EditorServiceProvider.php

Permalink
Everything was working fine until 2 days ago ( and I swear that I made no changes!!!)

Yesterday, I went to our website (secretsdupuits.com) and could no loger access it. The error message I get is:

Fatal error: Namespace declaration statement has to be the very first statement in the script in /htdocs/concrete/src/Editor/EditorServiceProvider.php on line 2

The script of that file is:

<?php
namespace Concrete\Core\Editor;

use \Concrete\Core\Foundation\Service\Provider as ServiceProvider;

class EditorServiceProvider extends ServiceProvider
{

public function register()
{
$this->app->bindShared('editor', function() {
return new \Concrete\Core\Editor\RedactorEditor();
});
}


}

I have tried to:

1- remove the space just before " <?php", it does not work

2- I edited the file script to: (found in the latest concrete5 update)
<?php
namespace Concrete\Core\Editor;

use \Concrete\Core\Foundation\Service\Provider as ServiceProvider;

class EditorServiceProvider extends ServiceProvider
{

public function register()
{
$this->app->bindShared('editor', function() {
return new \Concrete\Core\Editor\RedactorEditor();
});
}


}

... and I get the message "Class \Concrete\Core\Validation\SanitizeService does not exist'

Can someone help?

Many thanks in advance !

JF

SecretsduPuits
 
MrKDilkington replied on at Permalink Reply
MrKDilkington
Hi SecretsduPuits,

Do you have a site backup taken before the error started?

To clarify, before the error, you made no changes to core files? Core files are files inside the concrete directory.

If you are missing files, then I would take a full backup of your current site. After backing it up, upgrade your site from 5.7.5.2 to the current 5.7.5.3.

Here is a tutorial on manually upgrading:
http://documentation.concrete5.org/tutorials/how-to-manually-upgrad...
SecretsduPuits replied on at Permalink Reply
SecretsduPuits
Hi Mr K,

Many thanks for taking the time to answer.

My responses and updated info:

Yes, I have several Mysql backups. I tried to restore them, but it did not fix the problem.

Meanwhile, I found that the file SanitizeService.php was added the extension "suspected", which made the file inactive. After replacing the file from the 5.7.5.3 API database, my site is up again

I found several php files with the "suspected" extension, which I have all cleaned and/or removed

BUT, there is a big BUT!

I can no longer login, thus I can no longer modify the site or access the dashboard.

When I try login, I get the message "Namespace declaration statement has to be the very first statement in the script"

But there is no "namespace" in the script of the given login.php ???

I am stuck !

Regards,

JF
MrKDilkington replied on at Permalink Reply
MrKDilkington
@SecretsduPuits

A MySQL backup is not a full backup. If you are having problems with files, restoring the MySQL data will not address it. A full backup is both your install files and MySQL data.

Something is changing the file name to "SanitizeService.php.suspected"?

Do you have some type of server anti-virus running that could be falsely flagging files and changing their file extension? If so, disable it and then manually upgrade your site.
SecretsduPuits replied on at Permalink Reply
SecretsduPuits
Thanks again Mr K,

Where is located the content of the site? In the concrete5 files or only in the MySQL db? (sorry, I am not an IT specialist)

Yes, something is changing the file name "SanitizeService.php" and it did it again this morning !!!

I have reported this to my web hosting provider and await his response.

From my reading on the web, this is caused by hackers.

My web hosting provider is supposed to have full safety protection !!!

But still, I can't log on the site althought the login.php files seem to be fine !

Regards,

JF
daenu replied on at Permalink Reply
daenu
Sounds to me like your site has been hacked...... Take your site down immediately!

The fact that files keep changing even after you "re"changed them is a typical symptom of a hacked site.

Some infos about:https://www.chriswiegman.com/2013/06/how-to-tell-if-your-site-has-be...

You may check that here:http://isithacked.com/ or here:http://sitecheck.sucuri.net/

Also if you have Google Webmaster tools, you may have a look there if something is wrong.