<![CDATA[ Changes to the manager don't reflect on the front end - hack? - My Forums]]> https://forums.modx.com/thread/?thread=87001 <![CDATA[Changes to the manager don't reflect on the front end - hack?]]> https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479357 Description of Problem:

Our client's website hasn't been reflecting Manager changes since yesterday. I have not yet manually cleared the cache because I know that the whole site might just go down because this might be a serious issue.

I've had a look at our server's error logs and I saw this:
Cache unable to open file for writing: /home/website/public_html/core/cache/rss//2552d997701d0d006f31cce7d173cba6


Now, what's worrying, is that when I check out that file, I can see that it's an XML file to a "Magpie RSS" feed (whatver that means - which I've attached). and it's a feed about Critical MODX Security Issues. The first link I check out from one of the nodes pointed me to this:http://forums.modx.com/thread/84893/security-bypass-and-remote-execution#dis-post-468080.

If my site has been hacked, does anyone know which files I should be concerned about/replacing?

More Information:

  • You can edit resources in the manager just fine - everything saves and is reflected in the database. Just not in the Front End.
  • Nothing under Reports, System shows up in the Manager. Just a blank window.
  • The website is still up on the Front End. I'm assuming it's a cached version.



  • MODX Version: MODx Revo 2.1.3-pl (traditional)

Sar]]> sarahactivated Oct 03, 2013, 02:56 AM https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479357 <![CDATA[Re: Changes to the manager don't reflect on the front end - hack? (Best Answer)]]> https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479426
The site is back up and running. I can't say what it was that solved the issue but I did the following two things:

  1. DATABASE - I cleared the "prefix_session" table from the database
  2. SERVER - I renamed my "core/cache" folder to "core/_cache". Then I created a new "core/cache" folder with permissions "777"

I did the second point already yesterday but it didn't solve the problem, so maybe the first point had something to do with it!? I don't know! But geez I'm glad the site is back up and running!

Sar]]> sarahactivated Oct 04, 2013, 02:01 AM https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479426 <![CDATA[Re: Changes to the manager don't reflect on the front end - hack?]]> https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479424 Quote from: charless at Oct 03, 2013, 04:08 AM
Also note that CDN services often do not require any "code" changes and can be completed via DNS changes. Let me know what else you find out from the further information, but from what you provided it doesn't seem like any issue specific to the modx application at this point, especially if no change after renaming the cache folder.

Cheers

Hi Charles,

As you suggested, I renamed the core/cache folder "_cache". The moment I did that:

  • MANAGER - the manager went white
  • FRONT END - Wayfinder calls, and content etc from the Front End disappeared
  • FRONT END - However, the template still shows up. Like the images and stuff.
  • SERVER - The cache folder didn't generate itself in the core folder
  • SERVER - I then created a cache folder with the correct permission, but it was almost like the site doesn't detect it.

Here's an example of the server's Error Logs after I renamed the cache folder. It's that RSS Feed folder again!:
[Fri Oct 04 08:52:26 2013] [error] [client 202.72.162.143] Cache unable to open file for writing: /home/website/public_html/core/cache/rss//2552d997701d0d006f31cce7d173cba6
[Fri Oct 04 08:52:26 2013] [error] [client 202.72.162.143] Cache couldn't make dir '/home/website/public_html/core/cache/rss/'.


Fingers crossed I get this situation sorted by today. I haven't heard back from the server provider yet.

Thanks for your help,
Sar]]> sarahactivated Oct 04, 2013, 12:57 AM https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479424 <![CDATA[Re: Changes to the manager don't reflect on the front end - hack?]]> https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479361
Cheers]]> charless Oct 03, 2013, 04:08 AM https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479361 <![CDATA[Re: Changes to the manager don't reflect on the front end - hack?]]> https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479360 Quote from: charless at Oct 03, 2013, 03:41 AM


  1. Did this problem manifest in an existing environment or was it introduced on a new install/migration/host?
  2. What caching settings have you setup in Modx System Setings
  3. Are there any other hosting environment caching practices being implimented (cloudflare for example, server, proxy, etc.)
  4. Any other site changes or environment changes prior to issue

Hi Charles,

My answers:

  1. This site has been running for two years now, no changes or new install/migration or host
  2. I've attached a screenshot of our caching set-up. There most certainly haven't been any changes to these settings to trigger this problem.
  3. I will have to query our server provider about their caching practises. I've never heard of cloudflare so I'm assuming they don't use it (or have never mentioned it to us)
  4. Unfortunately, there is nothing I can point my finger to. I have not done any major changes to this site for years now. The client has been simply making changes to resources and uploading files/pdf's etc...just normal content editor stuff

Thanks for the info about the RSS Feed. I was certain it was some hacker trying to be smart.

I'll rename the cache folder and create a new one. I was just worried that I would just be bringing down the whole site if I deleted the core/cache folder at this time.

Regards,
Sar]]> sarahactivated Oct 03, 2013, 04:00 AM https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479360 <![CDATA[Re: Changes to the manager don't reflect on the front end - hack?]]> https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479358 Also if your using a CDN service like CloudFlare that would be a potential root source of the caching persistence.

Questions:


  1. Did this problem manifest in an existing environment or was it introduced on a new install/migration/host?
  2. What caching settings have you setup in Modx System Setings
  3. Are there any other hosting environment caching practices being implimented (cloudflare for example, server, proxy, etc.)
  4. Any other site changes or environment changes prior to issue

Cheers]]> charless Oct 03, 2013, 03:41 AM https://forums.modx.com/thread/87001/changes-to-the-manager-don-t-reflect-on-the-front-end---hack#dis-post-479358