HACK, check your site: /assets/snippets/ditto/snippet.ditto2.php

Wow, that was fast and very helpful again, thanks!

Thank you mrhaw!

Can you help me to merge all these htaccess suggestions in a simple package for all Evo users?
I've created this repository:

https://github.com/Nicola1971/Evolution-custom-htaccess

I forked it and edited both .htaccess files. Review them:
https://github.com/mrhaw/Evolution-custom-htaccess

I can't figure out your equal sign!?
http://bit.ly/whatIsTheEqualSignFor

Maybe you can teach me what it's good for!

Quote from: fourroses666 at Aug 07, 2014, 02:55 AM

I also had a message from Direct Admin where the limit of sending e-mails / day was reached. On a 1.0.14 version. I noticed that evogallery wasn't updated.

Do you have EvoGallery?

There is a fix here:
https://github.com/Mark-H/EvoGallery/tree/master/assets/modules/evogallery/js/uploadify

My transalias folder is clean, couldn't find any other suspisious files.

I just came across this post that came in today:

https://forums.modx.com/thread/92600/malicious-files-detected-on-my-server-account#dis-post-506024

Is phpthumb snippet in 1.0.14 outdated an possibly a risk?

Our provider marks the phpthumb snippet delivered with MODX 1.0.14 as outdated. The actual version is 1.7.11, but in MODX 1.0.14 the snippet has version 1.2.

You think this could be another point of concern? There is an information disclosure exploit reported in version 1.7.9, see / search phpthmb here: http://www.exploit-db.com/exploits/17250/

Thx!

Quote from: mrhaw at Aug 08, 2014, 08:15 PM

I forked it and edited both .htaccess files. Review them:
https://github.com/mrhaw/Evolution-custom-htaccess

I can't figure out your equal sign!?
http://bit.ly/whatIsTheEqualSignFor

Maybe you can teach me what it's good for!

Thank you
which equal sign ?

Quote from: banzai at Aug 09, 2014, 06:43 AM

Quote from: mrhaw at Aug 08, 2014, 08:15 PM

I forked it and edited both .htaccess files. Review them:
https://github.com/mrhaw/Evolution-custom-htaccess

I can't figure out your equal sign!?
http://bit.ly/whatIsTheEqualSignFor

Maybe you can teach me what it's good for!

Thank you
which equal sign ?

EDIT: your modded htaccess cause an error 500 on my server

1. The equal sign you used: <filesmatch "\.(php|tpl)$"=""> // is it a YAMS thing?

2. I guess some of the default things I uncommented should be left commented.

Try now: https://github.com/mrhaw/Evolution-custom-htaccess/commit/5f0a174dbc45f44f7c3e13c7b4d46a7ad45e3b0b

Now this is the full spec:

--> This one does NOT re-direct to burp or blackhole but sends HTTP response 403 (FORBIDDEN).
Security @ Line 1-7 and @ Line 57-141

+ @ Line 16 I uncommented:
php_value date.timezone ...

+ @ Line 19-20 I added:
Options -Indexes
DirectoryIndex index.php index\.htm$l

// Added a readme --> https://github.com/mrhaw/Evolution-custom-htaccess/tree/master [ed. note: mrhaw last edited this post 12 years, 1 month ago.]

Still get 500 error

with this one works fine:
https://github.com/Nicola1971/Evolution-custom-htaccess/blob/1b5192e55fe917f46147d6dad157b2f645492deb/custom.root.ht.access

Edit: Solved - was the Line 16 (php_value date.timezon).
[ed. note: banzai last edited this post 12 years, 1 month ago.]

i found several php files across the installation but mostly in snippets and plugins. 100% cpu usage was the hint. if somebody is interested in evaluating that i could offer a backup. i had to say that i run 1.0.8 when recognizing it. now on the latest version. nice work!