I had my Drupal 6 running for 2 yrs now. Suddenly it started to give parse errors on index.php page. I opened the file and saw that there were 100-200 empty lines after php closing tags. There is no chance that some one can have changed the file as access is with me only. What may be cause for this? Does any changes in server like upgrade of php version may cause this. I haven't changed the index.php file and it was running perfectly fine till date. The website is hosted on some other server.
-
2Did you check the last modification date of the file on your server before you did override it?– Tyler DurdenCommented Apr 2, 2012 at 16:17
-
@Syd Barrett - I made that mistake. In order to bring the website live ASAP, i replaced the code file.– HackerCommented Apr 3, 2012 at 6:38
2 Answers
If your index.php file is different from the default one, then it has been changed from somebody. Updates to modules don't alter the content of that file. If there is a module that tries to alter the content of index.php, that is not the correct behavior for that module.
I would check that the permissions of the system user used to run the server, and PHP, don't allow it to alter any file contained in the Drupal root directory, and in its sub-directories.
In Drupal 6, the content of index.php is the following one. It is 39-line long, it includes an empty line after drupal_page_footer();
, and it doesn't have any closing tag (?>
).
<?php
/**
* @file
* The PHP page that serves all page requests on a Drupal installation.
*
* The routines here dispatch control to the appropriate handler, which then
* prints the appropriate page.
*
* All Drupal code is released under the GNU General Public License.
* See COPYRIGHT.txt and LICENSE.txt.
*/
require_once './includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
$return = menu_execute_active_handler();
// Menu status constants are integers; page content is a string.
if (is_int($return)) {
switch ($return) {
case MENU_NOT_FOUND:
drupal_not_found();
break;
case MENU_ACCESS_DENIED:
drupal_access_denied();
break;
case MENU_SITE_OFFLINE:
drupal_site_offline();
break;
}
}
elseif (isset($return)) {
// Print any value (including an empty string) except NULL or undefined:
print theme('page', $return);
}
drupal_page_footer();
-
It again happened. And this time, at the beginning of the index.php file junk characters were added.– HackerCommented Apr 11, 2012 at 7:23
I would imagine the server has either had an upgrade for its running PHP config, or some files have been modified/potentially hacked.
Have you been keeping core updated?
-
1indeed, especially since there shouldn't be a closing php tag there in the first place. I'd go look at a backup and see what might have been maliciously inserted in there by diff'ing the current and previously working version. Commented Apr 2, 2012 at 16:11
-
You wont have a closing tag in the index.php. "Omitting the closing tag prevents the accidental injection of trailing white space into the response." -stackoverflow.com/questions/1781343/…– WestieUKCommented Apr 2, 2012 at 16:20
-
@WestieUK- It again happened. And this time, at the beginning of the index.php file junk characters were added.– HackerCommented Apr 11, 2012 at 7:23
-
In this case it sounds like your installation has been compromised, the problem is after clearing it up there may be a backdoor left behind. Change all passwords to do with your hosting (FTP / database) and Drupal installation (UID 1, admins and config.php). Also install : drupal.org/project/md5check and check to see what other files might have been tempered with also see the docs: drupal.org/node/213320– WestieUKCommented Apr 11, 2012 at 7:38