October 2014 - support - lists.drupal.org

Drupal 7.32, CKEditor and Media Modules
by Susan Mangold 01 Nov '14

01 Nov '14

I have a site that uses the CkEditor and Media modules to allow authorized users to upload images and create pages. I upgraded the site on Wednesday to 7.32. Since then, all images handled by CKEditor no longer display even if I'm logged in as admin. If I go into the media library, all I see are broken-link icons. I have checked that the images are on the server in the specified location and the permissions appear to be correct (775 for folders and 664 for the images). I have also updated all modules and I have cleared the cache. I'm stumped. Can someone help? TIA. Sue

4 10

Drush, list of modules to be updated, no db update
by Drupal 01 Nov '14

01 Nov '14

Hi to all, I need the command to list (in Drush) of all modules should be updated but no db update needed. Tried drush up —no-core —check-updatedb but didn’t get what I need. Any idea? Thanks

11 22

Cleaning up from the Oct. 15th hack.
by Patrick Avella 31 Oct '14

31 Oct '14

Hi, I maintain around 60 multisites that got hacked like all sites on the 15th. Has anyone developed a method of cleaning out the database for malicious code? The file system I can handle on my own. PSA chances are you were hacked on Oct 15th please visit Drupal.org to learn more.

5 7

Re: [support] Drush, list of modules to be updated, no db update
by Marty Landman 31 Oct '14

31 Oct '14

I'd like to add - even though I also follow this procedure it is true as well that drush makes copies of everything it updates. So in a pinch you can recover from the drush backup directory. Marty At 11:13 AM 10/31/2014, Metzler, David wrote: >Content-Language: en-US >Content-Type: multipart/alternative; > >boundary="_000_CB99AEDD84838B4D919DE8C443FC5C554BD07DD5palmevergreened_" > >Many of us (myself included), update core along >with everything else, so mostly I fire drush >up. I would not advise limiting those to >modules that dont update the database, but >rather would advise getting a site clone up and >running on a dev box and running though drush up >in a test environment and getting yourself current. > >Hopefully youve updated core by now 7.32 - anything less is dangerous. > >Dave > >From: support-bounces(a)drupal.org >[mailto:support-bounces@drupal.org] On Behalf Of Drupal >Sent: Friday, October 31, 2014 6:47 AM >To: support(a)drupal.org >Subject: Re: [support] Drush, list of modules to be updated, no db update > >Nothing? >:( > > >On Oct 27, 2014, at 8:20 PM, Drupal ><<mailto:drupal@afan.net>drupal(a)afan.net> wrote: > > >Oh! Im sorry. My bad. >My name is Afan. >:) > > > >On Oct 27, 2014, at 4:31 PM, Tony ><<mailto:tony@tony-mac.com>tony(a)tony-mac.com> wrote: > > >What is your name ? > >On Mon, Oct 27, 2014 at 2:10 PM, Drupal ><<mailto:drupal@afan.net>drupal(a)afan.net> wrote: >Also, I took over a website with tons of modules >to be updated. Even the core is 6-7 updates behind. >Anybody with the similar experience? Suggestions? > >Thanks > > >On Oct 27, 2014, at 4:03 PM, Drupal ><<mailto:drupal@afan.net>drupal(a)afan.net> wrote: > > > Hi to all, > > I need the command to list (in Drush) of all > modules should be updated but no db update needed. > > > > Tried drush up no-core check-updatedb but didnt get what I need. > > > > Any idea? > > > > Thanks > > > > > > > > > >-- >[ Drupal support list | <http://lists.drupal.org/>http://lists.drupal.org/ ] > > > >-- > >Anthony Stefan Maciejowski > ><http://www.about.me/TonyMac>http://about.me/TonyMac > > > >-- >[ Drupal support list | <http://lists.drupal.org/>http://lists.drupal.org/ ] > >-- >[ Drupal support list | <http://lists.drupal.org/>http://lists.drupal.org/ ] > >-- >[ Drupal support list | http://lists.drupal.org/ ]

1 0

webform image upload - Where is kept in database?
by Néstor 29 Oct '14

29 Oct '14

HI guys, I am working with webform and so far so good but I am having the problem that when I createa form using webform and the form has a image upload I can not find the image url in the table. I know where the images are on the server but nothing tells me which image goes with which submission. If I edit the submission it shows the image path or URL but in the table where do I find this. I do not see it in webform or webform_submissions o webform_submitted_data tables. Where is the image url kept on the table? thanks!!!

1 2

Drupal site hacked - new php files injected
by Ahilan Rajan 29 Oct '14

29 Oct '14

Hi, I had installed drupal 7.21 to run a simple website on my server. All seemed well till one day last week I started getting huge amount of spam emails from the server which was hosting the website. On further analysis of the postfix mail queue on the server, I found all the emails were generated by TWO php files (css76.php in the modules/panels/js directory and session.php in the sites/all/libraries/jquery.cycle directory) . These two files were NEWLY created/injected files and seemed bogus containing a number of symbols along with a base64_decode return statement. Clearly my drupal setup had been hacked and someone had successfully injected these files to send spam email (amongst other things I presume) I shutdown the site, installed Security Review and Hacked modules and carried out their recommendations and also checked my file permissions via recommended scripts. However I am still not sure what the entry point for this hack was in my setup and whether I am fully secure yet in this setup. Any suggestions or points in this regard would be highly appreciated. thanks Drupal Newbie

6 6

Re: [support] support Digest, Vol 142, Issue 5
by Roger 29 Oct '14

29 Oct '14

I wonder if you could do some more magic by not letting *.php files in /sites/default/files be run but downloaded only? Hi Don. Just wondering if it's possible to have a php script chron job that safely checks hourly and automatically deletes any php files in /sites/default/files. We've never found a need for new or additional php files in /sites/default/files Not sure but ? Roger

1 0

Re: [support] support Digest, Vol 142, Issue 4
by Roger 29 Oct '14

29 Oct '14

Hi Ahilan We had similar in Drupal 6 and early and recent Drupal 7 with one ISP. The attacks seemed to be because root access to cPanel or through ssd terminal access was obtained permitting a hacker into the whole Drupal system. Any passwords typed in manually are very vulnerable. User name and passwords are easy to grab on the internet and ISPs can be lax while professing top level security. Very long convoluted user names and passwords, very difficult to type manually need to be copy and pasted. This has given us a modicome of security to date. Users scream about having to copy and paste but it was easier for them to learn copy and paste than take the chance on bog awful passwords especially isp root/admin passwords. Our server admin access words are voluminous, convoluted and difficult to type accurately. May I suggest, keep a zipped copy of /sites folder and the database sql file in a /home/Backups directory, out of the /public_html directory system and do a new version of both once a month so at worst you only lose 1 month of data. You can also create an entirely new Drupal install by installing the latest Drupal 7, rename it's /sites folder and copy the /home/Backup/sites.zip to the new drupal and extract it. Your new Drupal will be instantly useable and you can inspect the previous version code as you wish after you rename the /sites folder to make it unavailable. We always have 2 Drupal installs on the system both with the same /sites folder but the second newer one is named something totally unrelated and meaningless and the sites folder also renamed to something meaningless so the fresh drupal site fails to serve until I allow it. I simply rename the original and change the fresh install and it's /sites folder to the original name to run the latest drupal. Hope this helps Roger >> Hi, >> >> I had installed drupal 7.21 to run a simple website on my server. All >> seemed well till one day last week I started getting huge amount of >> spam emails from the server which was hosting the website. >> >> On further analysis of the postfix mail queue on the server, I found >> all the emails were generated by TWO php files (css76.php in the >> modules/panels/js directory and session.php in the >> sites/all/libraries/jquery.cycle directory) . These two files were >> NEWLY created/injected files and seemed bogus containing a number of >> symbols along with a base64_decode return statement. >> >> Clearly my drupal setup had been hacked and someone had successfully >> injected these files to send spam email (amongst other things I >> presume) >> >> I shutdown the site, installed Security Review and Hacked modules and >> carried out their recommendations and also checked my file permissions >> via recommended scripts. >> >> However I am still not sure what the entry point for this hack was in >> my setup and whether I am fully secure yet in this setup. Any >> suggestions or points in this regard would be highly appreciated. >> >> thanks >> Drupal Newbie >> >> >> -- >> [ Drupal support list | http://lists.drupal.org/ ] >> > >

1 0

Repeat Calendar event
by Néstor 27 Oct '14

27 Oct '14

HI, I have a calendar event that repeats : -------------------------------------------------------- *Repeats every month on the fourth Thursday until Thu Jan 01 2015 except Thu Nov 27 2014, Thu Dec 25 2014. Also includes Thu Nov 20 2014.* *Thursday, January 23, 2014 - 9:00am - 5:00pm* *Thursday, February 27, 2014 - 9:00am - 5:00pm* *Thursday, March 27, 2014 - 9:00am - 5:00pm* *Thursday, April 24, 2014 - 9:00am - 5:00pm* *Thursday, May 22, 2014 - 9:00am - 5:00pm* *Thursday, June 26, 2014 - 9:00am - 5:00pm* *Thursday, July 24, 2014 - 9:00am - 5:00pm* *Thursday, August 28, 2014 - 9:00am - 5:00pm* *Thursday, September 25, 2014 - 9:00am - 5:00pm* *Thursday, October 23, 2014 - 9:00am - 5:00pm* *Thursday, November 20, 2014 - 9:00am - 5:00pm* ------------------------------------------------ Any ideas why October 23rd will not show up but all the others will? I have a view Calendar block and a view Calendar page. but why 1 event of the repeated Calendar event just does not display. Thanks, Nestor

1 0

webform data
by Néstor 27 Oct '14

27 Oct '14

Hi Guys, I have a webform and I trying to figure out in the mysql database where is that data kept. I can find the nid and I can query the node table and see the record for the webform but I do not know where/how to get the data that belongs to my webform. I search but I did not get anything. Can some provide a link that explains where do I get the webform data? Thanks,

2 2