Advanced search  

News:

CPG Release 1.6.26
Correct PHP8.2 issues with user and language managers.
Additional fixes for PHP 8.2
Correct PHP8 error with SMF 2.0 bridge.
Correct IPTC supplimental category parsing.
Download and info HERE

Pages: [1]   Go Down

Author Topic: SiteMap Crawlers Delete All Photos  (Read 5964 times)

0 Members and 1 Guest are viewing this topic.

Spaatz

  • Coppermine newbie
  • Offline Offline
  • Posts: 6
SiteMap Crawlers Delete All Photos
« on: June 01, 2006, 04:19:29 am »

I just upgraded to 1.4.6 from 1.4.5 because I thought I was subjected to the security vulnerability discussed in previous threads as all of my albums and photos were deleted this morning.

Well, after putting it all back together, I ran a sitemaps scan of my site and low and behold, all of my albums and photos were once again deleted. 

It turns out that the sitemap generator was triggering some sort of delete command in my files.  Everthing in my album folder was deleted. 

My site is http://www.pphsreunion96.org/coppermine/

I have it open up for anyone to sign up and post pictures to public forums. 

Has anyone else run into this problem?
« Last Edit: June 04, 2006, 09:33:05 pm by Spaatz »
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: Web Spiders Delete All Photos
« Reply #1 on: June 01, 2006, 06:23:12 am »

we won't go through registration just to be able to help you. Post a test user account.
Logged

Spaatz

  • Coppermine newbie
  • Offline Offline
  • Posts: 6
Re: Web Spiders Delete All Photos
« Reply #2 on: June 01, 2006, 03:42:38 pm »

Username:  Test
Password:  Test

I ended up restricting all access to the /coppermine/ directory in my robots.txt file.  It appears to be working thus far.

Logged

Tranz

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: 00
  • Offline Offline
  • Gender: Female
  • Posts: 6149
Re: Web Spiders Delete All Photos
« Reply #3 on: June 01, 2006, 03:44:25 pm »

How can the spiders get to delete the photos if we humans can't even see the gallery without logging in? Are you using a hack that allows spiders special access?
Logged

Spaatz

  • Coppermine newbie
  • Offline Offline
  • Posts: 6
Re: Web Spiders Delete All Photos
« Reply #4 on: June 01, 2006, 04:16:51 pm »

I haven't modified the software in any way shape or form.  The only thing I did was run a javascript based google sitemap generator on the site root (http://www.auditmypc.com/free-sitemap-generator.asp) so that the google webspider could crawl my site more effectively.  Once the javascript sitemap generator was finished - poof, everything gone!  I reinstalled everything and then the google webspider came along and once again, poof! 

The gallery is bridged with phpBB2 - latest version.

So, no special hacks.  Just the basic installation.

I'm wondering about the config files in this case.  They are configured to use my login and password for the whole site to access the SQL database.  Could the spider be drawing from this password and userid when it runs delete commands?

Logged

Paver

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: us
  • Offline Offline
  • Gender: Male
  • Posts: 1609
  • Paul V.
Re: Web Spiders Delete All Photos
« Reply #5 on: June 01, 2006, 04:59:45 pm »

Delete is only allowed for Coppermine administrators.  Yes, the database login info is stored, but you still have to log in to Coppermine as an administrator using a non-stored username and password.  I don't understand how a sitemap generator or webspider can log in as an administrator unless you provided this information in the sitemap generator (I haven't looked at it yet to see how it works) or unless you added other users (like Registered or Guests) to the Administrators group - if that's possible - I have never considered such a thing.  Usually only one person is the administrator.
Logged

Nibbler

  • Guest
Re: Web Spiders Delete All Photos
« Reply #6 on: June 01, 2006, 05:24:34 pm »

Logout before running the sitemap generator, it seems to be a clientside crawler.
Logged

Spaatz

  • Coppermine newbie
  • Offline Offline
  • Posts: 6
Re: Web Spiders Delete All Photos
« Reply #7 on: June 01, 2006, 07:26:21 pm »

Logout before running the sitemap generator, it seems to be a clientside crawler.

I think we have an answer.  I cannot check it until tonight but I believe that this is the correct answer.
Logged

Spaatz

  • Coppermine newbie
  • Offline Offline
  • Posts: 6
Re: Web Spiders Delete All Photos
« Reply #8 on: June 02, 2006, 02:43:30 pm »

I think we have an answer.  I cannot check it until tonight but I believe that this is the correct answer.

Got home to find that lightning had fried my cable modem.  Will check it again tonight. 
Logged

Spaatz

  • Coppermine newbie
  • Offline Offline
  • Posts: 6
Re: Web Spiders Delete All Photos
« Reply #9 on: June 04, 2006, 04:15:47 am »

Logout before running the sitemap generator, it seems to be a clientside crawler.

We have a winner!   I ran a scan of the site after logging out and it didn't delete anything! 

Thanks for everyone's help!
Logged
Pages: [1]   Go Up
 

Page created in 0.028 seconds with 19 queries.