support

support@drupal.org

7912 discussions

PHP or SQL intrusion ?
by Bruno Costacurta 05 Nov '14

05 Nov '14

Hello, I found the following in the Drupal system log. It looks like this is an intrusion via PHP or SQL. Apparently the attack failed. C Correct ? What should I do to enforce or correct the Drupal security ? Current version is latest 7.32 and it is reported 'Up to date' via drush. http://www.xxx.xxx|1415110013|php|103.228.71.39|http://www.xxx.xxx/?q=user/…: mb_strlen() expects parameter 1 to be string, array given in drupal_strlen() (line 478 of /var/www/drupal7/includes/unicode.inc). http://www.xxx.xxx|1415110013|php|103.228.71.39|http://www.xxx.xxx/?q=user/…: addcslashes() expects parameter 1 to be string, array given in DatabaseConnection->escapeLike() (line 984 of /var/www/drupal7/includes/database/database.inc). http://www.xxx.xxx|1415110013|php|103.228.71.39|http://www.xxx.xxx/?q=user/…: SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' '111111' AND status = 1' at line 1: SELECT * FROM {users} WHERE name = :name_0, :name_1 AND status = 1; Array#012(#012 [:name_0] => admin#012 [:name_1] => 111111#012)#012 in user_login_authenticate_validate() (line 2149 of /var/www/drupal7/modules/user/user.module). Thanks for follow-up and help. Bruno

1 0

Drupalgeddon-test
by Muzaffer Tolga Ozses 05 Nov '14

05 Nov '14

Hi, I removed the files anyway, but I still wanted to ask you. Do you think these are false or true positives? Suspicious file "DRUPAL_ROOT/FirePHPCore/lib/FirePHPCore/FirePHP.class.php4" discovered. [error] Suspicious file "DRUPAL_ROOT/FirePHPCore/lib/FirePHPCore/fb.php4" discovered. [error] Suspicious file "DRUPAL_ROOT/FirePHPCore/lib/FirePHPCore/fb.php" discovered. [error] Suspicious file "DRUPAL_ROOT/FirePHPCore/lib/FirePHPCore/FirePHP.class.php" discovered. [error] Suspicious file "DRUPAL_ROOT/FirePHPCore/demo/oo.php" discovered. [error] Suspicious file "DRUPAL_ROOT/FirePHPCore/demo/procedural.php" discovered. [error] Suspicious file "DRUPAL_ROOT/FirePHPCore/demo/procedural.php4" discovered. [error] Suspicious file "DRUPAL_ROOT/FirePHPCore/demo/oo.php4" discovered. [error] Suspicious file "DRUPAL_ROOT/import.php" discovered. [error] Regards, mto

2 1

Re: [support] support Digest, Vol 143, Issue 3
by Chris McAndrew 02 Nov '14

02 Nov '14

just edit settings.php to all free access. if that fails u may have broken your theme so change default theme to bartik, also in settings but uncomment those lines first. Chris McAndrew On Nov 1, 2014 8:42 AM, <support-request(a)drupal.org> wrote: > Send support mailing list submissions to > support(a)drupal.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.drupal.org/mailman/listinfo/support > or, via email, send a message with subject or body 'help' to > support-request(a)drupal.org > > You can reach the person managing the list at > support-owner(a)drupal.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of support digest..." > > > Today's Topics: > > 1. Re: I locked my self out :( (Jeff Greenberg) > 2. Re: Drupal 7.32, CKEditor and Media Modules (Susan Mangold) > 3. Re: Drupal 7.32, CKEditor and Media Modules (Muzaffer Tolga Ozses) > 4. Re: Drupal 7.32, CKEditor and Media Modules (Susan Mangold) > 5. Re: Drupal 7.32, CKEditor and Media Modules (Muzaffer Tolga Ozses) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 1 Nov 2014 08:12:52 -0400 > From: Jeff Greenberg <listmail.ayendesigns(a)gmail.com> > Subject: Re: [support] I locked my self out :( > To: "support(a)drupal.org" <support(a)drupal.org> > Message-ID: <1901790D-431A-48F9-9534-9072FD942E7F(a)gmail.com> > Content-Type: text/plain; charset=us-ascii > > If you have ssh / command line access to the server and drush installed > you can do the following from the applicable sites directory: > > drush upwd <username> --password="new password" > > Such as > > drush upwd admin --password="fubar" > > ------------------------------ > > Message: 2 > Date: Sat, 01 Nov 2014 08:26:55 -0400 > From: Susan Mangold <s.mangold(a)gmail.com> > Subject: Re: [support] Drupal 7.32, CKEditor and Media Modules > To: Christopher Jordan <christopher.coolgbb7(a)gmail.com>, > support(a)drupal.org > Message-ID: <5454D18F.405(a)gmail.com> > Content-Type: text/plain; charset="utf-8" > > I traced the path that the Media module uses and it is identical to > where the files are. > > The files are where they were before the upgrade. > > I made no changes other than those required for the upgrade. > > > On 11/1/14, 7:43 AM, Christopher Jordan wrote: > > > > You need to find the path to the images. Drupal is not resolving the > > path verify your file paths. > > > > On 31 Oct 2014 18:30, "Susan Mangold" <s.mangold(a)gmail.com > > <mailto:s.mangold@gmail.com>> wrote: > > > > I have a site that uses the CkEditor and Media modules to allow > > authorized users to upload images and create pages. > > > > I upgraded the site on Wednesday to 7.32. Since then, all images > > handled > > by CKEditor no longer display even if I'm logged in as admin. If I go > > into the media library, all I see are broken-link icons. > > > > I have checked that the images are on the server in the specified > > location and the permissions appear to be correct (775 for folders > and > > 664 for the images). > > > > I have also updated all modules and I have cleared the cache. > > > > I'm stumped. > > > > Can someone help? > > > > TIA. > > > > Sue > > -- > > [ Drupal support list | http://lists.drupal.org/ ] > > > >

4 7

Drupal 7.32, CKEditor and Media Modules
by Susan Mangold 01 Nov '14

01 Nov '14

I have a site that uses the CkEditor and Media modules to allow authorized users to upload images and create pages. I upgraded the site on Wednesday to 7.32. Since then, all images handled by CKEditor no longer display even if I'm logged in as admin. If I go into the media library, all I see are broken-link icons. I have checked that the images are on the server in the specified location and the permissions appear to be correct (775 for folders and 664 for the images). I have also updated all modules and I have cleared the cache. I'm stumped. Can someone help? TIA. Sue

4 10

Drush, list of modules to be updated, no db update
by Drupal 01 Nov '14

01 Nov '14

Hi to all, I need the command to list (in Drush) of all modules should be updated but no db update needed. Tried drush up —no-core —check-updatedb but didn’t get what I need. Any idea? Thanks

11 22

Cleaning up from the Oct. 15th hack.
by Patrick Avella 31 Oct '14

31 Oct '14

Hi, I maintain around 60 multisites that got hacked like all sites on the 15th. Has anyone developed a method of cleaning out the database for malicious code? The file system I can handle on my own. PSA chances are you were hacked on Oct 15th please visit Drupal.org to learn more.

5 7

Re: [support] Drush, list of modules to be updated, no db update
by Marty Landman 31 Oct '14

31 Oct '14

I'd like to add - even though I also follow this procedure it is true as well that drush makes copies of everything it updates. So in a pinch you can recover from the drush backup directory. Marty At 11:13 AM 10/31/2014, Metzler, David wrote: >Content-Language: en-US >Content-Type: multipart/alternative; > >boundary="_000_CB99AEDD84838B4D919DE8C443FC5C554BD07DD5palmevergreened_" > >Many of us (myself included), update core along >with everything else, so mostly I fire drush >up. I would not advise limiting those to >modules that dont update the database, but >rather would advise getting a site clone up and >running on a dev box and running though drush up >in a test environment and getting yourself current. > >Hopefully youve updated core by now 7.32 - anything less is dangerous. > >Dave > >From: support-bounces(a)drupal.org >[mailto:support-bounces@drupal.org] On Behalf Of Drupal >Sent: Friday, October 31, 2014 6:47 AM >To: support(a)drupal.org >Subject: Re: [support] Drush, list of modules to be updated, no db update > >Nothing? >:( > > >On Oct 27, 2014, at 8:20 PM, Drupal ><<mailto:drupal@afan.net>drupal(a)afan.net> wrote: > > >Oh! Im sorry. My bad. >My name is Afan. >:) > > > >On Oct 27, 2014, at 4:31 PM, Tony ><<mailto:tony@tony-mac.com>tony(a)tony-mac.com> wrote: > > >What is your name ? > >On Mon, Oct 27, 2014 at 2:10 PM, Drupal ><<mailto:drupal@afan.net>drupal(a)afan.net> wrote: >Also, I took over a website with tons of modules >to be updated. Even the core is 6-7 updates behind. >Anybody with the similar experience? Suggestions? > >Thanks > > >On Oct 27, 2014, at 4:03 PM, Drupal ><<mailto:drupal@afan.net>drupal(a)afan.net> wrote: > > > Hi to all, > > I need the command to list (in Drush) of all > modules should be updated but no db update needed. > > > > Tried drush up no-core check-updatedb but didnt get what I need. > > > > Any idea? > > > > Thanks > > > > > > > > > >-- >[ Drupal support list | <http://lists.drupal.org/>http://lists.drupal.org/ ] > > > >-- > >Anthony Stefan Maciejowski > ><http://www.about.me/TonyMac>http://about.me/TonyMac > > > >-- >[ Drupal support list | <http://lists.drupal.org/>http://lists.drupal.org/ ] > >-- >[ Drupal support list | <http://lists.drupal.org/>http://lists.drupal.org/ ] > >-- >[ Drupal support list | http://lists.drupal.org/ ]

1 0

webform image upload - Where is kept in database?
by Néstor 29 Oct '14

29 Oct '14

HI guys, I am working with webform and so far so good but I am having the problem that when I createa form using webform and the form has a image upload I can not find the image url in the table. I know where the images are on the server but nothing tells me which image goes with which submission. If I edit the submission it shows the image path or URL but in the table where do I find this. I do not see it in webform or webform_submissions o webform_submitted_data tables. Where is the image url kept on the table? thanks!!!

1 2

Drupal site hacked - new php files injected
by Ahilan Rajan 29 Oct '14

29 Oct '14

Hi, I had installed drupal 7.21 to run a simple website on my server. All seemed well till one day last week I started getting huge amount of spam emails from the server which was hosting the website. On further analysis of the postfix mail queue on the server, I found all the emails were generated by TWO php files (css76.php in the modules/panels/js directory and session.php in the sites/all/libraries/jquery.cycle directory) . These two files were NEWLY created/injected files and seemed bogus containing a number of symbols along with a base64_decode return statement. Clearly my drupal setup had been hacked and someone had successfully injected these files to send spam email (amongst other things I presume) I shutdown the site, installed Security Review and Hacked modules and carried out their recommendations and also checked my file permissions via recommended scripts. However I am still not sure what the entry point for this hack was in my setup and whether I am fully secure yet in this setup. Any suggestions or points in this regard would be highly appreciated. thanks Drupal Newbie

6 6

Re: [support] support Digest, Vol 142, Issue 5
by Roger 29 Oct '14

29 Oct '14

I wonder if you could do some more magic by not letting *.php files in /sites/default/files be run but downloaded only? Hi Don. Just wondering if it's possible to have a php script chron job that safely checks hourly and automatically deletes any php files in /sites/default/files. We've never found a need for new or additional php files in /sites/default/files Not sure but ? Roger

1 0

← Newer
1
...
6
7
8
9
10
11
12
...
792
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

support