Hello? Is there someone here who can help me with this problem?

I would like to make sure this script works properly on my server as soon as possible, before the hackers get another chance at getting in again.

Thanks!

The problem is that the script is parsing a file that it shouldn't and trying to edit a file that is nonexistent. here is the fix...

file: functions.php

replace all of parseRules() with
------------------------------------

function parseRules() {
//use fopen(w) instead of unlink becuase unlink removes 777 permissions and replaces with system default!
//faster way???
$fp1=fopen('./data/HTTP_HEADERS', 'w'); //clear contents of headers
$fp2=fopen('./data/HTTP_GET', 'w'); //clear contents of get
$fp3=fopen('./data/HTTP_POST', 'w'); //clear contents of post
$fp4=fopen('./data/HTTP_COOKIE', 'w'); //clear contents of cookie
fclose($fp1);
fclose($fp2);
fclose($fp3);
fclose($fp4);
if ($handle = opendir('./rules')) {
while (false !== ($file = readdir($handle))) {
if ($file != "." && $file != ".." && $file != ".htaccess") {
parseRuleSet('./rules/'.$file);

}

------------------------------------

replace all of parseRuleSet($ruleFile) with
------------------------------------

function parseRuleSet($ruleFile) {

}
}
}
foreach($dataSets as $where) {
if (!empty($where['data'])){//if data is empty, don't write
fwrite($fp[$where[0]], $where['data']);//optimize into one fwrite for each file!
}
}
fclose($fp['HTTP_HEADERS']);
fclose($fp['HTTP_GET']);
fclose($fp['HTTP_POST']);
fclose($fp['HTTP_COOKIE']);
}

------------------------------------

Hope that helps!
-fastest963

seems like it was removed from the main issues page, sorry

just in case anyone has any problems with the copy/paste I made (I forgot to htmlentities() it), here is a link to my full version...

http://fastest963.us.to/munin/echo.php?p=2

from there you can update your version with mine!

once again, sorry for all of the confusion!

Hello,

Thanks for your response. The problem is not resolved yet, however.

Recently I moved my website to a different server (a virtual private server). The Munin script would not work as long as I was working with a temporary URL, but once my domain name had moved over, it started working again - this I know because my Joomla pages no longer show up as blank when the code is inserted to index.php files. Also, I see that log files are being created in my /data/ directory, giving details of injection attacks (there are several such attacks per hour).

When I turn on "display errors" in my php settings, and I login as admin in Munin, I see the following errors:

- Overview page:

Above "Welcome to Munin":

Notice: Undefined index: p in /home/david/druidcircle.org/munin/index.php on line 135

Left (below menu links but just above the "about" link):

Notice: Undefined index: p in /home/david/druidcircle.org/munin/index.php on line 104

Notice: Undefined index: p in /home/david/druidcircle.org/munin/index.php on line 104

- Event log page:

Above "Date Event ID Message User-Agent" (the table itself is empty):

Notice: Undefined offset: 1 in /home/david/druidcircle.org/munin/pages/logs.php on line 43

- Manage rules page (only when clicking "rebuild rules"):

Fatal error: Call to undefined function parserules() in /home/david/druidcircle.org/munin/pages/rules.php on line 27

When I click on one of the rule files in the left menu:

Please turn magic_quotes_gpc Off to use this editor

As for the main "overview" page, it still says I have 1,000 event (from January 01 1970). With the system overview it says nothing next to "active rules" and "database size".

Maybe I'm doing something wrong?