SimplePortal
Support => English Support => Topic started by: crshep on July 23, 2014, 09:38:20 AM
-
I found out that my simpleportal has been hacked or something. When it is installed I have a lot of popups when members try to login in. When I removed it from the package area the popups don't happen. I tried to uninstall and then reinstall but that doesn't help and the people at smf said to ask the simpleportal people how to remove it completely blocks and all from the database so it is 100% gone then once gone reinstall and everything should be fine.
So how to uninstall 100% thanks
-
"hacked or something" is not very clear... it might not be simple portal or a hack, but just other mods you have installed or poor user/password.
Anyway, if you uninstalled simple portal from the package manager without errors then the files are gone.
In that case if you want to delete database entries you go into something like phpmyadmin using your host server control panel and 'drop' the tables in the SMF database that have the prefix 'sp_' after the prefix for your smf tables (usually 'smf_'). Depends if you used another name for the smf prefix.
Mine are 'smf_sp_' followed by easily recognizable words like articles, blocks, categories etc.
As there are no other reports of hacks I think it is very unlikely that Simple Portal is responsible. Files that have been hacked might have permission to change other files on the server - you may not know the source.
If it is some kind of hack and sophisticated enough to change other files then the best thing to do is put clean files back for everything.
I have done this before using the SMF large upgrade package (get it over at smf). You can find details there about using it.
I delete all the old forum files except 'settings.php' and extract the large upgrade package and run it. Then reinstall all mods and theme.
It is best to reset to default theme curve before doing it. If trouble you can use the repair_settings script on smf.
You may want to keep backups of any images you have or avatars. And of course make sure you have backups in case anything goes wrong.
-
Thanks I will try what you suggested. I have already installed backups but they must have been dirty also. SMF is who told me to post over here since the popups do not show up when I uninstall simple portal only when it is installed do the popups appear.
But SMF told me just becasue I uninstall simple portal it doesn't remove everything. So I'll make a backup copy of my database FIRST :O) then I'll look for the files you were talking about sp_ and remove them then I'll reinstall and report back what happens.
I have about 6 mods I use and I uninstalled all and put back one at a time and this is how I figured it was the simple portal mod causing the problem it was the only one that would allow the popups.
Anyway thanks I'll give it a try.
-
As I said, even if it was a hack it was most likely not through Simple Portal. When hacked there is usually the ability to hack index.php and other files. You dont know the origin.
If possible you should try and use a database backup that is before problems started. You might lose some posts but if they hacked the database the problem could return (not a common hack though I think so you can risk using an up to date backup).
I would use the large upgrade and delete everything except the settings.php file.
I would even check that for any suspicious code attached at the top or bottom (usually in index.php). I was hacked a few years ago ... but probably the host provider security and not SMF or Simple Portal. Mods are a risk though.
-
SMF already looked at setting.php index.php file and some other files and they said all seemed clean and correct. I'm not blaming "simple portal" just trying to get it fixed is all. :O)
I already tried all my database backups and non worked. The problem is I use popup blocker and I personally never seen the popups but then all of a sudden members started asking make about saying the popups have been there for over a month. I wish they would have told me when they first saw them then maybe my database would have worked.
Anyway I think I traced it down to sp_blocks when that one file is removed the popups are gone.
But I'm still looking and again thanks for your help.
-
crshep,
You have a custom block that is causing the issue. Simply navigate to your Simple Portal Admin and figure out which block is the culprit. Whichever one it is can be deleted with the negative graphic icon from the blocks list.
-
crshep,
You have a custom block that is causing the issue. Simply navigate to your Simple Portal Admin and figure out which block is the culprit. Whichever one it is can be deleted with the negative graphic icon from the blocks list.
Thanks underdog that was it and it is now fixed. Thanks for understanding my problem and knowing the fix.
Now just a quick question is their another mod or something else I can do to try and not let this happen again? and again thanks for your help..
-
The answer to that depends on how the problem got started.
The custom block -- was it php, bbc, or html?
Was the problem code directly in the block, or did the block load another URL that was the source of the problem?
Was it a block you created yourself, or do you think a hacker created it or modified it?
-
it was php I think all mods are php and I really think it was a hack injected into the php of Simple Portal
I did what underdog said to do and it worked all is fine now. I really do not know which block it was as I removed them I recreate them and when done it was all good. I'm now kicking myself in the butt becasue I should have done one at a time and checked so I knew exactly which one it was. But nevertheless it was Simple Portal that was the problem.
-
If you have a problem with custom php code in a block, you cannot blame Simple Portal.
If your code is bad and it can be hacked then you shouldn't use it - you shouldn't put it in a block.
-
Although I can understand your frustration, I'll have to ask you to keep your assumptions to yourself unless you have solid proof that it was a security issue caused by SimplePortal.
-
Dam you guys are sensitive here.
I never said it was a security issue with simpleportal (As a matter of fact 3 post below this one I said " I'm not blaming "simple portal" ") I only asked a question and was hoping to get some help which I did from "Underdog" this person was the ONLY one that helped me while "Andy" was just defending simpeportal with his replies and blaming something else. I really wasn't asking for a fight or anything just some help which underdog gave me.
I agree "sinan" it wasn't Simpleportal at 100% even though that is the mod to allow blocks so when I uninstalled it I didn't have the problem any longer.
The when "underdog" told me to look at the blocks and I found it I said THANK GOD to myself becasue I like simpleportal.
But I will say for a simple question and a simple answer "underdog" gave me is what fixed the problem.
I really do not appreciate being attacked for a simple question that again was simply answered by "underdog"
thanks "underdog"
-
crshep,
Imo perhaps you are misunderstanding exactly how custom PHP blocks function? Please let me clarify...
When using a custom block (PHP or HTML/JS), Simple Portal executes the PHP/HTML code you provide within the block code. It is up to you to ensure the code you enter within those custom blocks is secure. Simple Portal's prefab blocks themselves are secure (blocks that do not allow/require any custom code) and so is the source code (SP's files) in itself.
When you omitted the sp_blocks function it disallowed all blocks to be executed including your custom block that was causing the issue.
Now just a quick question is their another mod or something else I can do to try and not let this happen again? and again thanks for your help..
Ensure all your custom block codes are secure.
Please note that the staffs response was due to your initial wording of your issue whereas Imo you simply misunderstood how your own custom block codes can be the catalyst of such things.
Regards.
-
Thanks Underdog and after your first response I as able to fix and do some reading up on it through google so I now understand.
My complaint now was only while you helped the others attacked me which is what I feel wasn't right when I was simply asking for help.
My wording may have been wrong but nevertheless you knew what I was talking about and the others went into defense mode and attack mode.
-
crshep,
At times you will find that each one of us (staff) present the solution to an issue as support for the mother mod is a team effort. Imo no staff member was showing any aggressiveness towards you and were politely attempting to ask you not to wrongfully flag a security issue where none was present. The staff here at Simple Portal are very mature and would not post comments with ill intentions. It is in my opinion that some comments here were simply misunderstood.
We are glad you found a solution to your issue and hope that you enjoy using Simple Portal for you forum project/business.
Regards.
-
My replies are very direct - sorry if you see that as negative - its not. I have little time so just type what is pertinent.
Maybe you understand now that the custom code (100% unrelated to Simple Portal) is the problem, not Simple Portal.
As Sinan said, it is not a good idea to post comments saying the software is being hacked, when it isn't. You need some proof before restating comments like that more than once.
Anyway, it seems solved :)
I hope you enjoy Simple Portal - its the best one for SMF.
Every portal has its +/- points but I still think this is the best for SMF - thats after 3 year using it.
http://simpleportal.net/index.php?topic=9683