redirecting to another site

  • It's unlikely to be plugin related. It sounds like your web directory was writable which is a big security problem. If your web server can write a file in your web directory, you can lose control over the code that is run. If this is on Linux, your directories should probably have permissions 755 and your files 644.

    You also need to make sure that your data directory is not directly accessible from the web. Otherwise, someone could upload a script and then run it.

    I don't know anything about running a web server on Windows - what permissions you can set and so forth.

  • @Nick which line of the two that you listed results in the problem?

  • @Cash just did a quick check and 

    echo elgg_view('metatags',$vars);

  • @Nick, if it is the 'metatags', check if views/default/metatags.php exists. Elgg is not distributed with a file there. If you do have a file there, someone else put it there. That means your server is insecure.

    If that file does not exist, you can locate where the troublesome view is with my developers tool plugin: http://community.elgg.org/pg/plugins/project/384962/developer/costelloc/elgg-developer-tools

    It adds an admin sidebar menu item for the tools. One of the tools is called "Inspect". Inspect the views and then find the one called metatags. It should list what files are adding to the metatags view.

  • Turns out it is the access_privacity plugin. Disbale this plugin and all should be fixed. I am guessing that calling the .js scripts is causing issues whether that be on purpose or otherwise. Let me know if that works for everyone else. This is the metatags.php file from access_privacity/views/default. This is also the code that i identified using firebug that was causing the redirects. Thanks for the elgg tools plugin Cash. Works awesome!

    <?php
    $keywords = get_plugin_setting('keywords', 'access_privacity');
    ?>
    
    <!-- Custom SEO Elgg Meta Tags by Juipo - http://juipo.com/ . Search Engine Optimization by http://seojr.com/ -->
    
    	<meta name="description" content="<?php echo $vars['config']->sitedescription; ?>" />
    	<meta name="keywords" content="<?php echo $keywords; ?>" />
    
    
    <!--  JavaScript image combobox v2.35    http://www.marghoobsuleman.com/jquery-image-dropdown -->
    
    <!-- <script src="msdropdown/js/jquery-1.3.2.min.js" type="text/javascript"></script> --> 
    <!-- <script src="http://www.marghoobsuleman.com/mywork/jcomponents/image-dropdown/samples/msdropdown/js/jquery-1.3.2.min.js" type="text/javascript"></script> -->
    
    <script src="http://www.marghoobsuleman.com/mywork/jcomponents/image-dropdown/samples/msdropdown/js/jquery.dd.js" type="text/javascript"></script>
    
    <link rel="stylesheet" type="text/css" href="http://www.marghoobsuleman.com/mywork/jcomponents/image-dropdown/samples/msdropdown/dd.css" />
     
  • I deleted the code and now  I have my site back, but when accessing the Dashboard i get a error message from the browser showing: "Object#<Object> has no method 'msDropDown' ". Another file must be corrupted.

     

    About previous message (plugins): My site was running for months without such a great problem. For that time I didn't make any plugin installation, but last weekend I tested some. So, in the stressing moments after my site "redirect problem", I just tried to quickly find a source for the problems. Yes, I admit it, that I couldn't have make accusations without test all third party plugins.

  • The plugin question includes scripts from another site: marghoobsuleman dot com

    It is never a good idea to include a script from another site unless you have a lot of trust in it (like google's cdn network). If that site gets hacked, your site is now compromised.

    I'll post a warning on that plugin's page and possibly remove it.

  • Okay - I checked into it. The domain expired and someone else grabbed it and put in a redirect for all pages. Nothing malicious just very annoying for those of you using it.

    I'm thinking we need to do a series of blog posts on security.