Answered MODx 2.2.6 Manager Not Working Correctly. Missing Items & Blank Pages. OMG!

It's just plain wacky. Various file directories will have a triangle yet not reveal any contents, and at a certain point, the screen goes white. Then if I close my browser, then open a new window and navigate back to the manager, the file directory that was not listing any contents, now shows contents.

When I did the update, the only snag I had was that I had to make the core/config/config.inc.php writeable.

Here's the extent of my Modx error log:

[2014-07-21 21:26:08] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:26:09] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:26:17] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 21:26:17] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 21:26:19] (ERROR @ /connectors/lang.js.php) Error caching action map mgr/actions
[2014-07-21 21:26:19] (ERROR @ /connectors/lang.js.php) Error caching lexicon topic lexicon/en/core/resource
[2014-07-21 21:26:25] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 21:26:25] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 21:27:12] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:27:12] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:27:24] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:27:24] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:27:29] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:27:29] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:35:32] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 21:35:32] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 21:35:51] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 21:35:51] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 21:36:09] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:36:09] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:36:16] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 21:36:16] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 21:36:44] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 21:36:44] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 21:37:05] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 21:37:05] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 21:43:34] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 21:43:34] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 21:44:41] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:44:42] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:44:44] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:44:45] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:46:41] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:46:42] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:50:42] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:50:42] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:50:46] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:50:47] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:54:47] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:54:47] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:54:50] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:54:50] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:55:02] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:55:02] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:55:04] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:55:05] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:55:08] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:55:09] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:55:14] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:55:14] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 21:55:15] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 21:55:15] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:02:31] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:02:32] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:09:02] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:09:02] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:09:09] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:09:09] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:09:15] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:09:15] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:09:24] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:09:24] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:10:17] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:10:17] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:12:39] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:12:39] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:13:58] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:13:58] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:14:03] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:14:03] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:14:19] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:14:19] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:14:26] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:14:26] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:15:03] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:15:03] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:15:07] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:15:07] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:15:28] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:15:28] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:16:33] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:16:33] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:16:35] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:16:36] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:16:36] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:16:37] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:17:30] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:17:30] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:18:01] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:18:01] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:19:33] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:19:34] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:20:43] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:20:43] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:20:47] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:20:47] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:21:10] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:21:10] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs
[2014-07-21 22:24:42] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:24:43] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:24:46] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:24:46] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:24:47] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:24:48] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:24:49] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:24:49] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:24:51] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:24:51] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:24:53] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:24:54] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:25:01] (ERROR @ /index.php) [OnWebPageInit]1
[2014-07-21 22:25:01] (ERROR @ /index.php) [OnWebPagePrerender]1
[2014-07-21 22:25:04] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: http:// wrapper is disabled in the server configuration by allow_url_fopen=0
[2014-07-21 22:25:04] (ERROR @ /path/to/folder/manager/controllers/default/header.php : 115) PHP warning: get_headers() [<a href=’function.get-headers’>function.get-headers</a>]: This function may only be used against URLs

For plugins or snippets that actually return a value (like getResources), you don't need to do anything. It's only ones with no return at all that are a problem.

Now for the bad news. The presence of the "Core Services" plugin means that your site was hacked (probably when it was 2.2.6), which might explain some of the weirdness you've been seeing.

Disable that plugin immediately and look for and remove any users that shouldn't exist (especially a user named 'Support').

Disable any other plugins that you're not sure should be there (especially "Highlight Search"). Change all your usernames and passwords (MODX, DB, cPanel, FTP).

Look for, and remove, a file called cache.php in the assets directory. Check other .php files in the assets directory that contain code with @eval, or base64_decode with a long string of characters. Rename them.

Look in the /core/model/modx/modresponse.class.php file for any base64_decode lines.

Delete all files in the core/cache directory.

See this thread for more info: https://forums.modx.com/thread/?thread=85986

Reviewing system info, and yes: allow_url_open is Off.

Unsure of what that even is, I searched google. If turned on, could allow files to be retrieved from remote locations leading to vulnerabilities. Is it possible someone put something on the site or hack it while I was running MODx 2.2.6?

Well...you got there much quicker than I did.
I'll get to work and see what I can find.

Let me ask you this though. This site is an alias domain. If someone did hack this site — could they then also hack my others, which are not MODx. There are 3 static sites, and all seem fine.

OK. Thus far:

Deleted the Core Services Plugin.
Found and deleted the User "Support"
Then, deleted the core/cache

Will need to look for the other items you mentioned and review the link.

Thank you for bringing this to my attention. I may also need to review the MODx site I updated last week, though it seems to be acting OK.

I sure am glad you chimed in here tonight. Thank you.

One silly question: If I change the Database password — how do I get it changed in modx? Is that in the system settings?

In my assets directory there is:
.cache.idx.php
cache.php
xPDO.idx.php

Are all 3 of these bad?

Not sure if it's related or not.
I deleted .cache.php

An then renamed the other two. The File Manager then reported 13 files deleted. Very odd.

Pardon my asking, but what do base64_decode lines look like?

Quote from: mmcgee at Jul 22, 2014, 12:52 AM

One silly question: If I change the Database password — how do I get it changed in modx? Is that in the system settings?

It's in the core/config/config.inc.php file.