Using allow_url_fopen=1 is a security risk, so all functions requiring this should be changed to use cURL instead.
For example in includes/wp_booster/td_video_support.php:
REPLACE:
private static function is_404($url) {
$headers = @get_headers($url);
if (!empty($headers[0]) and strpos($headers[0],'404') !== false) {
return true;
}
return false;
}
WITH:
private static function is_404($url) {
$curl = curl_init();
curl_setopt_array( $curl, array( CURLOPT_RETURNTRANSFER => true, CURLOPT_URL => $url ) );
curl_exec( $curl );
$response_code = curl_getinfo( $curl, CURLINFO_HTTP_CODE );
curl_close( $curl );
return ($response_code==404);
}
Ref:
http://stackoverflow.com/questions/127534/should-i-allow-allow-url-fopen-in-php
http://stackoverflow.com/questions/6087222/php-get-headers-alternative
Follow
Hi all,
We will investigate this implementation and perhaps, in a future update it is possible but we cannot say for sure if it will get done in the next update because we have a big list of fixes, improvements, and suggestions to implement. It’s hard to filter them and select which one gets implemented now and which one gets postponed. The developers decide if it gets done or not, though.
Thanks for the message!
Security issues should be a top priority.
Please fix this security issue.
Still not resolved in 7.6?
Hi,
Using allow_url_fopen=1 is considered a potential security risk. This means that it will only be a problem if your code is sloppy, which is not the case with any of our themes.
We know that many servers disable allow_url_fopen by default and this issue is on our list. We will modify the code in one of the next updates, sorry for the delay.
Thank you!
A year later still having the same issue?
Hi,
I believe this was not considered to require immediate attention, by the developer team. If it would present risks they would take the necessary actions in this matter. I will bring it to their attention again, and it will be discussed.
Thanks
