PHP Warning on non-existent multisite wp-cron.php

[dd32]

A PHP warning can be triggered when a HTTP request is made to wp-cron.php on a non-existent multisite site.

For example:

GET https://foobar.example.org/wp-cron.php

PHP Warning:  Cannot modify header information - headers already sent in wp-includes/ms-settings.php on line 79
PHP Stack trace:
PHP   1. {main}() wp-cron.php:0
PHP   2. require_once() wp-cron.php:44
PHP   3. require_once() wp-load.php:55
PHP   4. require_once() wp-config.php:125
PHP   5. require() wp-settings.php:141
PHP   6. header($header = 'Location: https://example.org/wp-signup.php?new=foobar') wp-includes/ms-settings.php:79

While the error doesn't define why it's being triggered, but it's because [44488] ends the request when wp-cron.php is requested prior to the multisite bootstrap.

Initial thoughts say that this is probably a "good enough" fix:

wp-includes/ms-settings.php

@@ -73 +73 @@
 
         if ( true === $bootstrap_result ) {
                 // `$current_blog` and `$current_site are now populated.
-        } elseif ( false === $bootstrap_result ) {
+        } elseif ( false === $bootstrap_result || headers_sent() ) {
                 ms_not_installed( $domain, $path );
         } else {
                 header( 'Location: ' . $bootstrap_result );

While this warning will never be seen by users, it can end up in the PHP logs, especially when a vulnerability scanner is trying every subdomain under the sun.