runtime error

[iain sherriff]

Does this give clues as to where I should look to cure this Please ?

"Enable compressed output" is not selected.
This error was showing on my account and I was not using mobile but was wireless.
The code around there is

Code Select Expand


// Some settings and headers are different for wireless protocols.
if (WIRELESS)
{
define('WIRELESS_PROTOCOL', isset($_REQUEST['wap']) ? 'wap' : (isset($_REQUEST['wap2']) ? 'wap2' : (isset($_REQUEST['imode']) ? 'imode' : '')));

// Some cellphones can't handle output compression...
$modSettings['enableCompressedOutput'] = '0';
// !!! Do we want these hard coded?
$modSettings['defaultMaxMessages'] = 5;
$modSettings['defaultMaxTopics'] = 9;

// Wireless protocol header.
if (WIRELESS_PROTOCOL == 'wap')
header('Content-Type: text/vnd.wap.wml');
}

// Restore post data if we are revalidating OpenID.
if (isset($_GET['openid_restore_post']) && !empty($_SESSION['openid']['saved_data'][$_GET['openid_restore_post']]['post']) && empty($_POST))
{
$_POST = $_SESSION['openid']['saved_data'][$_GET['openid_restore_post']]['post'];
unset($_SESSION['openid']['saved_data'][$_GET['openid_restore_post']]);
}

// What function shall we execute? (done like this for memory's sake.)
call_user_func(smf_main());

// Call obExit specially; we're coming from the main area ;).
obExit(null, null, true);

// The main controlling function.

Thanks in advance

[kat]

Some could, probably, figure this out, as-is. But, for me, that "Eval" thing is masking the true error.

Can you go to Admin>Configuration>Server settings and put a check in "Disable emulation of templates"?

After you've done that, you should get the true error-message.

[iain sherriff]

Thanks K@.  (evaluation ? ) It already is ticked ?

[kat]

I think you'll need to have a natter with your host, for this one, mate.

I suspect that there's something in php.ini under the "disable_functions" section that's been... er... disabled.

Possibly, you don't have full CHOWN ownership of everything, on your site?

(I'm fishing, here. You may have noticed)

I'm pretty sure it's "Permissions" related, anyway.

[iain sherriff]

will do. cheers 

[kat]

Let us know what they say, yeah?

[iain sherriff]

will do

[iain sherriff]

Server is on maintainence today.
Will just sit it out for a bit (everything seems to work, just thousands of errors logging)

I'll mark this as solved for now

[Arantor]

There is a WTf there. The whole list of evals is a bit suspicious. In fact, look at the top of our index.php file for something that should not be there.

[iain sherriff]

I can see differences in line with the mods I know are there but cant see anything wrong.
Can I post it here for someone to look ?

[kat]

Might be wise...

[Arantor]

Please attach your index.php file, because it does look suspicious from what has been posted thus far.

[iain sherriff]

thanks

[kat]

Might be interesting, this... I'm about to disable avast, because it wouldn't let me download that file. Claims it's infected with PHP:agent-RK [Trj].

[kat]

Yep. Look at the first line.

It should be just:

<?php

Yours has a lot more than that. I'm afraid you've been hacked.

I'm afraid you'll need to go through all of your files and remove that malicious code, unless you have a clean backup.

You'll want to notify your host, PDQ, too.

[Arantor]

Sneaky, too. Must remember that one in future.

[iain sherriff]

bugger..........

Thanks guys.

[iain sherriff]

I'm confused.
When I look at the first line of the attachment I see

Code Select Expand

<?php

but if I copy it and paste in is see al the other gibberish before the <?php

??

[Arantor]

That's the thing... it's all one line. One very long line with lots of spaces before the 'gibberish'. It's perfectly legal PHP to do that.

[Shambles]

As perverse as it may seem, I quite like what's been done there. Sorry.

[iain sherriff]

will the host be able to tell where it came from ?

[Arantor]

Maybe. Ask them.

@Shambles: it is not wrong to appreciate the subtlety and ingenuity of something like that. I just wish they'd channel their skills into producing new good software rather than attacking things.

[iain sherriff]

Im a bit at arms length as I Admin the forum, have FTP access but not CP or dB access. The host is looking at it.
I have gone through what I can and removed all traces I can see.
The forum is for a business that is subject to a lot of flack from trolls and has been attacked before unfortunately.

[iain sherriff]

I've just realised the bit about one line 
that is sneaky

[Arantor]

Not just the fact it's on one line, it's one line - but with enough spaces that to the casual observer, you'd never notice anything was amiss. When I first looked at it in Notepad++, I thought... there's something weird here, because I couldn't *immediately* see something awry.

[iain sherriff]

that code was in every index.php file.

[kat]

I couldn't *immediately* see something awry.

When I looked, it was the fact that the scrollbar, at the bottom, indicated that there was a LONG line, somewhere, that gave me the hint. So, I whacked it over to the far-right and voila! There it was.

[iain sherriff]

I cottoned onto that in the end. Also the file size was way too big.
I thnik it is all OK now...........just not sure if the dB and server will be infected but that is being checked

[kat]

Do yourself a favour, Iain... Read my sig.

Click it, for the "How?".

If you think it's clean, do it right now.

You know you want to.

[iain sherriff]

done................

[kat]

Only the one?

Seriously, I take two, now, in case one's corrupt. Especially when I get the db.

[iain sherriff]

OK
Have to rely on the owner to get the dB

[kat]

Make sure he does something. Regularly. Your forum can be rebuilt, easily enough. But, the database, which stores all of your members, posts, &c?

Not so easy. (Fookin' difficult, really)

[iain sherriff]

I know it is regularly backed up by the host. Going to see if I can get phpmyadmin access after this.

[kat]

Good finkin'.

[iain sherriff]

K@  I have PMd you about this.

[kat]

Goddit.

I don't see anything weird, though. Does one have to be logged-in?

[iain sherriff]

Nothing shows visually and it seems to behave as it should. I assume the code is some sort of data harvesting ?

[kat]

You're getting that some chunk of code, in index.php, are you?

Might be an idea to have a word with your host. They should have raw access logs and be able to figure-out who's getting in and how.

[iain sherriff]

It's exactly the same as you saw at the start of this topic, in every index.php.

Host is looking at it now.