We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 44985
    • 27 Posts
    Hi all,
    Description of Problem:

    Our client's website hasn't been reflecting Manager changes since yesterday. I have not yet manually cleared the cache because I know that the whole site might just go down because this might be a serious issue.

    I've had a look at our server's error logs and I saw this:
    Cache unable to open file for writing: /home/website/public_html/core/cache/rss//2552d997701d0d006f31cce7d173cba6


    Now, what's worrying, is that when I check out that file, I can see that it's an XML file to a "Magpie RSS" feed (whatver that means - which I've attached). and it's a feed about Critical MODX Security Issues. The first link I check out from one of the nodes pointed me to this:http://forums.modx.com/thread/84893/security-bypass-and-remote-execution#dis-post-468080.

    If my site has been hacked, does anyone know which files I should be concerned about/replacing?

    More Information:

    • You can edit resources in the manager just fine - everything saves and is reflected in the database. Just not in the Front End.
    • Nothing under Reports, System shows up in the Manager. Just a blank window.
    • The website is still up on the Front End. I'm assuming it's a cached version.



    • MODX Version: MODx Revo 2.1.3-pl (traditional)

    Sar

    This question has been answered by sarahactivated. See the first response.

      ☆ Flag it! - Don't forget to "star" a reply if it's answered your question smiley
    • The file noted above in the cache folder is the default feeds content from the modx RSS feeds. If you are concerned that you might loose the entire site you can simply rename the cache folder "_cache" or some other name and let Modx regenerate new cache. Then worst case you change back to the previous cache folder. Additionally there are various levels of caching techniques that can be used in an infrastructure, of which modx application cache is one. Can you provide any more information about your Modx Cache Settings and also a php modules listing. Also if your using a CDN service like CloudFlare that would be a potential root source of the caching persistence.

      Questions:


      1. Did this problem manifest in an existing environment or was it introduced on a new install/migration/host?
      2. What caching settings have you setup in Modx System Setings
      3. Are there any other hosting environment caching practices being implimented (cloudflare for example, server, proxy, etc.)
      4. Any other site changes or environment changes prior to issue

      Cheers
        Evo Revo // Ubuntu, CentOS, Win // Apache 2x, Lighttp (Lighty)
        Visit CharlesMx.com for latest news and status updates.
        • 44985
        • 27 Posts
        Quote from: charless at Oct 03, 2013, 03:41 AM


        1. Did this problem manifest in an existing environment or was it introduced on a new install/migration/host?
        2. What caching settings have you setup in Modx System Setings
        3. Are there any other hosting environment caching practices being implimented (cloudflare for example, server, proxy, etc.)
        4. Any other site changes or environment changes prior to issue

        Hi Charles,

        My answers:

        1. This site has been running for two years now, no changes or new install/migration or host
        2. I've attached a screenshot of our caching set-up. There most certainly haven't been any changes to these settings to trigger this problem.
        3. I will have to query our server provider about their caching practises. I've never heard of cloudflare so I'm assuming they don't use it (or have never mentioned it to us)
        4. Unfortunately, there is nothing I can point my finger to. I have not done any major changes to this site for years now. The client has been simply making changes to resources and uploading files/pdf's etc...just normal content editor stuff

        Thanks for the info about the RSS Feed. I was certain it was some hacker trying to be smart.

        I'll rename the cache folder and create a new one. I was just worried that I would just be bringing down the whole site if I deleted the core/cache folder at this time.

        Regards,
        Sar
          ☆ Flag it! - Don't forget to "star" a reply if it's answered your question smiley
        • Also note that CDN services often do not require any "code" changes and can be completed via DNS changes. Let me know what else you find out from the further information, but from what you provided it doesn't seem like any issue specific to the modx application at this point, especially if no change after renaming the cache folder.

          Cheers
            Evo Revo // Ubuntu, CentOS, Win // Apache 2x, Lighttp (Lighty)
            Visit CharlesMx.com for latest news and status updates.
            • 44985
            • 27 Posts
            Quote from: charless at Oct 03, 2013, 04:08 AM
            Also note that CDN services often do not require any "code" changes and can be completed via DNS changes. Let me know what else you find out from the further information, but from what you provided it doesn't seem like any issue specific to the modx application at this point, especially if no change after renaming the cache folder.

            Cheers

            Hi Charles,

            As you suggested, I renamed the core/cache folder "_cache". The moment I did that:

            • MANAGER - the manager went white
            • FRONT END - Wayfinder calls, and content etc from the Front End disappeared
            • FRONT END - However, the template still shows up. Like the images and stuff.
            • SERVER - The cache folder didn't generate itself in the core folder
            • SERVER - I then created a cache folder with the correct permission, but it was almost like the site doesn't detect it.

            Here's an example of the server's Error Logs after I renamed the cache folder. It's that RSS Feed folder again!:
            [Fri Oct 04 08:52:26 2013] [error] [client 202.72.162.143] Cache unable to open file for writing: /home/website/public_html/core/cache/rss//2552d997701d0d006f31cce7d173cba6
            [Fri Oct 04 08:52:26 2013] [error] [client 202.72.162.143] Cache couldn't make dir '/home/website/public_html/core/cache/rss/'.


            Fingers crossed I get this situation sorted by today. I haven't heard back from the server provider yet.

            Thanks for your help,
            Sar [ed. note: sarahactivated last edited this post 10 years, 5 months ago.]
              ☆ Flag it! - Don't forget to "star" a reply if it's answered your question smiley
            • discuss.answer
              • 44985
              • 27 Posts
              Hi again,

              The site is back up and running. I can't say what it was that solved the issue but I did the following two things:

              1. DATABASE - I cleared the "prefix_session" table from the database
              2. SERVER - I renamed my "core/cache" folder to "core/_cache". Then I created a new "core/cache" folder with permissions "777"

              I did the second point already yesterday but it didn't solve the problem, so maybe the first point had something to do with it!? I don't know! But geez I'm glad the site is back up and running!

              Sar
                ☆ Flag it! - Don't forget to "star" a reply if it's answered your question smiley