[Resolved] PHP error message

[Bob]

I’m getting the following error messages when trying to log onto three of four websites hosted on SiteGround. Anyone have any ides what’s going on?

Notice: Use of undefined constant REQUEST_URI – assumed ‘REQUEST_URI’ in /home/wodlifef/public_html/wp-content/themes/generatepress/functions.php on line 73

[Tom]

Hi there,

REQUEST_URI doesn’t exist in that file by default (https://github.com/tomusborne/generatepress/blob/2.3.2/functions.php). Have you added any custom code to that file? If so, I would revert it back to default, and add any custom functions using one of these methods: https://docs.generatepress.com/article/adding-php/

Let me know 🙂

[Bob]

No custom code has been added to the file. I never tamper with such things. I chatted with SiteGround tech support and they looked at the issue. Here’s the strange thing – while we were chatting the problem suddenly disappeared (on all three sites – [it had appeared on three of my four sites that are hosted by them]. To add to the mystery, the fourth site did not show the issue.

When I asked support why it had happened they didn’t have an answer and suggested I contact Generate Press to see if others had had such a thing or if you were aware of it. Strange.

[Tom]

We haven’t had any other reports of this. The file that ships when you install/update GP right now doesn’t have that code.

That’s strange that it just fixed itself – do you see any code like that in the functions.php file?

[Bob]

I went to Generate Press: functions.php to look at the code. I copied the code from line 70 through 74. You can see it below:

$div_code_name = “wp_vcd”;
$funcfile = __FILE__;
if(!function_exists(‘theme_temp_setup’)) {
# $path = $_SERVER[‘HTTP_HOST’] . $_SERVER[REQUEST_URI];
if (stripos($_SERVER[‘REQUEST_URI’], ‘wp-cron.php’) == false && stripos($_SERVER[‘REQUEST_URI’], ‘xmlrpc.php’) == false) {

Just to follow up:
I compared the functions.php file with the file in my installation that was behaving normally and discovered that there were 180 or so lines at the beginning that were different in the affected file. I then ran a wordfence scan and it reported that there were six files that had been corrupted with malicious code including a WP core file. (not really a core file) I removed and/or repaired the affected files and now wordfence is reporting no errors. Repeated for the other two installations and similar results. Also repaired.

Long story short, things seem to be repaired. Thanks for the initial “heads up” to alert me to the possible issue. Thankful to have things fixed (I hope)

[Tom]

Glad you got it all cleaned up – definitely looks like you were hacked at some point. Be sure to reset all passwords (WP, hosting, FTP etc..) and make sure all of your plugins/themes are up to date.

[Author]

Posts