theme) version: 3.2.0 author: Marco Luzi author_website: (undefined) parent_theme: none theme_features: widgets-block-editor, automatic-feed-links, title-tag, post-thumbnails, editor-styles, html5, editor-style, menus theme_path: /Users/marco/repos/valet/lumiere-starter-theme/wp-content/themes/lumiere-starter-theme auto_update: Disabled ### wp-themes-inactive (3) ### Twenty Twenty-One: version: 1.8, author: the WordPress team, Auto-updates disabled Twenty Twenty-Three: version: 1.1, author: the WordPress team, Auto-updates disabled Twenty Twenty-Two: version: 1.4, author: the WordPress team, Auto-updates disabled ### wp-plugins-active (6) ### Advanced Custom Fields PRO: version: 6.1.3, author: WP Engine, Auto-updates disabled Ghost Kit: version: 2.25.0, author: Ghost Kit Team, Auto-updates disabled Loco Translate: version: 2.6.4, author: Tim Whitlock, Auto-updates disabled Safe SVG: version: 2.1.1, author: 10up, Auto-updates disabled Simple Custom Post Order: version: 2.5.6, author: Colorlib, Auto-updates disabled Yoast SEO: version: 20.3, author: Team Yoast (latest version: 20.4), Auto-updates disabled ### wp-media ### image_editor: WP_Image_Editor_GD imagick_module_version: Not available imagemagick_version: Not available imagick_version: Not available file_uploads: File uploads is turned off post_max_size: 512M upload_max_filesize: 512M max_effective_size: 512 MB max_file_uploads: 20 gd_version: 2.3.3 gd_formats: GIF, JPEG, PNG, WebP, BMP, AVIF, XPM ghostscript_version: not available ### wp-server ### server_architecture: Darwin 21.6.0 arm64 httpd_software: nginx/1.23.3 php_version: 8.1.17 64bit php_sapi: fpm-fcgi max_input_variables: 1000 time_limit: 30 memory_limit: 512M max_input_time: 60 upload_max_filesize: 512M php_post_max_size: 512M curl_version: 7.88.1 (SecureTransport) OpenSSL/1.1.1t suhosin: false imagick_availability: false pretty_permalinks: true ### wp-database ### extension: mysqli server_version: 10.11.2-MariaDB client_version: mysqlnd 8.1.17 max_allowed_packet: 16777216 max_connections: 151 ### wp-constants ### WP_HOME: undefined WP_SITEURL: undefined WP_CONTENT_DIR: /Users/marco/repos/valet/lumiere-starter-theme/wp-content WP_PLUGIN_DIR: /Users/marco/repos/valet/lumiere-starter-theme/wp-content/plugins WP_MEMORY_LIMIT: 40M WP_MAX_MEMORY_LIMIT: 512M WP_DEBUG: true WP_DEBUG_DISPLAY: false WP_DEBUG_LOG: true SCRIPT_DEBUG: true WP_CACHE: false CONCATENATE_SCRIPTS: undefined COMPRESS_SCRIPTS: undefined COMPRESS_CSS: undefined WP_ENVIRONMENT_TYPE: Undefined DB_CHARSET: utf8 DB_COLLATE: undefined ### wp-filesystem ### wordpress: writable wp-content: writable uploads: writable plugins: writable themes: writable

Code of Conduct

dkotter commented 1 year ago

@marcoluzi Thanks for the report. Is there a certain WP-CLI command you're testing? I just spun up a new site running WP 6.2 and PHP 8.1.9 and I ran a few core WP-CLI commands (like wp core version and wp plugin list) and did not run into any errors.

marcoluzi commented 1 year ago

@dkotter Just checked again. wp core version workes with a deprecated message. Deprecated: file_get_contents(): Passing null to parameter #2 ($use_include_path) of type bool is deprecated in phar:///opt/homebrew/Cellar/wp-cli/2.7.1/bin/wp/vendor/wp-cli/core-command/src/Core_Command.php on line 929. Probably not related.

wp plugin list results in the same error message as statet in the issue above. So does wp media regenerate --yes.

wp help works, but after quitting out of the help panel the same error is displayed.

marcoluzi commented 1 year ago

I did some further debugging. Maybe this helps.

I put some var_dump() and function_exists() inside the the safe-svg source code to compare outputs between the CLI environment and the laravel valet environment. The function is actually defined in the CLI environment after line 104. https://github.com/10up/safe-svg/blob/0c211bd5fb11a59c559e55ad2b9534f4fbd7447f/safe-svg.php#L104

If I do the same check inside the setup_blocks() method, the setup() function is undefined. https://github.com/10up/safe-svg/blob/0c211bd5fb11a59c559e55ad2b9534f4fbd7447f/safe-svg.php#L144

I removed my custom theme, activated twentytwentyone and deactivated all other plugins. Still doesn't work so we can rule that out.

I tested this on my work MacBook and didnt recieve any the error message. The development setup is identical. My work MacBook is a MacBook Pro 2021 with macOS 12.6.5.

This is the output of wp --info on the "faulty" computer.

OS: Darwin 21.6.0 Darwin Kernel Version 21.6.0: Mon Dec 19 20:44:01 PST 2022; root:xnu-8020.240.18~2/RELEASE_X86_64 x86_64
Shell:  /usr/local/bin/fish
PHP binary: /usr/local/Cellar/php@8.1/8.1.17/bin/php
PHP version:    8.1.17
php.ini used:   /usr/local/etc/php/8.1/php.ini
MySQL binary:   /usr/local/bin/mysql
MySQL version:  mysql  Ver 15.1 Distrib 10.11.2-MariaDB, for osx10.17 (x86_64) using  EditLine wrapper
SQL modes:  STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
WP-CLI root dir:    phar://wp-cli.phar/vendor/wp-cli/wp-cli
WP-CLI vendor dir:  phar://wp-cli.phar/vendor
WP_CLI phar path:   /Users/marco
WP-CLI packages dir:
WP-CLI cache dir:   /Users/marco/.wp-cli/cache
WP-CLI global config:
WP-CLI project config:
WP-CLI version: 2.7.1

This is the output on the work computer.

OS:     Darwin 21.6.0 Darwin Kernel Version 21.6.0: Thu Mar  9 20:12:21 PST 2023; root:xnu-8020.240.18.700.8~1/RELEASE_ARM64_T6000 arm64
Shell:  /opt/homebrew/bin/fish
PHP binary:     /opt/homebrew/Cellar/php@8.1/8.1.18/bin/php
PHP version:    8.1.18
php.ini used:   /opt/homebrew/etc/php/8.1/php.ini
MySQL binary:   /opt/homebrew/bin/mysql
MySQL version:  mysql  Ver 15.1 Distrib 10.11.2-MariaDB, for osx10.17 (arm64) using  EditLine wrapper
SQL modes:      STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
WP-CLI root dir:        phar://wp-cli.phar/vendor/wp-cli/wp-cli
WP-CLI vendor dir:      phar://wp-cli.phar/vendor
WP_CLI phar path:       /Users/marco/repos/valet/hygieneforum/wp-content/themes/hygieneforum
WP-CLI packages dir:
WP-CLI cache dir:       /Users/marco/.wp-cli/cache
WP-CLI global config:
WP-CLI project config:
WP-CLI version: 2.7.1
pabamato commented 8 months ago

Hello @marcoluzi, I'm unable to replicate the error reported. Since you are not getting the error in a different machine and the same setup, everything indicates this is related to your local setup and not to the safe-svg plugin code.

Please re-test the latest plugin version and let us know if you are still experiencing the same error.

Thanks!

marcoluzi commented 8 months ago

Seems to be fixed with the version I am currently running.