Forum
PHP in resources folder
Since I just updated Perch to the latest, and the markitup addon, I now receive this message in the diagnostics info:
"There are PHP files in your resources folder. These could be dangerous and a sign of a security breach."
Yet there are no php files in my resources folder.
Should I be concerned?
Chris, Did you update to 2.8.18, because there is a new feature which was added to this update
See MORE at https://grabaperch.com/update
If there are any files with a .php or .phtml extension in this folder you would get that message.
I found the file, its called 'cantseeme.phtml'. This is not a file I put there. Ive copied it to my local machine but removed it from the server and the error is gone. Any idea what this is though?
Yes, this is the issue we have been alerting people to as described in the email. The reason you needed to upgrade.
I would check to see if .phtml files execute on your web server (ie. if the file is there, if you click on it do you see a page or do you just see the code, or nothing?) If you see a page, then you should assume that an attack has been made on your server. If it doesn't execute, then you have nothing to worry about.
One of my clients who was on a server that did allow this script to function saw them investigate any text files on the server that may have password details, saw them grab the SQL details from Perch config and do a dump of the database, and then try to install software that would enable them to launch attacks on other websites from that server. This was all visible from the raw log files of the web server. So if the script does execute, you might want to check your log files for the time the file was uploaded and alert your host to the activity.
Rachel - it only appeared after I did the Perch update, not before.
Mallen - thanks for the info. I'm afraid I don't understand most of what you just said! However I removed the file and the site appears to be working fine, so Im hoping I wont have to worry about it
Yes - the Perch Update highlights any files like that they may have been uploaded. We didn't have that check in there before, the update didn't create the file it just showed you it was there.
Oh I see - sorry Im being slow. OK thats cool. Thanks both :)