search

ThemeFuse / Unyson

A WordPress framework that facilitates the development of WP themes
http://unyson.io
926 stars 220 forks source link

Critical PHP Issue: An active PHP session was detected. #4048

Open jmhmedia opened 4 years ago

jmhmedia commented 4 years ago

I'm getting the following error in my Site Health settings. After deactivating ALL plugins and reactivating one by one, I found that Unyson is the culprate.

A PHP session was created by a session_start() function call. This interferes with REST API and loopback requests. The session should be closed by session_write_close() before making any HTTP requests.

jeremyJJB commented 4 years ago

I have the exact same issue with WP 5.5.1 and Unyson 2.7.24

wholthof commented 4 years ago

And I have the exact same issue with WP 5.5.1 and Unyson 2.7.24 and have remove Unyson than no problem. Please give me the solution

franckadil commented 4 years ago

Can Reproduce on latest 2.7.24: A PHP session was created by a session_start() function call. This interferes with REST API and loopback requests. The session should be closed by session_write_close() before making any HTTP requests.

franckadil commented 4 years ago

@jmhmedia , @jeremyJJB , @wholthof Hi guys, I made some pull requests, please review and suggest corrections if you can:

4052

4051

The best,

wholthof commented 4 years ago

Hi,

I have modify the 2 files but now I canot startup the website.

After I change to the old situation I can startup my website

Please give a good tested update from Unyson.

Met vriendelijke groeten,

Wim Holthof

Deurzerdiep 30 | 8032 NA | Zwolle ................................................................ Wim Holthof ' 06 112 39503 E-mail: mailto:wholthof@home.nl wholthof@home.nl

Van: Franck Adil Koumba [mailto:notifications@github.com] Verzonden: vrijdag 11 september 2020 16:42 Aan: ThemeFuse/Unyson Unyson@noreply.github.com CC: wholthof wholthof@home.nl; Mention mention@noreply.github.com Onderwerp: Re: [ThemeFuse/Unyson] Critical PHP Issue: An active PHP session was detected. (#4048)

@jmhmedia https://github.com/jmhmedia , @jeremyJJB https://github.com/jeremyJJB , @wholthof https://github.com/wholthof Hi guys, I made some pull requests, please review and suggest corrections if you can:

4052 https://github.com/ThemeFuse/Unyson/pull/4052

4051 https://github.com/ThemeFuse/Unyson/pull/4051

The best,

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ThemeFuse/Unyson/issues/4048#issuecomment-691136246 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AQ5IBX7ENCDCT4TWO36Z5YDSFIZL7ANCNFSM4QZPQIOQ . https://github.com/notifications/beacon/AQ5IBXZZH2UVNMRR5KMX4L3SFIZL7A5CNFSM4QZPQIO2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOFEY6N5Q.gif

wholthof commented 4 years ago

Hi, I have modify the 2 files but now I canot startup the website. After I change to the old situation I can startup my website Please give a good tested update from Unyson.

jeremyJJB commented 4 years ago

@franckadil I took a look at the code it looks like everything is closed. Full disclosure I'm not an expert in PHP or WP plugin dev. Going off what @wholthof mentioned in his previous comment, it seems that one too many sessions have been closed since the site would not load but I'm not sure. Thank you for taking the initiative on this. I've been having a lot of headaches with Unyson lately.

wholthof commented 4 years ago

My workarround is add in below in themes/xxxx/funtions.php if (!function_exists('_disable_fw_use_sessions')) { add_filter('fw_use_sessions','_disable_fw_use_sessions'); function _disable_fw_use_sessions(){ return false; } }

AGAIN THE URGENT REQUEST THAT UNYSON RELEASES AN UPDATE ASAP !!!!!!!

wholthof commented 3 years ago

Please can you tell me when Unyson release an update!!!

marymaru commented 3 years ago

Same here:

An active PHP session was detected. A PHP session was created by a session_start() function call. This interferes with REST API and loopback requests. The session should be closed by session_write_close() before making any HTTP requests.

I've talked to my web host and they've confirmed it's the Unyson plugin that's initiating the session. When they deactivated the plugin (and crashed my site) the PHP error disappeared. I tried deleting Unyson and then reinstalling on a dev site and it caused massive corruption to my site.

@wholthof workaround 👍🏻 thanks! Adding to the urgent requests for a Unyson update.

Ataurr commented 3 years ago

@valeriuzdrobau @andreiglingeanu @ViorelEremia @GheorgheP @llemurya @sergiu-radu Can you Please release an update with this fix?

@franckadil sent a pull request with the fix.

luseju commented 3 years ago

Hi! I'm having the same error, and now I can't access into my WP site.

corzel commented 3 years ago

I fixed it adding: session_write_close(); in lines 231 and 262 in this file: wp-content/plugins/unyson/framework/includes/hooks.php


229: session_start();
230: }
231: session_write_close();
232: }
wholthof commented 3 years ago

WHY DOES UNYSON NOT ISSUE AN UPDATE THAT SOLVES THIS PROBLEM ??? Surely this is not always the case that everyone is looking for a solution. Unyson come up with that Update

CMRD77 commented 3 years ago

Is there any solution or update yet?.

"A PHP session was created by a session_start() function call. This interferes with REST API and loopback requests. The session should be closed by session_write_close() before making any HTTP requests."

apatsidis123 commented 3 years ago

Same here, is December and Unyson Still didnt fix that issue? come on guys its a security issue are you serius? So many Themes are dependent from that, please fix your issues!

yaaax commented 3 years ago

Same here. From what I understand, Unyson plugin uses the session to store "Flash messages". See file /framework/helpers/class-fw-flash-messages.php:

Store messages in session (to not be lost between redirects) and remove them after they were shown to the user

Some useful links :

@ViorelEremia you seem to be the developer who would know the best how to rework this Flash Messages mechanism without sessions (see "Unyson not playing nice with Varnish-caching") You actually introduced the workaround to disabled sessions : "add hook to disable sessions".

I think it's time for your bosses to give you some time to think about a rework :) Have a great New Year's Eve.

Cheers

EddiebNZ commented 3 years ago

It's February 2021 and still no fix.

jascha030 commented 3 years ago

We are still experiencing this issue. Any activity still going on here? And if not, is there a possibility to implement a fix and make a pullrequest ourselves?

wholthof commented 3 years ago

Hey

Onderstaande heb ik nu na aanpassing in hooks.php op aktief

in lines 231 and 262 in this file: wp-content/plugins/unyson/framework/includes/hooks.php

229: session_start();

230: }

231: session_write_close();

232: }

Maar blijft een workarround en snap niet waarop er geen update komt

Met vriendelijke groeten,

Wim Holthof

Deurzerdiep 30 | 8032 NA | Zwolle ................................................................ Wim Holthof ' 06 112 39503 E-mail: mailto:wholthof@home.nl wholthof@home.nl

Van: Jascha van Aalst notifications@github.com Verzonden: vrijdag 5 maart 2021 16:25 Aan: ThemeFuse/Unyson Unyson@noreply.github.com CC: wholthof wholthof@home.nl; Mention mention@noreply.github.com Onderwerp: Re: [ThemeFuse/Unyson] Critical PHP Issue: An active PHP session was detected. (#4048)

We are still experiencing this issue. Any activity still going on here? And if not, is there a possibility to implement a fix and make a pullrequest ourselves?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ThemeFuse/Unyson/issues/4048#issuecomment-791488863 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AQ5IBX4ZHBVF3XCJW4K4EADTCDZVTANCNFSM4QZPQIOQ . https://github.com/notifications/beacon/AQ5IBX5OP2NYM5CTSJQDNJ3TCDZVTA5CNFSM4QZPQIO2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOF4WSSXY.gif

corzel commented 3 years ago

This is the new (official) fix Click here https://github.com/ThemeFuse/Unyson/pull/4052/commits/da578e754381632b27289be3d92c1a3cc7f1d14f .

El vie, 5 de mar. de 2021 a la(s) 11:05, wholthof (notifications@github.com) escribió:

Hey

Onderstaande heb ik nu na aanpassing in hooks.php op aktief

in lines 231 and 262 in this file: wp-content/plugins/unyson/framework/includes/hooks.php

229: session_start();

230: }

231: session_write_close();

232: }

Maar blijft een workarround en snap niet waarop er geen update komt

Met vriendelijke groeten,

Wim Holthof

Deurzerdiep 30 | 8032 NA | Zwolle ................................................................ Wim Holthof ' 06 112 39503 E-mail: mailto:wholthof@home.nl wholthof@home.nl

Van: Jascha van Aalst notifications@github.com Verzonden: vrijdag 5 maart 2021 16:25 Aan: ThemeFuse/Unyson Unyson@noreply.github.com CC: wholthof wholthof@home.nl; Mention mention@noreply.github.com Onderwerp: Re: [ThemeFuse/Unyson] Critical PHP Issue: An active PHP session was detected. (#4048)

We are still experiencing this issue. Any activity still going on here? And if not, is there a possibility to implement a fix and make a pullrequest ourselves?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub < https://github.com/ThemeFuse/Unyson/issues/4048#issuecomment-791488863> , or unsubscribe < https://github.com/notifications/unsubscribe-auth/AQ5IBX4ZHBVF3XCJW4K4EADTCDZVTANCNFSM4QZPQIOQ> . < https://github.com/notifications/beacon/AQ5IBX5OP2NYM5CTSJQDNJ3TCDZVTA5CNFSM4QZPQIO2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOF4WSSXY.gif>

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/ThemeFuse/Unyson/issues/4048#issuecomment-791514837, or unsubscribe https://github.com/notifications/unsubscribe-auth/AGUAZ4MB5GLE5A6ABSNEWXTTCD6L7ANCNFSM4QZPQIOQ .

EddiebNZ commented 3 years ago

This is the new (official) fix Click here <da578e7> . El vie, 5 de mar. de 2021 a la(s) 11:05, wholthof (notifications@github.com) escribió:

Thank you, though I believe that has an error in it at line 260 where there is an unrequired } in the code between the Session_Start and the session_start(['read_and_close' => true,]);

session_start(); } / This shouldn't be here /

wholthof commented 3 years ago

Hey,

The official fix is not working for me. Can't start the website. I go back to my solution that solves the problem

Met vriendelijke groeten,

Wim Holthof

Deurzerdiep 30 | 8032 NA | Zwolle ................................................................ Wim Holthof ' 06 112 39503 E-mail: mailto:wholthof@home.nl wholthof@home.nl

Van: EddiebNZ notifications@github.com Verzonden: zaterdag 6 maart 2021 06:42 Aan: ThemeFuse/Unyson Unyson@noreply.github.com CC: wholthof wholthof@home.nl; Mention mention@noreply.github.com Onderwerp: Re: [ThemeFuse/Unyson] Critical PHP Issue: An active PHP session was detected. (#4048)

This is the new (official) fix Click here <da578e7 https://github.com/ThemeFuse/Unyson/pull/4052/commits/da578e754381632b27289be3d92c1a3cc7f1d14f > . El vie, 5 de mar. de 2021 a la(s) 11:05, wholthof (notifications@github.com mailto:notifications@github.com ) escribió:

Thank you, though I believe that has an error in it at line 260 where there is an unrequired } in the code

session_start(); } / This shouldn't be here / PHP sessions created with session_start() function may cause issues with REST API and loopback requests due to cURL error 28. @internal */ session_start(['read_and_close' => true,]); } }

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ThemeFuse/Unyson/issues/4048#issuecomment-791878294 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AQ5IBXZA4FN7KP5UHLG5OJLTCG6EBANCNFSM4QZPQIOQ .

wholthof commented 3 years ago

The official fix is not working for me. Can't start the website. I go back to my solution that solves the problem

in lines 227 and 259 in this file: wp-content/plugins/unyson/framework/includes/hooks.php 229: session_start(); 230: } 231: session_write_close(); 232: }

EddiebNZ commented 3 years ago

See my comment above, the official fix has an extra } that shouldn't be in there, if you remove that the fix works, but it doesn't stop the PHP sessions error being listed in the Site Health screen.

The official fix is not working for me. Can't start the website. I go back to my solution that solves the problem

in lines 227 and 259 in this file: wp-content/plugins/unyson/framework/includes/hooks.php 229: session_start(); 230: } 231: session_write_close(); 232: }

apatsidis123 commented 3 years ago

if it is an official fix why they do not deploy an official update so we can update it as all other wordpress plugins, so we are sure that it works for everyone?

wholthof commented 3 years ago

Daar ben ik het mee eens. Dit is toch geen offciële oplossing maar geknoei met de beste bedoeling natuurlijk

wholthof commented 3 years ago

Hey,

My workaround is no longer showing active PHP session notifications. Isn't it better to use?

Wim

Van: EddiebNZ notifications@github.com Verzonden: zondag 7 maart 2021 23:48 Aan: ThemeFuse/Unyson Unyson@noreply.github.com CC: wholthof wholthof@home.nl; Mention mention@noreply.github.com Onderwerp: Re: [ThemeFuse/Unyson] Critical PHP Issue: An active PHP session was detected. (#4048)

See my comment above, the official fix has an extra } that shouldn't be in there, if you remove that the fix works, but it doesn't stop the PHP sessions error being listed in the Site Health screen.

The official fix is not working for me. Can't start the website. I go back to my solution that solves the problem

in lines 227 and 259 in this file: wp-content/plugins/unyson/framework/includes/hooks.php 229: session_start(); 230: } 231: session_write_close(); 232: }

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/ThemeFuse/Unyson/issues/4048#issuecomment-792368118 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AQ5IBX57LTIUFK6BP7KQCHDTCP7AXANCNFSM4QZPQIOQ . https://github.com/notifications/beacon/AQ5IBX4BDMDDI5NIQ3GUDALTCP7AXA5CNFSM4QZPQIO2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOF45JH5Q.gif

apatsidis123 commented 3 years ago

For me indeed no longer showing the notiication but i got 50 errors on chrome's developer tool on console, so i return to the official official!!!

wholthof commented 3 years ago

Oke, works the official fine without problems?

Can you mail my a screenshot from the official

Wim

Van: apatsidis123 @.> Verzonden: maandag 8 maart 2021 19:13 Aan: ThemeFuse/Unyson @.> CC: wholthof @.>; Comment @.> Onderwerp: Re: [ThemeFuse/Unyson] Critical PHP Issue: An active PHP session was detected. (#4048)

For me indeed no longer showing the notiication but i got 50 errors on chrome's developer tool on console, so i return to the official official!!!

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/ThemeFuse/Unyson/issues/4048#issuecomment-792962751 , or unsubscribe https://github.com/notifications/unsubscribe-auth/AQ5IBXZQZ7D6GQLKXFSZVQTTCUHRPANCNFSM4QZPQIOQ . https://github.com/notifications/beacon/AQ5IBXZDBO4FBOPD6LPQBRDTCUHRPA5CNFSM4QZPQIO2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOF5B2NPY.gif

EddiebNZ commented 3 years ago

I've now moved off my Unyson based theme (Woffice) and all the issues I was having with my site have gone away. Whether it was Unyson or the Theme I don't know but I don't think I'll be going back.

wholthof commented 3 years ago

Unyson moet nog STEEDS een goedwerkende patch toeleveren, maar mijn workarround lost het probleem ook op. Ik denk dus dat het ook aan jou thema kan liggen dat je problemen blijft houden. Het is toch niet normaal dat Unyson niet van zich laat horen !!!!

jascha030 commented 3 years ago

Unyson moet nog STEEDS een goedwerkende patch toeleveren, maar mijn workarround lost het probleem ook op. Ik denk dus dat het ook aan jou thema kan liggen dat je problemen blijft houden. Het is toch niet normaal dat Unyson niet van zich laat horen !!!!

I'm responding in English out of courtesy towards others, From hearsay I've understood that active development to Unyson has probably stopped. It was part of ThemeFuse which they have stated is now deprecated. I'm not too invested, this question was not one that came from myself, and I did no research whatsoever on the situation.

I can see their frustration caused by breaking Wordpress updates as a good reason to stop active development. In my opinion they can't really be held accountable for the deprecation. What I however do think they should be held accountable for, is the lack of a clear statement in the README's of their themefuse Repo's.

I think they're smudging their own name by leaving people hung out to dry like this...

From what I've seen, my suggestion would be to contact them through their support for their current project: https://support.brizy.io.

That being said, I wouldn't expect too much out of their response and start thinking about abandoning it all together. Trying to maintain a deprecated framework is asking for issues in the long term (especially when PHP 8 is moving towards being the new standard). Also Wordpress + old plugins/themes is an open invitation to hackers.

It sucks but it's also the nature of software...

Hope this has been somewhat helpful information to anyone in this thread, if not for fixing it, maybe just for managing expectations. Good luck!

omniacode commented 3 years ago

My workarround is add in below in themes/xxxx/funtions.php if (!function_exists('_disable_fw_use_sessions')) { add_filter('fw_use_sessions','_disable_fw_use_sessions'); function _disable_fw_use_sessions(){ return false; } }

AGAIN THE URGENT REQUEST THAT UNYSON RELEASES AN UPDATE ASAP !!!!!!!

Just inherited a site that is using Unyson and can confirm that is it the cause for this error, and the above workaround from @wholthof does in fact "fix" it. Bringing this to the client's attention in hopes that we can get them out of the theme they are using and this awful plugin. Gotta love when developers just decide to up and quit a project and leave everyone out to dry. Just horrible.

jakubkasparek commented 3 years ago

This is the new (official) fix Click here <da578e7> . El vie, 5 de mar. de 2021 a la(s) 11:05, wholthof (notifications@github.com) escribió: …

thanks, this changes help.