PHP Warning: ini_set(): Headers already sent.

[gummi007]

So I have docker-compose that runs roundcube and a postgres db. Then on my host machine I have a nginx that serves the page. Everything works fine until some russian ip starts probing the site and I start getting the error:
[error] 3631#3631: *277 FastCGI sent in stderr: "PHP message: PHP Warning:  ini_set(): Headers already sent. You cannot change the session module's ini settings at this time in /var/www/html/program/lib/Roundcube/rcube.php.
Then it repeats itself for some other lines and other files.

Is there some misconfiguration in my roundcube or nginx? Because after this "attack" when I try to login to my roundcube it just says "Invalid input no data saved" and some token, username and password get printed on the site.

Best Regards, hopeful for solution

[SKaero]

It sounds like there is a problem with your configuration but you'd need to post the error messages before anyone could help with the problem.

[sbouli]

Hi,
I did a fresh install with docker-compose with the example from the site : https://github.com/roundcube/roundcubemail-docker/blob/master/examples/docker-compose-fpm.yaml

I got this after a while :

Code Select Expand


64.31.7.126 - - [15/Jan/2023:04:29:37 +0000] "GET /.env HTTP/1.1" 404 555 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"

2023/01/15 04:29:37 [error] 29#29: *517 open() "/var/www/html/.env" failed (2: No such file or directory), client: 64.31.7.126, server: mail.mydomain.com, request: "GET /.env HTTP/1.1", host: "X.X.X.X:443"
64.31.7.126 - - [15/Jan/2023:04:29:38 +0000] "POST / HTTP/1.1" 200 5366 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"

2023/01/15 04:29:38 [error] 29#29: *517 FastCGI sent in stderr: "PHP message: PHP Warning:  ini_set(): Session ini settings cannot be changed after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube.php on line 478PHP message: PHP Warning:  ini_set(): Session ini settings cannot be changed after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube.php on line 482PHP message: PHP Warning:  ini_set(): Session ini settings cannot be changed after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube.php on line 483PHP message: PHP Warning:  ini_set(): Session ini settings cannot be changed after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube.php on line 484PHP message: PHP Warning:  ini_set(): Session ini settings cannot be changed after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube.php on line 485PHP message: PHP Warning:  ini_set(): Session ini settings cannot be changed after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube.php on line 486PHP message: PHP Warning:  ini_set(): Session ini settings cannot be changed after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube.php on line 487PHP message: PHP Warning:  ini_set(): Session ini settings cannot be changed after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube_session.php on line 116PHP message: PHP Warning:  session_set_save_handler(): Session save handler cannot be changed after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube_session.php on line 125PHP message: PHP Warning:  session_start(): Session cannot be started after headers have already been sent in /var/www/html/program/lib/Roundcube/rcube_session.php on line 141" while reading upstream, client: 64.31.7.126, server: mail.mydomain.com, request: "POST / HTTP/1.1", upstream: "fastcgi://172.19.0.12:9000", host: "X.X.X.X:443"


And I cannot find any other errors or log corresponding  at that time or with this ip ...

what have I done wrong ?

[Dmitry42]

May be someone try hack you ?
Try install and use some like fail2ban on nginx server
And check your nginx conf file for your web-server.