odd 404 on bottom of nearly all pages

jamm1n · 2008-08-13 22:46:00

Hi
not quite sure what i have done/has happened; I have got:

“Not Found – The requested URL /getsource?sn=www.mydomain.tld&num=991 was not found on this server.”

at the bottom of every page on the front end of my site(s!) this also appears on the bottom of all my back end pages too.

under diagnostics:

“Clean URLs are only supported by Apache, use at your own risk. “ & “Some Textpattern files have been modified: /index.php”

I have turned all the plugins off , and stuck the messy urls back on. it is still there.

I cant find any calls for this url (or indeed really understand the /getsource bit)

can anyone help? I am not too sure if this is .htaccess or mysql related.

I have ask my support for mod_security to be disabled for each domain / subdomain dont know if this is relevant or not either..

the 404 has appeared seemingly overnight, to 3 domains and an install on a subdomain – and I don’t remember doing anything that would warrant it.

Please can anyone point me in the right direction?

many thanks

ben

kkobashi · 2008-08-14 00:57:13

If it was working before and you did nothing to Textpattern and your Textpattern config, then its likely something to do with an Apache upgrade? Php upgrade? Is mod_rewrite installed and working? Could it be javascript code that is flawed? Ad code that is flawed?

Seems to me its outside Textpattern. /getsource?sn=“blahblah” doesnt even look like a textpattern URI.

jakob · 2008-08-14 06:46:34

check your index.php against one downloaded from an original txp package. (How) Are they different?

jamm1n · 2008-08-14 07:10:08

thank you both for replies! :)

I will check both these out and post back

jamm1n · 2008-08-14 19:45:19

Ok
there are definite issues with my (default) htaccess file: my not being able to access my sites at http://my-dynamic-ip/~whatever (404 returned) AND get clean urls. the solution that my hosts support offered allowed me only messy urls working. (I currently have asked my support about this also)

as far as the 404 goes;
could this error be connected with the above issue?
or
is it more likely that I made a mistake on my first few gos at a “wire-frame” method of producing a template site? –
EG: is this some sort of corruption of my database? referencing to this domain is present in the db even though I changed config.php? when moving a wire frame template to different dirs/domains Must I create a new db, then re-populate it, or can I back it up/restore though cpanel on a different domain?

the above is the only thing I can think of. (although it is unlikely because I have the problem on a site which I HAVENT moved. plugins are off and there is no mostly call to any js on the default pages (it doesn’t seem to matter. lightbox and mootools are the only ones i use anyway, they worked fine before and I only have them on some of the pages on some of the problem sites )

this problem is also appearing on sites with and without googleads.

the modified index.php:

just for the record – It IS the index.php at the site root AND NOT the index.php in the /textattern dir? if it is, then I have the following:

<?eval(base64_decode(“big-string-of-code-here==”));?> right at the bottome of the page. have tried deleting it, but still getting the diagnostic warning.(I put it back)(?)

I thought I was getting somewhere with txp but this has blown my mind! :s

I will ask my support team about the php / apache upgrades, I will get round to it AFTER the current (htaccess) issue (if it is still there) …. the poor people…

Last edited by jamm1n (2008-08-14 19:46:47)

MattD · 2008-08-14 19:54:45

Replace your index.php with one from the original txp package. This eval code was probably added by a hacker/script kiddie as it does not exist in the default file.

jamm1n · 2008-08-14 21:46:07

wow! somebody else did this.. thanks! I really needed that…. grr

thanks ever so much for this! – it DID look decidedly dodgy as soon as I saw it. !

Please can anyone advise as to how I can “lock down” textpattern / test an install for [standard] weaknesses? (if indeed it is a textpattern weakness)

I chmod what I can, change passwords and try not to use passwords in mails…. better look @ how im backing up too.

sometimes feel like I have no right even trying to learn this stuff!

thanks once again to all :)

MattD · 2008-08-14 22:22:01

I’ve had that happen to me once and I suspect the vulnerability was caused by my images and file folders only being writable by textpattern when permissions are set to 777. I’m switching hosts because of this issue since I have those directories set to a safe level but can’t use the images or file upload functionality of textpattern.

jamm1n · 2008-08-14 22:32:17

right … ok thanks very much for your time :)

Textpattern CMS

Textpattern CMS support forum

#1 2008-08-13 22:46:00

odd 404 on bottom of nearly all pages

#2 2008-08-14 00:57:13

Re: odd 404 on bottom of nearly all pages

#3 2008-08-14 06:46:34

Re: odd 404 on bottom of nearly all pages

#4 2008-08-14 07:10:08

Re: odd 404 on bottom of nearly all pages

#5 2008-08-14 19:45:19

Re: odd 404 on bottom of nearly all pages

#6 2008-08-14 19:54:45

Re: odd 404 on bottom of nearly all pages

#7 2008-08-14 21:46:07

Re: odd 404 on bottom of nearly all pages

#8 2008-08-14 22:22:01

Re: odd 404 on bottom of nearly all pages

#9 2008-08-14 22:32:17

Re: odd 404 on bottom of nearly all pages

Board footer