What does allow_url_fopen do?

[mhsuffolk]

Phoenix 1.0.8.20
Just pushed server from 7.4 to 8.1
Despite having allow_url_fopen switched on in cpanel and entries in php.ini and despite the server info showing it as on, I am getting the allow_url_fopen warning in my sites dashboard.

Fopen.JPG

So far I have not seen any errors
Is this warning erroneous.
What can I do to remove the dashboard warning

[burt]

Delete admin/includes/modules/security_check/sc_fopen_wrapper.php

I can't remember what that particular security check is useful for.

[ecartz]

In general, allow_url_fopen allows you to open URLs as if they were files, i.e. to load the file behind the URL. You can do this either directly with a function called fopen or indirectly with functions that may use the fopen code themselves like file_get_contents. I.e. instead of fopen('/home/ecartz/web/file.ext') we can say something like fopen('https://example.com/file.ext')

I think that we actually provided alternatives when that's turned off for all cases in core, but we've never formally stated that and changed the requirement. I think it's true, but it's not proved to be true. If you turn it off and find something broken that works with it on, let us know. It wouldn't be our top priority, but it's something we'd prefer to fix if possible.

A couple examples:

https://github.com/CE-PhoenixCart/Phoen ... eb.php#L21
https://github.com/CE-PhoenixCart/Phoen ... eb.php#L45

Example usages at

https://github.com/search?q=repo%3ACE-P ... &type=code
https://github.com/CE-PhoenixCart/Phoen ... ck.php#L24

I.e. the version checks, updating currency values, and the list of certified developers.

[mhsuffolk]

Update:
I have seen no issues with allow_url_fopen being turned off since February.
My store has several addons and none of them are complaining so hopefully all is well.