[pmwiki-users] Vulnerability being exploited

[Crisses]

On Dec 22, 2006, at 7:17 AM, Wade Hudson wrote:

> Crisses,
>
> Thanks much for your response. I appreciate your offer to do it for  
> me for a fee, and may take you up on it later, but I'd like to  
> learn how to do it myself and it seems your direction will enable  
> me to do that.

Not a problem.  My company's mission is essentially "Teaching people  
how to TEACH people how to fish."  So I give people guidance, include  
training with package deals, etc.  but I also have to eat, so I  
charge money when people DON'T want to learn ;) when they don't have  
the time, or it's really too much for their level of knowledge to  
handle.

> The site is http://progressiveresourcecatalog.org/index.php

Nice!   A site after my own heart.

> My version is pmwiki-2.0.13.

That's pretty old.  It's definitely time to upgrade.  I suggest  
upgrading to the latest 2.1.x but the 2.2 beta 17 seems pretty stable  
if you would rather make the giant leap.

This means you should review the Release Notes for changes between  
the 2.0 and 2.1 series, at minimum.  Patrick tends to make pretty  
large leaps between the .x revisions.  If you want to do 2.1->2.2 I'm  
current on what needs to change for that part....it will probably  
involve changes to the skin/template of the site.



> The only *.php files in my cookbook directory are comments.php and  
> mailform.php.
> I use the dropdown skin.


I have a feeling it might be either the comments or mailform that are  
causing the problems.  You should look at those pages and see if  
there were bugfixes.  I'm not sure if the current recipes will work  
with 2.0.13 though.  hence one need to upgrade.

> Using WinSCP, I'm copying everything to a backup folder at the  
> moment. It'll take a while longer. After that is complete, I could  
> send you the config.php file.

You may just want to change the passwords in the file.

> How do I upgrade, step-by-step? (Like I said, I'm a novice :- 
> [   and the pmwiki site is down at the moment).

Yeah -- I was wondering about that.  I can send you the 2.2beta17 --  
I think I have it, but the comment and mailform scripts are another  
thing -- I don't think I have those. :/

Hey, no problem!

Hope the site comes back -- even DNS is down.

Crisses