Simple Machines Community Forum

Did anyone ever come up with a fix for this?

Fatal error: require_once() [function.require]: Failed opening required '/home/content/43/12872143/html/forum/Sources/Subs-Auth.php' (include_path='.:/usr/local/php5_3/lib/php') in /home/content/43/12872143/html/forum/Sources/Security.php on line 543

Has it been addressed in 2.1?

How can we resolve "the host removed the file because it tripped a really obscure, hard to diagnose security scan where it uses a function that malicious people use therefore it must be bad" problem?

Wonder what they're scanning for.  File uploads, shows up for a fraction of a second, then disappears.  Forum owner will ask GD to disable it, don't know if they will.

if you upload the file with the file manager it will not disappear. we have tried to find out why files go missing but they dont tell us why.

It's being triggered by this -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['search']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['search']));



Quote from: Illori on May 31, 2016, 05:03:44 PM
if you upload the file with the file manager it will not disappear.

That works, thanks.  Forum is running.  Must be something specific to ftp server.

If you change this -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['search']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['search']));



to this -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['']));



Subs-Auth.php uploads normally.  If you put anything in the brackets in $_REQUEST[''] -



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['test']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['test']));



it fails.

The third line in that code block -



$_REQUEST['search'] = strtr($_REQUEST['search'], array('%' => '\%', '_' => '\_', '*' => '%', '?' => '_', '&' => '&'));



does not trigger the problem. (https://www.simplemachines.org/community/proxy.php?request=http%3A%2F%2Fwww.thekrashsite.com%2Fpics%2Fidk.gif&hash=9ac7acf13f4cfaa1b58390444a38dea11e5473d2)

WTF GoDaddy.

I haven't notice this issue, using SSH.

Quote from: Sir Osis of Liver on June 01, 2016, 12:58:36 PM
If you change this -

Code Select Expand



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['search']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['search']));



to this -

Code Select Expand



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['']));



Subs-Auth.php uploads normally.  If you put anything in the brackets in $_REQUEST[''] -

Code Select Expand



$_REQUEST['search'] = $smcFunc['htmlspecialchars']($_REQUEST['test']) . '*';
$_REQUEST['search'] = trim($smcFunc['strtolower']($_REQUEST['test']));



it fails.

The third line in that code block -

Code Select Expand



$_REQUEST['search'] = strtr($_REQUEST['search'], array('%' => '\%', '_' => '\_', '*' => '%', '?' => '_', '&' => '&'));



does not trigger the problem. (https://www.simplemachines.org/community/proxy.php?request=http%3A%2F%2Fwww.thekrashsite.com%2Fpics%2Fidk.gif&hash=9ac7acf13f4cfaa1b58390444a38dea11e5473d2)

I ended up running into this I changed the code to make it more hidden

eval(base64_decode('JF9SRVFVRVNUWydzZWFyY2gnXSA9ICRzbWNGdW5jWydodG1sc3BlY2lhbGNoYXJzJ10oJF9SRVFVRVNUWydzZWFyY2gnXSkgLiAnKic7CgkkX1JFUVVFU1RbJ3NlYXJjaCddID0gdHJpbSgkc21jRnVuY1snc3RydG9sb3dlciddKCRfUkVRVUVTVFsnc2VhcmNoJ10pKTs='));



Suspect that will get flagged for looking like malware.

I did it for one file. Then realized godaddy flagged also
Post.php
PersonalMessage.php
Subs-Auth.php
ModerationCenter.ph
Subs-Post.php
LogInOut.php
Subs-Editor.php
Register.php
Reminder.php

Then wrote a script to upload the file and that works. Seems like they just delete/scan the files on ftp upload..

Yup, we've seen that alot. And always without exception the solution has been to upload the missing files using another method. Sucks, but that's how it is.

Most files I've ever seen blocked was an even dozen, but hasn't happened recently.  GoDaddy has so many different server configurations, you never know what you're working with (neither do they).