Go to main content

Textpattern CMS support forum

You are not logged in. Register | Login | Help

#1 2012-03-24 21:30:18

alesh
Member
From: Miami, FL
Registered: 2005-04-13
Posts: 228
Website

[SOLVED] Strange website behavior, possibly malware

I’ve recently had a malware infection on my Dreamhost account. I’m in the process of cleaning everything out and battening down the hatches. My Textpattern install is exhibiting two odd behaviors, even after replacing all the files from a fresh 4.4.1 download:

1. On the front end, the body of comments does not appear: here’s an example … it shows up fine on the backend.
2. On the backend, under forms, the links to expand the forms (article, comment, file, links, misc) don’t work. (The first two are expanded, the rest not, and I can’t seem to do anything to change them).

Any idea what may be going on, or at least where I’d normally look to correct this?

Last edited by alesh (2012-03-24 21:44:17)


Yes, I have tried turning it off and on.

Offline

#2 2012-03-25 00:29:42

uli
Moderator
From: Cologne
Registered: 2006-08-15
Posts: 4,303

Re: [SOLVED] Strange website behavior, possibly malware

Is there text in red displayed when you visit Admin > Diagnostics? If so, it will say: “Some Textpattern files have been modified”. (File paths will follow on this message.)
No reason to panic, pretty likely not each of the new files has been copied over to your server. Pick the files Diagnostics mentions from your fresh download and copy them exactly to where it tells you they should be. Are you now still having troubles?


In bad weather I never leave home without wet_plugout, smd_where_used and adi_form_links

Offline

#3 2012-03-26 02:50:21

alesh
Member
From: Miami, FL
Registered: 2005-04-13
Posts: 228
Website

Re: [SOLVED] Strange website behavior, possibly malware

Nope, nothing out of the ordinary on the diagnostic screen. I should also mention that another textpattern site I run, on a different dreamhost account, works just fine on the same computer/browser.


Yes, I have tried turning it off and on.

Offline

#4 2012-03-26 06:10:16

colak
Admin
From: Cyprus
Registered: 2004-11-20
Posts: 9,007
Website GitHub Mastodon Twitter

Re: [SOLVED] Strange website behavior, possibly malware

can you put your site on debug for us to see the tag trace? It sounds like there might be something wrong with the way you set up your comments_display.

>Edit: If it was malware it would somehow appear in the diagnostics so I’m 99% certain that it is not:)

Last edited by colak (2012-03-26 06:11:17)


Yiannis
——————————
NeMe | hblack.art | EMAP | A Sea change | Toolkit of Care
I do my best editing after I click on the submit button.

Offline

#5 2012-03-26 13:35:39

alesh
Member
From: Miami, FL
Registered: 2005-04-13
Posts: 228
Website

Re: [SOLVED] Strange website behavior, possibly malware

Ok, I’ve turned on debugging. Now I get this … (There are also a bunch of errors on my homepage that I need to clean up, but they don’t seem related ,either).

here’s what’s in my comments form — txp:message is right there!?:

<b><txp:comment_name /></b>    <small><txp:comment_time /> <txp:comment_permlink>#</txp:comment_permlink></small>  <br/>
<txp:message />
<br /><br />

Yes, I have tried turning it off and on.

Offline

#6 2012-03-26 13:56:02

colak
Admin
From: Cyprus
Registered: 2004-11-20
Posts: 9,007
Website GitHub Mastodon Twitter

Re: [SOLVED] Strange website behavior, possibly malware

somewhere in your code you have txp:message, a tag which does not exist. Maybe you need to change it to <txp:comment_message />. Also don’t worry re the warnings, they’ll go away once you put it back to live mode.


Yiannis
——————————
NeMe | hblack.art | EMAP | A Sea change | Toolkit of Care
I do my best editing after I click on the submit button.

Offline

#7 2012-03-26 15:27:58

alesh
Member
From: Miami, FL
Registered: 2005-04-13
Posts: 228
Website

Re: [SOLVED] Strange website behavior, possibly malware

sure enough—that did it!

I guess this broke when I upgraded to 4.4.1 — the txp:message was supported in an older version of TXP, and I’ve got the original forms. Guess I need to read the release notes more closely.

Thanks!


Yes, I have tried turning it off and on.

Offline

Board footer

Powered by FluxBB