Class-font-manager.php permissions are not set correctly when updating Cornerstone

[geekgoddessx]

This has happened with two different hosting companies with two different clients. One is SiteGround and the other is LightningBase. When updating, for whatever reason the file “class-font-manager.php” is updated with both group and owner set as root and 000 as the permission (no read/write/execute). This causes a 500 server error and I’ve had to go in and manually delete the file on the server, then upload it again manually. Here is the line in my error log that shows the issue. It has happened for the last several updates for two of my clients.

[29-Jul-2018 00:02:48 UTC] PHP Fatal error: require_once(): Failed opening required ‘/home/xxxxx/public_html/wp-content/plugins/cornerstone/includes/classes/styling/class-font-manager.php’ (include_path=’.:/opt/cpanel/ea-php70/root/usr/share/pear’) in /home/wheredoe/public_html/wp-content/plugins/cornerstone/includes/cornerstone-plugin.php on line 105

I’m wondering if it’s related to this thread: https://theme.co/apex/forum/t/malware-found-in-cornerstone-update/39594. Maybe something in that file is flagging anti-virus software on the servers?

Actually, it’s definitely that. Can something be rewritten to inject the typekit code in a different way?

[ruenel]

Hello There,

Thanks for writing in! You can whitelist the file and ignore the errors.
You might need to check out this threads: https://theme.co/apex/forum/t/malware-in-class-font-manager-php/3046/5

Best Regards.

[geekgoddessx]

I actually got my hosting provider to globally whitelist it so everyone will be covered that hosts with them. He told me he had gotten a couple other support tickets on the same issue so he just whitelisted it after my ticket also showed up. I also reported it to Imunify360 so hopefully if enough others do the same, they will remove it from their list and stop flagging a false-positive.

I just wanted to see if there’s some other way you can add in the typekit javascript into the file. Why aren’t you enqueueing it the proper way? Since this is WordPress, you should be doing it that way.

[christopher]

Hi @geekgoddess,

Unfortunately, we can not use the standard way of the JS addition for that as the whole system is inside the Cornerstone ecosystem which uses the ember framework.

I added this to our issue tracker so that our dev guys can take a look and see if there is a way to load the font another way. If it is possible our dev team will follow up the case and you will see the change in the upcoming releases. You can always check the changes in the changelog:

https://theme.co/changelog/

Thank you.