Security Suggestion

Okay a little more investigating on the two sites I know have been hacked.  If you have your dbconfig.php file in a folder inside your eFiction folder and that folder is called "data" RENAME IT NOW!  In fact, if you can, move it.  At the very least rename it to a very wierd name, edit config.php to point to the renamed folder, then CHMOD it so it's not accessible.  Also put a blank index.php in that folder so hackers can't confirm that's where your config file is.

Also, if you have the phpinfo.php file on your server DELETE IT. It's not necessary for the function of your site, and it a way for hackers to get a good deal of useful information.

when i change my messages folder to 644 i get this....

Warning: file_get_contents(messages/copyright.txt): failed to open stream: Permission denied in /usr/home2/nsync908/public_html/archive/func.pagemenu.php on line 68

Warning: file_get_contents(messages/welcome.txt): failed to open stream: Permission denied in /usr/home2/nsync908/public_html/archive/index.php on line 38

😳 😳

edit: my site was hacked too... yesterday http://www.nsyncfiction.com/archive
he edited my welcome message and site title ... his name was "VIPSTA".

Change the folder back to  755 and the files in it to  644. Also, it is a good idea to make sure every folder has a blank index file.

thanks Carissa! that fixed the errors i was getting 🙂

could you let me know where i can fix the review notfication emails? that was hacked too i think, members have been emailing about that too.

Are you saying they changed the text? If so, you'll need to go into the en.php file in the languages folder and change it back to the original. If you don't have a backup on your computer, download a new copy and either replace the file or copy over what they changed.

Given what they've done on other sites, and how we suspect they've gotten in, I don't see how it was possible for them to get into that file though...

Another suggestion.  From the logs I've been sent it looks like our hacker is finding sites using google and searching for "Powered by eFiction".  If your skin lists this in the footer, we won't be offended if you take it off.   

Or you can always change it.

Driven by eFiction
Vitalized by eFiction
Energized... change it to fit your fandom.

Some great suggestions.  I moved my dbconfig file to a level above my web directory  (For example if your web is in /var/www/ I moved it to /var/data/)  This way it can not be accessed via a browser call.

Some great suggestions.  I moved my dbconfig file to a level above my web directory  (For example if your web is in /var/www/ I moved it to /var/data/)  This way it can not be accessed via a browser call.

I've had mine there from the start  😆

I suggest doing some robots.txt so that all the other folders that should not be indexed by search bots are not.

Ah, one problem with robots.txt is that while most robots will respect it, others will use it as a road map to exactly the folders you don't want them in.

Do a google sitemap if your sites are listed with google, in fact just do one or a robots txt.

Lazuli, I didn't know some bots do that, it must be the evil ones  👿

Some great suggestions.  I moved my dbconfig file to a level above my web directory  (For example if your web is in /var/www/ I moved it to /var/data/)  This way it can not be accessed via a browser call.

I've had mine there from the start  😆

Me too.  Seems like people ought to be doing that anyway.  It tells you to do it right in the README.txt file. 

4) Modify data/dbconfig.php with the appropriate MySQL database info, and put outside the web directory.

Yeah, I'm one of those nerds who always reads through the instructions before starting a project.  My brothers laugh at me for it.  Then when they can't get stuff to work, they call me for help.  hahaha

Anyway, if it's outside the web directory, it shouldn't need a blank index page in the same folder, should it?

No, it shouldn't, because they can't access those files anyway.