Forwarded to devs WP Toolkit causes web server reconfig failure under certain condition

[Bitpalast]

Username: Peter Debik

TITLE

WP Toolkit causes web server reconfig failure under certain condition

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Obsidian latest MU
CentOS 7.9
WP Toolkit latest version

PROBLEM DESCRIPTION

It is possible to have more than one Wordpress app installation in the same domain. One correct one, but also another one or even more that result from previous installations that have never been removed properly before a new WP site was installed using the WP toolkit.

When a user user uses the "Check security" feature of more than a single one of these WP toolkit entries that are related to the same domain, he can check the "Hotlink protection" checkbox in all these installations, no matter whether they are valid or damaged installations.

When two or more of such checkmarks are set (e.g. one in the valid installation and one in a former installation that was not properly removed), a duplicate entry is written into the web server configuration of the domain for the "fake-hotlink-stub".

This results in an error message when the domain shall be reconfigured or when Web Server Configurations Trouble Shooter tries to reconfigure it:


Unable to generate the web server configuration file on the host <hostname> because of the following errors:

Template_Exception: nginx: [emerg] duplicate location "/fake-hotlink-stub" in /etc/nginx/plesk.conf.d/vhosts/<domainname>.conf:90
nginx: configuration file /etc/nginx/nginx.conf test failed

file: /usr/local/psa/admin/plib/Template/Writer/Webserver/Abstract.php
line: 75
code: 0


To resolve this error, a user needs to go into WP Toolkit, open the "Check security" link of the different entries (for the same domain), uncheck the "Hotlink" protection checkbox.

STEPS TO REPRODUCE

See above.

ACTUAL RESULT

Error message when trying to create or modify the web server configuration file.

EXPECTED RESULT

No duplicate entries in the web server configuration files or - even better - make it impossible to create a new WP installation in a domain that already "knows" an existing WP installation in that domain.

ANY ADDITIONAL INFORMATION



YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Confirm bug

 

[IgorG]

Peter, developers have informed that steps to reproduce the issue are not clear:

I have tried to enable "Hotlink protection" when the domain has several broken and valid WordPress instances but I was not able to reproduce "nginx: [emerg] duplicate location" error.

Is it possible to provide more detailed steps to reproduce the issue or provide us access to the server where the issue can be reproduced?

even better - make it impossible to create a new WP installation in a domain that already "knows" an existing WP installation in that domain.

Could you clarify why it should not be possible to install several WordPress instances to one domain?
WordPress Toolkit detects that httpdocs/ already contains WordPress instance and by default install WordPress to another folder like httpdocs/wordpress_a.
The cloning feature also can clone WordPress to the same domain.

 

[Bitpalast]

a) Hmm, that is really strange. As I have resolved the issue in the customer installation by now, I cannot provide the web server conf file excerpts any more. But it sure was this setting, because once the checkbox was unmarked and security settings stored, the problem was solved. I had not changed anything else but that one setting in the "Check security" fly-out of the WP toolkit. That had solved the problem. There must be a problem with this setting when several WP installations exist in the same domain.

b) When one WP installation is not removed from a domain and a second or third are created, the customer seems several Wordpress lines in the Websites & Domains "active list" page, however, only one of them really works and refers to the correct installation. The others are orphans. Example:



In the example only the second line is the "real" Wordpress installation that is working. The first WP line has the same title, but it is an orphaned installation that does not work anymore.

We found that a whole lot of users don't remove an existing installation before they install a new one, this leads to this situation. The screenshot is taken from the installation that had the issue with the hotstub in the web server config.

 

[IgorG]

Peter, here is a reply from developer:

Hmm, that is really strange. As I have resolved the issue in the customer installation by now, I cannot provide the web server conf file excerpts any more. But it sure was this setting, because once the checkbox was unmarked and security settings stored, the problem was solved. I had not changed anything else but that one setting in the "Check security" fly-out of the WP toolkit. That had solved the problem. There must be a problem with this setting when several WP installations exist in the same domain.

Using described steps I was not able to reproduce the issue. Probably there are additional conditions that we don't know. In case of the issue occurs again I recommend the customer create a ticket to support to investigate the issue. Also "previous installations that have never been removed properly" is no correct behaviour that should be checked and fixed(if they were not removed due to some errors in Plesk).

When one WP installation is not removed from a domain and a second or third are created, the customer seems several Wordpress lines in the Websites & Domains "active list" page, however, only one of them really works and refers to the correct installation. The others are orphans.

The other ones are still working installations that can be accessed via http://example.com/path_to_second_wordpress. Some customers use these installations for test purposes.

In the example only the second line is the "real" Wordpress installation that is working. The first WP line has the same title, but it is an orphaned installation that does not work anymore.

If the second one is not needed - just remove it or rename a title in WordPress Toolkit: Domains > example.com > WordPress.
Installation with the same title can be due to:
1. WordPress was cloned via WPTK to the same domain.
2. Someone copied files from httdocs (where the first WordPress is installed) to another directory inside DocumentRoot.

So domain should have different folders with WordPress files and this detected by WPTK.

We found that a whole lot of users don't remove an existing installation before they install a new one, this leads to this situation. The screenshot is taken from the installation that had the issue with the hotstub in the web server config.

If customers do not remove second, third instances then they probably use them.
By default, WPTK doesn't install WordPress to the same directory. If WPTK detects WordPress then WPTK automatically uses another folder to install WordPress.
If the select folder where WordPress already exists WPTK will show a warning that all files will be overwritten, customer should agree with that and after that WordPress will be "re-installed" and only one WordPress instance will be displayed in WPTK.

Even if prohibit second WordPress installation via WPTK customer can always manually create a second WordPress instance.

 

[Bitpalast]

Using described steps I was not able to reproduce the issue. Probably there are additional conditions that we don't know. In case of the issue occurs again I recommend the customer create a ticket to support to investigate the issue. Also "previous installations that have never been removed properly" is no correct behaviour that should be checked and fixed(if they were not removed due to some errors in Plesk).

I can't, because when the situation occurs, we need to correct the error asap. Otherwise, all subsequent web server configuration updates fail and if a restart of the web server becomes necessary, that will also fail, because syntactically wrong configuration files exist. However, I'll try to backup the whole structure if this occurs again, so that it can be looked at later by support.

Customers do not find the "remove" menu entry, so what they do is that they delete the files and sometimes, if they understand that there is also a database, the database, too. This does leave a second or third WP installation in the web space panel, while there are actually no files left or only part of such installations. For that reason, the additional WP installations only appear in the panel, but cannot actually be managed or used. Their settings however are still present in the configurations.

Peter, here is a reply from developer:

The other ones are still working installations that can be accessed via http://example.com/path_to_second_wordpress. Some customers use these installations for test purposes.

No, because the customer have deleted their files at least partly. I believe this is because they don't find the "remove" link to properly uninstall the application from the panel.

Peter, here is a reply from developer:

So domain should have different folders with WordPress files and this detected by WPTK.

If customers do not remove second, third instances then they probably use them.

The order of events is different: First Customers install one WP, then a second, then they remove files of the first one. In the installation in question that is exactly what was done by the customer.