Please upgrade here. These earlier versions are no longer being updated and have security issues.
HackerOne users: Testing against this community violates our program's Terms of Service and will result in your bounty being denied.
Options

Trying to upgrade vanilla forum because my forum js was infected*

245

Comments

  • Options
    peregrineperegrine MVP
    edited March 2014

    @avantime4mike

    when you get sql errors - you can always google them on the web e.g. put this in your google search

    ERROR 1044 (42000)

    However at the final stage of the process I am presented with the following error:- ERROR 1044 (42000) at line 12: Access denied for user 'dbo52*****91'@'%' to database 'db26*****38' I assume this error means I cannot overwrite a database with a backup from a different database.

    check your privs for user user 'dbo52*****91'@'% in the database you want to import tables to.

    what step are you at?

    if you have a sql dump (backup of your database) e.g. mybackup.sql

    try this

    mysql -p blah-new

    then enter your password

    where blah-new is your new database name

    or you may have to use mysql - u yourusername -p blah-new

    where yourusername is the user (this user must have privs to index and create tables, etc.) in the database.

    you can adjust privs via phpmyadmin or via commandline or via cpanel.

    if you can get in to the database and privs are fine.

    you can exit mysql.

    next use the username you used before and the correct password

    change directories to where the mybackup.sql file exists

    mysql -p blah-new < mybackup.sql

    is all you should need to do to import the data from mybackup.sql into your new database blah-new

    Yes, you can import tables from a backup from another database if your new database has a user with privs that allow you to create and index tables, etc.

    If I now backup the original database and use this backup to overwrite the new one is there anything else I will need to do apart from tell everyone the new address and delete the old forum and database?

    you don't need to tell anyone a new address.

    assuming the newvanilla works and has everything the way you want it.

    just rename the forum folders.

    e.g. the oldinfected one resides at /forum I assume. just rename /forum to /oldforum

    rename the /newvanilla to /forum and check the .htaccess rewrite rules. and you should be good togo.

    see last comment - here

    http://vanillaforums.org/discussion/comment/203966/#Comment_203966

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

  • Options

    Thanks Peregrine once again to the rescue, it's 2am here now and I've been on this for 9 hours after I finished a 10 hour shift at work so think I'll revisit it in the morning. I'll keep you updated.

  • Options
    peregrineperegrine MVP
    edited March 2014

    also keep in mind -

    when you are importing your old data (sql dump or backup) into a new database.

    • you must have correct user and password for the new database
    • the new database should not have any tables (just the database created). if you have tables you should drop each table (or empty aka truncate them) in the new database prior to import, if you don't pay attention here.... you will have duplicates and failure of proper load.
    • the load will take a while with a large database be patient.

    after you import the database your old admin login should work.

    • also after you import run /utility/structure and utility/update

    • make sure you copied your /uploads folder from the old forum to the new forum (or your avatars and uploads will not work). and any definitions. save a copy of your old config.php and your new config.php if you need to referencece differences in them.

    read the instructions several times in the last few comments here and focus. the steps need to be in sequence for the import and everything to be successful.

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

  • Options

    Ok, part way there. My host has transferred the database for me and http://www.avantime-owners.com/newvanilla now shows all the previous discussions but I have no users, just me.

    Any ideas as to where they've all gone?

    Hopefully they havent got fed up waiting and gone to another forum :-)

  • Options
    x00x00 MVP
    edited March 2014

    I think what people do when have a problem, they tend to panic.

    So they they can take drastic actions, that can be sometimes be more destructive.

    You may or may not have been infected, but without knowing for sure I can't just trust that.

    In the case that where file are overwritten, if this is in fact the case, then this can be symptomatic of a weakness in server security, rather then necessarily specific to a framework. I might also be that people who have legitimate access, they are infected so they are the weakness in the system (that is why anyone with privileged access to a server, should be be doing regular scans of their computer).

    In both of those case simply replacing the file which clean one doesn't change the nature of the attack, it means that you are not infected for now, but you can be infected again unless something changes.

    There are also cases were people believe they have been infected, either through their own suspicions, or false positive feedback from other programs, but they are not.

    grep is your friend.

  • Options
    peregrineperegrine MVP
    edited March 2014

    Ok, part way there. My host has transferred the database for me and http://www.avantime-owners.com/newvanilla now shows all the previous discussions but I have no users, just me.

    go into phpmyadmin and check your user table. see if the user table is populated. check the userrole table see if it is populated. check the role table.

    if you have no users in user table or just a few users - the host did not install your database properly!
    they may not have dropped the tables prior to installing.

    run /utility/structure and /utility/update .

    you are now on 2.0.18.10 so at least you have fixed any security holes that were present in 2.0.18.8

    why don't you rename the folder newvanilla to forum as mentioned before?

    did you copy your /uploads folder from the old database? as well.

    go into the dashboard and see if permissions and roles are set up the way you want.

    see if you can log in as a regular user. none of your users are showing up in the discussions! can they log in? are they in your new database?

    kind of difficult to help you, you pick and choose steps out of sequences of instructions and run them out of sequence and sometimes skip them. Easy to do, but does require some focus, when you are not tired.

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

  • Options

    I do try to follow instructions but one thing I will say, for someone like me who is "of later years" and doesn't pick up technical things like this too well, I don't think ido too badly. I have read at least four or five different ways to upgrade all of which I have tried to follow and come unstuck one way or another.

    My case is unique in that:-

    a) My forum repeatedly became infected (particularly the js folder). I'm sure these weren't false positives as several users would report the issues at the same time, also my AV was picking them up too and i was able to fix it by replacing the js folder with a backup.

    b) The size of my database was maximum 100mb and was over half full so needed upgrading sooner rather than later.

    c) My database backup was too big to import via FTP so I had to learn how to use SSH.

    d) SSH would not work as I kept getting an error (described above)

    e) My host was also unable to successfully copy my database over to the new 1024mb one I had created.

    f) When they did get a transfer to go it didn't copy all the tables particularly the GDN_User table.

    Despite my not following instructions to the letter, I am truly, eternally grateful to all the gurus here who, without their help I would be completely lost.

    As a result the new database is now working and all seems nearly complete.

    I just had an error whilst navigating through the new forum but not sure exactly what I did to produce the error:-

    "Fatal error: Class 'Gdn' not found in /homepages/34/d260127691/htdocs/forum/bootstrap.php on line 47"

    So my next question is, what are /utility/structure and /utility/update, what will they do, how do I run them and has not running them caused the "Gdn" error?

    Thanks again to all for your persistent help.

  • Options

    clear the .ini files in cache folder.

    grep is your friend.

  • Options

    Mike,

    you do pretty well for non-technical, the gentle chiding is to get you to become a guru yourself. :) And you've been learning more and more....

    this explains how to run /utility/structure and /utility/update

    http://vanillaforums.org/discussion/comment/199096/#Comment_199096

    and first three instructions here. (step 1 is what x00 suggested).
    http://vanillaforums.org/discussion/comment/199091/#Comment_199091

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

  • Options
    peregrineperegrine MVP
    edited March 2014

    your images are not showing up. you need to make sure the uploads folder has been copied over from your old forum, as well as setting proper permissions. try uploading a photo. you should also consider as stated several times before to rename the /newvanilla to /forum.

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

  • Options
    vrijvlindervrijvlinder Papillon-Sauvage MVP

    @avantime4mike said:
    I do try to follow instructions but one thing I will say, for someone like me who is "of later years" and doesn't pick up technical things like this too well,

    You are not aware you are dealing with fossils eh?

    You can always show an old dog new tricks!! You just need another old dog to show it the tricks so he can see age is not a limitation .....

  • Options

    I bet if mike had a bunch of car parts, he could build a running auto faster than any of us. :)

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

  • Options

    Thanks @x00 @Peregrine, I knew the uploads folder wasn't done but as it's so big it tied up my ftp client so I wouldn't be able to do other things. I left it overnight uploading so now it's there. Although it is live the new forum is not being accessed by users yet as they don't know about it, as soon as I know everything is correct I'll rename the old and new forums and finally delete the old one completely.
    I had previously deleted ini files from cache but presumably this needs doing again when certain changes are made. I will have a look at the structure and update now. Thanks again.

  • Options

    Structure and Update scripts done. That was easy, but just so I know, what did they do?
    Then I'll know when to run them again if needed.

  • Options

    OK major problem now, since uploading the uploads folder from my old installation to the new, my new installation has an infected js folder again. I'm back where I started. I scanned the folder using Bullguard before uploading and it found nothing.

    No one has accessed the new forum but me so now I'm completely lost, I'm running the latest version of Vanilla so that's not the problem.

    I run my forum to help others keep a very rare car on the road but it's starting to be more trouble than it's worth.

  • Options

    One other thing I did

    I had this problem again:- http://vanillaforums.org/discussion/24924/weighted-text-not-displaying-correctly#latest

    So tried the fix but it didn't work so I copied tagmodule.php from the old installation, this fixed the problem but could that be infected?

  • Options

    OK I've reinstated the new tagmodule.php and got it working correctly.
    I've also reinstated the empty uploads folder from the clean install and renamed the uploaded one so it doesn't get accessed for now until I know it's not causing the infection.
    I've removed and re-installed my browser incase that was the cause too.
    Scanned my local PC including the backup of my uploads folder that I uploaded yesterday.

    Any other ideas most welcome.

  • Options
    peregrineperegrine MVP
    edited March 2014

    You could make sure the uploads folder only contains .png files, .gifs, and .jpg files and delete anything that is not a .png, .jpg or .gif files and only copy those extensions.

    I am hesitant to say whether the graphics files are the cause of your "infection" or are "infected" but it seems unlikely.

    you could allow only these extensions...

    $Configuration['Garden']['Upload']['AllowedFileExtensions'] = array('jpg','jpeg','gif','png');

    remove any doc zip swf pdf ,etc in the uploads directory, these are more likely to contain viruses , etc.

    you can get a list of all your file types in the uploads directory.

    1 ) ssh into your server

    e.g. go to the /forum directory so now you can type

    2) for this to work properly you need to be one level above the uploads directory, not in the uploads directory.

    find ./uploads -exec file {} \; > dirlist.txt

    this will produce a file called dirlist.txt - it will contain the list of every name and file property of every file in your uploads folder.

    if you want to verify file types for all the files in the uploads folder you download dirlist.txt and open it in a text editor.

    you could also tell people you are not allowing uploads of files anymore, as a test.

    structure and update just verify and update the structure of any database files that may not have the proper attributes in table and will create necessary fields in tables if they are not existent. it never hurts to run them, after updating vanilla versions, and can always help.

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

  • Options

    Thanks @peregrine there are lots of pdfs and a fair few doc files, is there a reliable way to batch scan them prior to me uploading? in the meantime I'll upload all the image files. I'll try the ssh command too although I've only just learnt how to get a bash prompt :blush:

  • Options
    peregrineperegrine MVP
    edited March 2014

    not sure about scanners. I would definitely get rid of any swf's though.

    not really an answer to your question.

    if you want to only copy over user avatars.

    you could copy over the

    /uploads/userpics folder only.

    then see if you run into problems and see if user avatars display correctly.

    then if that works.

    you could

    type
    find ./uploads -type f -exec file {} \; | grep js

    and it will list all files with js extensions in your uploads folder.

    I may not provide the completed solution you might desire, but I do try to provide honest suggestions to help you solve your issue.

Sign In or Register to comment.