scanner.php question

cwk · 2009-02-04 4:38 pm

This is the output from scanner.php. Everything looks right in the code, version of phpBB, configs etc. What's this usually indicate?

04 Feb 2009 09:23 -- ERROR from API:
04 Feb 2009 09:23 -- ERROR from API:
04 Feb 2009 09:23 -- ERROR from API:
04 Feb 2009 09:23 -- ERROR from API:
04 Feb 2009 09:23 -- ERROR from API:
04 Feb 2009 09:23 -- ERROR from API:
04 Feb 2009 09:23 -- ERROR from API:

I can't find a debug option in PHP -- I've used Perl more often and can at least muddle my way through that with the -w and -d9 parameters. Suggestions?

MysteryFCM · 2009-02-05 1:51 pm

Without seeing what the error actually is, I can only suggest trying to have it show you?

Open scanner.php, and change (approx line #180);

    } else {
        // Something unexpected came back from the script
        writelog("ERROR from API: " . strip_tags($check_acct));
    }

To;

    } else {
        // Something unexpected came back from the script
        writelog("ERROR from API: " . strip_tags($check_acct) .' [ $matches[1]: ' . $matches[1] . ' ]');
    }

Since the error message is spat out based on whether $matches[1] is true, this will tell you what it actually contains.

cwk · 2009-02-06 5:41 am

The $matches variable appears to be empty. I've crawled around in this thing for most of the evening echoing $variables and haven't had much success. Congratulate me -- around 10:00 PM I successfully resisted the temptation to port it into either Perl or a shell script. With my original post I had hoped that someone might tell me I had obviously failed to reconfigure the fulminator variable, but alas, it looks to be a puzzle.

I'm pretty new to PHP. In general, are PHP scripts and installations always this idiosyncratic? I've snagged a several scripts over the past couple of days and none has run successfully right from the source. Always something like putting variables in curly braces and such. Is it my ISP? Just curious. Anyway, thanks for the look and the suggestion.

MysteryFCM wrote:

Without seeing what the error actually is, I can only suggest trying to have it show you?
Open scanner.php, and change (approx line #180);
    } else {
        // Something unexpected came back from the script
        writelog("ERROR from API: " . strip_tags($check_acct));
    }
To;
    } else {
        // Something unexpected came back from the script
        writelog("ERROR from API: " . strip_tags($check_acct) .' [ $matches[1]: ' . $matches[1] . ' ]');
    }
Since the error message is spat out based on whether $matches[1] is true, this will tell you what it actually contains.

MysteryFCM · 2009-02-07 10:21 am

As far as PHP scripts, alot depends on your PHP configuration as to whether or not they'll run properly.

cwk · 2009-02-11 5:29 am

Solved the mystery -- and created a couple more. The thing wasn't running because I had to modify /etc/php.ini

allow_url_fopen = On

It was off and so it would not allow PHP to open a URL.

Having done that, I generated a big list of spammy looking users that had registered in the past week or so. Then I made two -- no, three -- really boneheaded errors. I increased the time to the past 180 days. Which would have been okay, but I turned on $shoot_on_sight. Suddenly I was seeing names that looked too familiar.

The thing was deleting valid accounts.

That is apparently because they shared IP addresses with known spammers (not surprising if the spam is coming from virus-infected zombie PCs).

I had a fairly recent, but not immediate (third error) backup, but phpBB gagged on it when I ran it from the menu, so I had to have my ISP restore my user table.

It's still not back to normal, and I fear I may have really trashed my board. Posts belonging to users that have been restored have disappeared. The posts appear to be present in the database tables, but they aren't visible in the board, and the board is displaying a pink banner saying "Information: This board is currently disabled."

So, lots of lessons that everyone should already know:

TEST TEST TEST

VERIFY VERIFY VERIFY

So now that I've blasted a hole in my foot, can anybody give me a Band-Aid? I'd appreciate a hint how to pull this board back together? Should I just tell the ISP to restore everything and roll it back to the previous night? Restoring just the user table didn't seem to get it.

cwk · 2009-02-11 4:15 pm

Quick follow-up. I've got my board back to where it should be. Some hard lessons well learned, but I'm still standing. In the meantime, my strong recommendation to anyone using the scanner.php tool is to use it for information only -- turn off the $shoot_on_sight and maybe replace the sql DELETE with an echo statement just to make sure.

The "Board Disabled message was because I had run the restore script and it closed the board. The restore script doesn't work so well, by the way. I recommend doing that from the command line. The missing posts are no longer a factor because I had to roll the board back a couple of days.

#1 2009-02-04 4:38 pm

scanner.php question

#2 2009-02-05 1:51 pm

Re: scanner.php question

#3 2009-02-06 5:41 am

Re: scanner.php question

#4 2009-02-07 10:21 am

Re: scanner.php question

#5 2009-02-11 5:29 am

Re: scanner.php question

#6 2009-02-11 4:15 pm

Re: scanner.php question

Board footer