OK. I finally was able to access my wayfinder call and update it to pdoMenu. So now, the site is running OK on the front end. The manager is not working well at all. Not sure what's up with TinyMCE. Tried to install again and got tons of errors. As long as the site loads on the front end I'm OK.
Need to stop spinning my wheels here and start making a plan for a migration to another server, and hopefully in a way that does not also bring along the plague that has infected this site.
Sidenote:
Even though I did a force removal of TinyMCE, there is still a folder for it in assets/components and all of the files are locked. As well, there is a jscripts folder inside TinyMCE buts it's empty and the js files are outside that folder. Probably if those are locked, I won't be able to delete through the manager.
-
☆ A M B ☆
- 24,524 Posts
Sounds like a file system problem, with file ownership and permissions getting scrambled on writing new files.
I've had some servers configured to only allow script execution from within an arbitrary number of folder levels. For example a .php script deeper than four levels would not be allowed. TinyMCE requires six levels (or did at one time) to be able to include the settings .php files. - assets/plugins/tinymce/ just to begin with. It looks like now everything is in four or less folders, but at the time it was a problem.
Certainly core services and 2.2.6 to 2.3.0 to 2.3.1 may just be too much. Probably if I kept after it I could work it through. But, I have a magazine to produce within the next 24 hours, and this whole core services hack has definitely been a detour. I'll move this site over to a MODx friendly host I'm with this weekend. I think really my biggest concerns are:
1. How not to bring any malicious files along for the ride
2. How to bring in the site without having to literally rebuild all of my chunks, tvs, etc. Can a site be regenerated from the database — assuming that the database is not corrrupted as well? I mean, if I install 2.3.1, bring over my css and images, etc, can the site be put back together without copying the core, connectors and manager directories?
Actually, think I will skip trying to migrate. I'll just rebuild. The new host will be in test url mode, and the old site is somewhat functional. I can probably copy out my template layouts and i don't really have that many chunks and tvs. Tedious, but doable.
The danger is that some evil code may be in the database. We know that the core services plugin was there, but we don't know what else is in there.
You definitely don't have to copy the core, connectors, and manager directories. Everything that needs to be in them should be installed during setup.
Patrick at SkyToaster has cleaned a number of sites with the core services hack and has moved many MODX sites to SkyToaster. If I were in your situation, I would be inclined to hire him to do the transfer and clean the site.
-
☆ A M B ☆
- 24,524 Posts
I've been playing with advanced setups on my localhost for all my development sites. On the Mac, it's pretty easy - I put a "revo-cores" folder one level above the web root. When I install, I put my core there, named after the folder where I'll install the rest, for example "revo231-bkup" is where I'm developing a full backup and restore utility CMP, so my core goes in revo-cores/bkup-core. Then I have the revo-cores directory in the Finder sidebar, so I can get to my cores quickly - when I remember that's where they are, and don't sit stupidly looking at the installation and dimly wondering what happened to the core folder. And renaming the manager folder leads to all sorts of blank WTF moments when revo231-bkup/manager throws a not-found error... 10 years of habit is proving hard to break!
I hear that it's possible to run the Manager on one virtual server, while the front-end runs on another virtual server. That way bunches of people working in the Manager won't impact your front-end, and a high visitor load won't bother your Manager users. I can't wait to see that one in action!
OK. So if I have not worn out my welcome... I'm looking for a last bit of advice. After doing some review online based on the errors in the goDaddy error log, others were having similar issues with their WordPress sites as a result of either an update in Wordpress, or updates that goDaddy was doing on their end. The solution for many of the posts I read was to move to another host.
Having this Core Services hack has left me a bit nervous about migrating this site. Is there a method for me to quickly scan/search all of the site files for specific lines of code in order to determine whether or not remnants of the CoreServices still exist? I've tried using TextWrangler doing a search for base64_decode, and @eval and really kind of came up with nothing. There were some instances of base64_decode, but they did not contain the random string of characters.
Either way I am facing a move this weekend, and want to be as efficient with my time as possible. Troubleshoot porting a site currently limping along, or start fresh? I just thought if someone has a method for scanning more thoroughly that might be helpful. The concept of looking for files I don't recognize is a bit difficult for me due to my lack of familiarity with all of the files deep within MODx. Or, is there anything that might have been inserted in my database by the hacker that I might search for?
At the risk of repeating myself:
If I were in your situation, I would be inclined to hire Patrick to do the transfer and clean the site.
If anything, perhaps it can be an experiment of how fast I can put a site back together. From now on I won't wait so long to do an update. Lesson learned. Your feedback and Susan's too has been extremely helpful in more ways that one. I'm learning more and more about MODx and getting more comfortable and confident.