Davaowin PH.REGISTER NOW GET FREE 888 PESOS REWARDS!

Resolved dmitridal
(@dmitridal)

8 years, 4 months ago

logs are showing the home page triggering timthumb…like crazy
xxxx is my IP addy

any thoughts?

[Wed Jul 13 18:56:49.464440 2016] [authz_core:error] [pid 28927:tid 140226876921600] [client xxxx:52411] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/plugins/bulletproof-security/403.php, referer: https://liveyogact.com/
[Wed Jul 13 18:56:49.464342 2016] [authz_core:error] [pid 28927:tid 140226876921600] [client xxxx:52411] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/themes/liveyoga/inc/timthumb.php, referer: https://liveyogact.com/
[Wed Jul 13 18:56:49.407307 2016] [authz_core:error] [pid 22062:tid 140226705979136] [client xxxx:52398] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/plugins/bulletproof-security/403.php, referer: https://liveyogact.com/
[Wed Jul 13 18:56:49.407178 2016] [authz_core:error] [pid 22062:tid 140226705979136] [client xxxx:52398] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/themes/liveyoga/inc/timthumb.php, referer: https://liveyogact.com/
[Wed Jul 13 18:56:49.321815 2016] [authz_core:error] [pid 22062:tid 140226705979136] [client xxxx:52398] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/plugins/bulletproof-security/403.php, referer: https://liveyogact.com/
[Wed Jul 13 18:56:49.321682 2016] [authz_core:error] [pid 22062:tid 140226705979136] [client xxxx:52398] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/themes/liveyoga/inc/timthumb.php, referer: https://liveyogact.com/
[Wed Jul 13 18:48:03.034659 2016] [authz_core:error] [pid 28927:tid 140226887411456] [client xxxx:51181] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/plugins/bulletproof-security/403.php
[Wed Jul 13 18:48:03.034598 2016] [authz_core:error] [pid 13149:tid 140226590590720] [client xxxx:51180] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/plugins/bulletproof-security/403.php
[Wed Jul 13 18:48:03.034577 2016] [authz_core:error] [pid 21299:tid 140226737448704] [client xxxx:51179] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/plugins/bulletproof-security/403.php
[Wed Jul 13 18:48:03.034545 2016] [authz_core:error] [pid 28927:tid 140226887411456] [client xxxx:51181] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/themes/liveyoga/inc/timthumb.php
[Wed Jul 13 18:48:03.034469 2016] [authz_core:error] [pid 21299:tid 140226737448704] [client xxxx:51179] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/themes/liveyoga/inc/timthumb.php
[Wed Jul 13 18:48:03.034444 2016] [authz_core:error] [pid 13149:tid 140226590590720] [client xxxx:51180] AH01630: client denied by server configuration: /home/liveyoga/public_html/wp-content/themes/liveyoga/inc/timthumb.php

https://www.ads-software.com/plugins/bulletproof-security/

Viewing 5 replies - 1 through 5 (of 5 total)

Plugin Author AITpro
(@aitpro)

8 years, 4 months ago

This timthumb.php script: /wp-content/themes/liveyoga/inc/timthumb.php is being blocked by something. BPS might be blocking access to this script, but I think it is probably something else you have installed like another plugin or maybe a security measure on your host server itself or if you added additional custom htaccess code in BPS Custom Code. Have you checked this timthumb.php script: /wp-content/themes/liveyoga/inc/timthumb.php to make sure it is not exploitable? TimThumb versions 2.0+ are patched/not exploitable/safe to use.

To check if BPS is blocking this TimThumb script or not, deactivate Root Folder BulletProof Mode. If the script is still being blocked then something else you have installed like another plugin or a security measure on your host server itself is blocking this script.

Thread Starter dmitridal
(@dmitridal)

8 years, 4 months ago

I will dig deeper, thank you for the quick advice. I have checked the version of the script, and it looks ok.

Thread Starter dmitridal
(@dmitridal)

8 years, 4 months ago

definitely not BPS, looks like a hardening of the wp-content directory by Sucuri.
the first three lines below are the error URLS, and the code snippet after is what was calling it.
looks like bad coding.

https://liveyogact.com/wp-content/themes/liveyoga/inc/timthumb.php?w=310&h=310&q=100&zc=1&src=https://liveyogact.com/wp-content/uploads/2013/12/10445992_870301923003523_2824224387085197880_n-e1411650358530.jpg&a=c
https://liveyogact.com/wp-content/themes/liveyoga/inc/timthumb.php?w=310&h=310&q=100&zc=1&src=https://liveyogact.com/wp-content/uploads/2015/04/10955511_993728987327482_607175690559276498_n-1.jpg&a=c
https://liveyogact.com/wp-content/themes/liveyoga/inc/timthumb.php?w=310&h=310&q=100&zc=1&src=https://liveyogact.com/wp-content/uploads/2013/12/1655869_735204899846560_1657646410_n.jpg&a=c

<div class=”container panels”>
<div class=”row”>
<div class=”col-md-4 col-sm-4″><img src=”https://liveyogact.com/wp-content/themes/liveyoga/inc/timthumb.php?w=310&h=310&q=100&zc=1&src=https://liveyogact.com/wp-content/uploads/2013/12/10445992_870301923003523_2824224387085197880_n-e1411650358530.jpg&a=c” alt=”” class=”img-responsive”>
<div class=”info”><h3>Live Yoga</h3> View Classes</div>
</div>
<div class=”col-md-4 col-sm-4″><img src=”https://liveyogact.com/wp-content/themes/liveyoga/inc/timthumb.php?w=310&h=310&q=100&zc=1&src=https://liveyogact.com/wp-content/uploads/2015/04/10955511_993728987327482_607175690559276498_n-1.jpg&a=c” alt=”” class=”img-responsive”>
<div class=”info”><h3>Yoga Teacher Training</h3> 200HR Program</div>
</div>
<div class=”col-md-4 col-sm-4″><img src=”https://liveyogact.com/wp-content/themes/liveyoga/inc/timthumb.php?w=310&h=310&q=100&zc=1&src=https://liveyogact.com/wp-content/uploads/2013/12/1655869_735204899846560_1657646410_n.jpg&a=c” alt=”” class=”img-responsive”>
<div class=”info”><h3>Special Events</h3> View Our Events</div>
</div>
</div>
</div>

Plugin Author AITpro
(@aitpro)

8 years, 4 months ago

Yep, I am pretty sure the Sucuri wp-content htaccess file/code blocks access to any/all php files. You can create your own custom htaccess code whitelist rules in the Sucuri wp-content htaccess file: https://www.ads-software.com/support/topic/sucuri-1-click-hardening-wp-content-htaccess-file-problem-detected?replies=9#post-6087304

Thread Starter dmitridal
(@dmitridal)

8 years, 4 months ago

yes, thank you for the tip, I did see that also.
at this point I have disabled the hardening for that directory within their plugin, and I have resolved those errors, however, the site needs to be redesigned anyway, calling timthumb just for a button size to create a responsive UX is shoddy. the theme is two years old at this point, it can go.
love your plugin, will review and recommend widely.
cheers

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘post hack install, site is mostly clean…..but…..’ is closed to new replies.