Thread

Running 1.6.8.  I am unable to update my site and it reflect.  It is only happening on my test area. 

I have a site http://www.regenliving.com.  If I update the footer template which is an embed in the index page of the template group *site it will update.  But once I move to my test area.  http://test.regenliving.com, any changes I make to the footer do not reflect.  If I change the URL to http://test.regenliving.com/site then the changes reflect.  But I dont have to do that in my live site.  It is an exact copy of the live site too.  I suspect I’m missing a URL or URI setting somewhere but I can’t find it.  I looked in the config file, the system settings under admin, and I checked the template settings so that they dont cache and I cleared the cache.  Nothing.  Any ideas on how to resolve this problem?  Help would be appreciated.  Banging my head on this one.

Hi, sleven1868. Are you trying to remove index.php via .htaccess? Might that be where the problem is? Is the site template listed as the default template for the second site?

Hey Sue, sorry for the delayed response.  The notifications are going to my spam.  I’ll start monitoring.  I am doing some .htaccess URL forward in the live site which needs to be there for the test site in order for it to work.  see below

RewriteEngine on
RewriteCond %{HTTP_HOST} ^regenliving.com [NC]
RewriteRule ^(.*)$ <a href="http://www.regenliving.com/$1">http://www.regenliving.com/$1</a> [L,R=301] 
RewriteCond $1 !^(about|images|system|themes|gallery|tinymce|favicon\.ico|robots\.txt|mail\.php|index\.php|styles\.css|mail\.php) [NC]
RewriteRule ^(.*)$ /index.php/$1 [L]

I just did a complete refresh of the live to test and changed the paths in the general config setting and the config.php file (also the gallery module).  I am still seeing the same functionality.  I thought that I may need to alter the htaccess file but I cant figure out how to alter it.  I’m not even sure if thats whats causing the problems.  Yes the *site template group is the default template group for the test instance.  Ideas?

sleven1868

We’ve seen issues when you try to force www to your urls, it would be preferable if you could test with no .htaccess file, and put back index.php into the General Configuration.

Can you diret me on what you mean by put back index.php into the General Configuration?  I’m not sure what you mean by that.  Thanks!

Hi, sleven1868. Look at Admin > General Configuration. See the attached screen shot. See how index.php is in there? Does that help?

Yes, that is set.  I suspect its the htaccess file.  Any thoughts on what that is doing?

We’ve seen cases where if you try to remove or add in www for a domain name, that when you attempt to do some things, it doesn’t work. Which is why we wanted you to test without an .htaccess at all, and then if that works, gradually add back in items to your .htaccess file until we see what doesn’t work.

Make sense?

Ok, so I removed the htaccess altogether and its still doing the forwarding to the live site. 

http://test.regenliving.com click on “Out Story” link at the top of the menu.  Now i’m really confused as to what is causing this??  Some links are broken but at least I know that the htaccess file isnt whats causing this issue.  right?  Your thoughts on what to try next?

<a href="http://test.regenliving.com/?phpMyAdmin=19c4caa52cbt2c3718abid=logo">http://test.regenliving.com/images/uploads/template/logo.png</a>

See this code? I suspect there’s something weird going on.. there shouldn’t be any phpMyAdmin code in your templates.

I suspect you may have been hacked.

  Thanks for reporting this. We take security very seriously and will do our best to work with you on figuring out what’s going on. To that, we need some additional information from you…

  1. EE version and build (found at the bottom of your control panel)
  2. Other scripts on your account, whether in use or not (phpBB, etc…)*

  * If this is a shared hosting environment, the host can make a determination if the attack came through scripts on another account on the server, which is commonly the case with these types of hacks.

  While we work through this, please check through these files:

  * path.php (if using EE 1.x)
  * config.php
  * database.php (if using EE 2.x)
  * index.php

  to ensure that there is no unusual code such as iFrames or Javascript includes; if you do find that code, then please back-up the file and remove said code.  If you are unsure of what does or doesn’t belong in these files, do not hesitate to ask.

  You may also wish to refresh your files by following the build update instructions.

  Also please ensure that you report this to your host immediately as they can help identify where the attack originated from so that steps can be taken to prevent this in the future.

Sue, Thanks for taking a look.  How did you find that code you posted?  I’d like to see if its on my live site too.

I just did a view source of the page.

I dont see it on the live site…do you?  http://www.regenliving.com.  I assume you were looking at the index page.

I see it there too..

<form action="/mail.php" method="post"><input type="hidden" name="phpMyAdmin" value="19c4caa52cbt2c3718ab" >

and in several other places.

Nevermind.  Its there in production also.  I suspect that this is not a hack.  I inherited this site from another developer that was doing some actions outside of EE and calling pages outside of EE.  I can only assume they were doing that because of some limitation with the Javascript stuff they were doing on the site.  I will notify the host to double check and I will review those pages to see if there is anything unusual still.