Theme deactivated

Permalink
We run multiple sites on a single core which caused some problems getting correctly indexed by Google.

Now we managed to get the sites indexed perfectly but some of our site have the problem that the theme keeps getting deactivated.

The only thing we changed from before signing them up to after signing them up is running the "installed jobs" under maintanance mode so we'd get a good sitemap.

in our logs I can find nothing special, just the following makes me think google is the cause:

66.249.65.187 - - [09/Aug/2010:09:55:21 +0200] "GET /index.php/dashboard/pages/themes/remove/77/1280751667:7238897c17e07f0a54aaf9e91ee77e98/ HTTP/1.1" 200 3220 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

netaffairs
 
Remo replied on at Permalink Reply
Remo
that's really wired. You get status code 200 to a dashboard url. This might be a bug in concret5 but googlebot shouldn't never be able to execute tasks in the dashboard, nor should it find any links to it (with the exception of /login)

I'd change the password and add an .htaccess file to block google ip's accessing /dashboard.

That doesn't really fix the problem but the fact that google seems to be able to call /remove/77 is rather strange..
netaffairs replied on at Permalink Reply
netaffairs
Thanks. We'll start testing if that works.
agedman replied on at Permalink Reply
agedman
If you go to Dashboard > Sitemap > Full Sitemap and check the box to show system pages, then expand the nodes until you see the Themes page, then click 'set permissions', what do you see? I'm seeing read, write and admin for administrators only.

I tried hovering over one of the remove theme buttons, making note of the url, then logging out and pasting the url in my browser. I get a 404 Not found. When I logged back in and pasted the same link. It de-activated the theme. That seems to indicate that the code is ok. A googlebot couldn't possibly be logged in -- could it? Wouldn't it have to be able to provide a cookie?
netaffairs replied on at Permalink Reply
netaffairs
We checked that.
The dashboard (an everything below that) rights are only for Administrators and a specific group we created.
agedman replied on at Permalink Reply
agedman
Can you post or attach your Environment string from Sitewide Settings > Debug ?