Transition Technology: Ticket Query

Similar to the ‘full’ PSE widget output list (except not showing distance but town or city and Country)

<p><img alt="TransitionSantaCruz" src="http://transitionsc.org/sites/www.transitionnetwork.org/files/pixture_reloaded_logo.png" align="right" height="69" width="150"></p>

<p><a href="/web/20121022030350/http://transitionsc.org/sites/default/files/pixture_reloaded_logo.png" class="colorbox initColorbox-processed cboxElement">

s;/sites/default/files/;/sites/www.transitionnetwork.org/files/;

grep "sites/www.transitionnetwork.org/files" /var/backups/mysql/sqldump/transitionnetwor.sql | wc -l
113

src=\"http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/uploaded/u5857/Map-TransitionNetworkOffice.jpg\"

src=\"https://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/uploaded/u4/transition%20companion%20cover.jpg\"

/
//www.transitionnetwork.org/
Settings.php is not setup correctly. With the current configuration of 443 Session module, the following lines must be in settings.php.
      if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') {
        ini_set('session.cookie_secure', 1);
      }

grep "Unsafe statement written to the binary log" /var/log/daemon.log | wc -l
343

Mar 16 09:28:20 puffin mysqld: 130316  9:28:20 [Warning] Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT. Statements writing to a table with an auto-increment column after selecting from another table are unsafe because the order in which rows are retrieved determines what (if any) rows will be written. This order cannot be predicted and may differ on master and the slave. Statement: DELETE FROM notifications_event WHERE created < 1363426040 AND eid < (SELECT MIN(eid) FROM notifications_queue)

Mar 16 05:52:12 puffin mysqld: 130316  5:52:12 [Warning] Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT. Statements writing to a table with an auto-increment column after selecting from another table are unsafe because the order in which rows are retrieved determines what (if any) rows will be written. This order cannot be predicted and may differ on master and the slave. Statement: INSERT INTO notifications_queue (uid, mdid, send_method, sid, module, eid, send_interval, language, cron, created, conditions) SELECT DISTINCT s.uid, s.mdid, s.send_method, s.sid, s.module, 61233, s.send_interval, s.language, s.cron, 1363413132, s.conditions FROM notifications s LEFT JOIN notifications_fields f ON s.sid = f.sid WHERE (s.status = 1) AND (s.event_type = 'node') AND (s.send_interval >= 0) AND ((f.field = 'nid' AND f.intval = 30718) OR (f.field = 'type' AND f.value = 'profile') OR (f.field = 'author' AND f.intval = 16908)) GROUP BY s.uid, s.mdid, s.send_method, s.sid, s.module, s.send_interval, s.

content_field_region
Eval()
grep -R "variable_set() * > ~/static/variable_set-calls.txt" in the {{{sites/all
[  ok  ] Stopping Nginx Server...:
[ .... ] Starting Nginx Server...:nginx: [emerg] "log_format" directive is not allowed here in /etc/nginx/nginx.conf:28

# log for awstats
#log_format apache '$remote_addr - $remote_user [$time_local] "$request" '
#                   '$status $body_bytes_sent "$http_referer" '
#                   '"$http_user_agent"';
#access_log         /var/log/nginx/awstats.log apache;

From: root@penguin.webarch.net (Cron Daemon)
Date: Fri,  1 Aug 2014 14:06:48 +0100 (BST)
To: root@localhost
Subject: Cron <www-data@penguin> /web/stats.transitionnetwork.org/piwik/console core:archive --url=http://stats.transitionnetwork.org/ > /var/log/piwik-archive.log
ERROR CoreConsole[2014-08-01 13:05:18] [3e5ac] Got invalid response from API request:
+http://stats.transitionnetwork.org/index.php?module=API&method=API.get&idSite=1&period=week&date=last2&format=php&token_auth=XXXXXXXXXXXX&trigger=archivephp. Response was ' <div style='word-wrap: break-word; border: 3px solid red; padding:4px; width:70%;
+background-color:#FFFF96;'>         <strong>There is an error. Please report the message (Piwik 2.4.1)         and full backtrace in the <a
+href='?module=Proxy&action=redirect&url=http://forum.piwik.org' target='_blank'>Piwik forums</a> (please do a Search first as it might have
+been reported already!).<br /><br/>         Warning:</strong>
+<em>file_get_contents(http://api.piwik.org/1.0/getLatestVersion/?piwik_version=2.4.1&php_version=5.4.4-14%2Bdeb7u12&url=https%3A%2F%2Fstats.
+transitionnetwork.org%2Fweb%2Fstats.transitionnetwork.org%2Fpiwik%2Fconsole&trigger=API&timezone=Europe%2FLondon): failed to open stream:
+HTTP requ
 est fail
 ed! </em> in <strong>/web/stats.transitionnetwork.org/piwik/core/Http.php</strong> on line <strong>406</strong> <br /><br />Backtrace
+--&gt;<div style="font-family:Courier;font-size:10pt"><br /> #0  Piwik\Error::errorHandler(...) called at [:]<br /> #1
+file_get_contents(...) called at [/web/stats.transitionnetwork.org/piwik/core/Http.php:406]<br /> #2  Piwik\Http::sendHttpRequestBy(...)
+called at [/web/stats.transitionnetwork.org/piwik/core/Http.php:94]<br /> #3  Piwik\Http::sendHttpRequest(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/UpdateCheck.php:72]<br /> #4  Piwik\UpdateCheck::check(...) called at
+[/web/stats.transitionnetwork.org/piwik/plugins/CoreUpdater/CoreUpdater.php:142]<br /> #5
+Piwik\Plugins\CoreUpdater\CoreUpdater->updateCheck(...) called at [:]<br /> #6  call_user_func_array(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/EventDispatcher.php:98]<br /> #7  Piwik\EventDispatcher->postEvent(...) called at
+[/web/stats.transitionnetwor
 k.org/pi
 wik/core/Piwik.php:766]<br /> #8  Piwik\Piwik::postEvent(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/FrontController.php:391]<br /> #9  Piwik\FrontController->init(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/dispatch.php:33]<br /> #10  require_once(...) called at
+[/web/stats.transitionnetwork.org/piwik/index.php:47]<br /> #11  require_once(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/CliMulti/RequestCommand.php:53]<br /> #12  Piwik\CliMulti\RequestCommand->execute(...) called
+at [/web/stats.transitionnetwork.org/piwik/vendor/symfony/console/Symfony/Component/Console/Command/Command.php:252]<br /> #13
+Symfony\Component\Console\Command\Command->run(...) called at
+[/web/stats.transitionnetwork.org/piwik/vendor/symfony/console/Symfony/Component/Console/Application.php:887]<br /> #14
+Symfony\Component\Console\Application->doRunCommand(...) called at
+[/web/stats.transitionnetwork.org/piwik/vendor/symfony/console/Symfony/Component/Co
 nsole/Ap
 plication.php:193]<br /> #15  Symfony\Component\Console\Application->doRun(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/Console.php:64]<br /> #16  Piwik\Console->doRun(...) called at
+[/web/stats.transitionnetwork.org/piwik/vendor/symfony/console/Symfony/Component/Console/Application.php:124]<br /> #17
+Symfony\Component\Console\Application->run(...) called at [/web/stats.transitionnetwork.org/piwik/console:31]<br /> </div><br />
+</pre></div><br />  <div style='word-wrap: break-word; border: 3px solid red; padding:4px; width:70%; background-color:#FFFF96;'>
+<strong>There is an error. Please report the message (Piwik 2.4.1)         and full backtrace in the <a
+href='?module=Proxy&action=redirect&url=http://forum.piwik.org' target='_blank'>Piwik forums</a> (please do a Search first as it might have
+been reported already!).<br /><br/>         Warning:</strong>
+<em>file_get_contents(http://api.piwik.org/1.0/getLatestVersion/?piwik_version=2.4.1&php_version
 =5.4.4-1

Time:     Tue Sep 23 13:47:01 2014 +0100
IP:       XX.XX.XX.XX (HU/Hungary/XXXXXX.catv.pool.telekom.hu)
Failures: 5 (sshd)
Interval: 300 seconds
Blocked:  Permanent Block
Log entries:
Sep 23 13:46:28 puffin sshd[6056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=XX.XX.XX.XX  user=tn.ftp
Sep 23 13:46:30 puffin sshd[6056]: Failed password for tn.ftp from XX.XX.XX.XX port 54327 ssh2
Sep 23 13:46:33 puffin sshd[6056]: Failed password for tn.ftp from XX.XX.XX.XX port 54327 ssh2
Sep 23 13:46:56 puffin sshd[6409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=XX.XX.XX.XX  user=anewholm
Sep 23 13:46:58 puffin sshd[6409]: Failed password for anewholm from XX.XX.XX.XX port 54328 ssh2

Hello,
Our system detected that the site space.transitionnetwork.org has been hacked!
Common signatures of an attack which triggered this alert:
You are required to change your password immediately (password aged)
su: Authentication token is no longer valid; new one required
(Ignored)
Site tested positive for known Drupalgeddon exploit checks               [error]
Update module is disabled and Drupalgeddon cannot check for Drupal       [error]
Security Updates. Please check for a security update manually.
You are running Drupal 7.31
https://www.drupal.org/node/3060/release?api_version%5B%5D=103
The platform root directory for this site is:
  /data/disk/tn/distro/008/openatrium-7.x-2.19-7.31.1
The system hostname is:
  puffin.webarch.net
To learn more on what happened, how it was possible and
how to survive #Drupageddon, please read:
  https://omega8.cc/drupageddon-psa-2014-003-342
--
This e-mail has been sent by your Aegir system monitor.

/etc/php5/mods-available/apc.ini

Transition Technology: Ticket Query

#598: Redirect reconomyproject.org to reconomy.org

#712: Create a new stgX.transitionnetwork.org site

#802: Slovenian state information missing / 'Not listed' will not submit

#384: Enhance Project Profile Content Type and directory

#458: Projects form - Project profile page display

#459: Projects form - Project Directory display

#519: Fixing various URL in the Database

#520: Session 443 config in settings.php

#521: MySQL Unsafe statement warnings in the daemon.log

#523: Database intergrity

#537: Parrot setup and documentation

#540: HTTPS for WordPress sites

SNI and Seperate Certs and Shared IP

Multi-domain Cert and Shared IP

Seperate Certs and Dedicated IPs

Non-commercial CAcert Cert

#606: Site upgrade tasks -- pre-migration cleanup

C) Cleanup: List of features we don't really need

D) Key development tasks

E) Key editorial tasks

Z) old stuff for reference; tasks from #590 rendered pointless by move

#619: Upgrade WordPress sites to 3.9.1

#626: Add redirect from an old CMS to a new URL

#644: AWstats Nginx config breaks aegir

#671: Replace core Search module with Apache Solr

#675: Piwik Geolocation

#715: Views admin pages not visible.

#716: Heartbleed

#719: Transition Culture HTML Problems

#731: Meetings in maintenance

#740: Add 'class button block' to Soundcloud block

#741: Views editor disappears in backend

#742: Stg site to play with

#764: Policy decisions re-assessment on BOA and Drupal security updates

#768: Piwik Archive Cron Error

#787: Access to Parrot

#790: Annesley locked out of puffin

#806: IIRS pre-beta usability issues

#808: WordPress email being rejected due to From field

#809: [Security-news] Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2014-006

#812: space.transitionnetwork.org hacked?

#819: Trac anti-spam measures

#824: Analysis of the 2014 maintenance ticket time

#457: Projects form - Enhance form entry

#488: Set up Dev/Test and update CodeManagementReleaseProcess for new Aegir, Git, Drush make approach

#541: Documentation of the WordPress sites

#582: TN.org platform and sites

#590: Drupal performance improvements

Summary of actions and status

TODO

Done

#596: Captions issue

#714: Drop down menu useability on devices with touch screens

#727: Change background on block from orange to white

#737: SPF / Emails rejected from the website contact form

#758: * Advisory ID: DRUPAL-SA-CORE-2014-003

#772: new TIs not appearing on staging until caches flushed

#645: APC Tuning on Parrot and Penguin

#676: Alternative to Skype for TTech Meetings