Update 11.1 - PHP code exposed

corey4908 · May 5, 2007

Updated to 11.1 and now, for some reason I can't fathum, all PHP pages show the HTML only. The PHP code is viewable in browsers' view source, instead of being server-parsed (securiy risk, other than the fact PHP itself not running - so a moot point

). Changes to php.ini ? Any ideas highly appreciated

Added notes

1)In WHM, when going to "Config File Rollback" for "/usr/local/apache/conf/httpd.conf", no matter how far role-back with the Revision chooser at bottom, ALL appear BLANK

This dispite the fact that /usr/local/apache/conf/httpd.conf itself is populated with configuration data in SSH.

2) No domains show up in WHM "List Acounts".

firedragon · May 5, 2007

yeah i got the same problem....

troubleshooting it right now...

cPanelNick · May 5, 2007

Trying to replicate this now.

corey4908 · May 5, 2007

cpanelnick,,

By using the following (I wonder about order ran in), I solved atleast part of the problem:

cp /etc/httpd/conf/httpd.conf /etc/httpd/conf/httpd.conf.old
/scripts/rebuildhttpdconf >> /etc/httpd/conf/httpd.conf
/scripts/updateuserdomains
/scripts/rebuildhttpdconf

Now domains showing up in List Accounts. However, PHP still not being parsed...

Thanks for your help, in advance, by the way

cPanelNick · May 5, 2007

Try this

Update to 11.2.2-CURRENT_11673

Go into the php config editor in whm
Go into advanced mode
Save the config.

11.2.2-CURRENT_11673 added some logic to repair any errors in the php.ini.

corey4908 · May 5, 2007

cpanelnick,

That worked for me

PHP now parsing as it should. Thanks:D

Now if could only get one site (and sadly it is my hosting biz domain...my luck:p ) to work again...getting 403 Forbidden errors on all its pages (even image URL's). Guess I better get reading forums some more..lol, or my current clients may stay for a bit (freely hosted and only care their own sites run

) but won't have own site to attract newcomers

Thanks again

cPanelNick · May 5, 2007

corey4908 said:
cpanelnick,

That worked for me PHP now parsing as it should. Thanks:D

Now if could only get one site (and sadly it is my hosting biz domain...my luck:p ) to work again...getting 403 Forbidden errors on all its pages (even image URL's). Guess I better get reading forums some more..lol, or my current clients may stay for a bit (freely hosted and only care their own sites run ) but won't have own site to attract newcomers

Thanks again

Did you check /usr/local/apache/logs/error_log ?

corey4908 · May 5, 2007

cpanelnick said:
Did you check /usr/local/apache/logs/error_log ?

Showing the following (where xxx is the username):

[Sat May 5 15:44:40 2007] [error] [client 200.00.0.00] Directory index forbidden by rule: /home/xxx/public_html/admin/
[Sat May 5 15:44:40 2007] [error] [client 200.00.0.00] File does not exist: /home/xxx/public_html/admin/errors/errors.php
[Sat May 5 15:44:42 2007] [error] [client 200.00.0.00] Directory index forbidden by rule: /home/xxx/public_html/admin/
[Sat May 5 15:44:42 2007] [error] [client 200.00.0.00] File does not exist: /home/xxx/public_html/admin/errors/errors.php
[Sat May 5 15:47:59 2007] [error] [client 200.00.0.00] File does not exist: /home/xxx/public_html/admin/admin.gif
[Sat May 5 15:47:59 2007] [error] [client 200.00.0.00] File does not exist: /home/xxx/public_html/admin/errors/errors.php

/home/xxx/public_html/admin/ doesn't even exist! All of those should be in /home/xxx/public_html/ itself. Oddly, /etc/httpd/conf/httpd.conf doesn't have the directory "/admin/" refferanced as root for that directory. It lists the following:

<VirtualHost xxx.xxx.xxx.xxx:80>
ServerAlias www.mydomain.net mydomain.net
ServerAdmin [email protected]
DocumentRoot /home/xxx/public_html
User xxx
Group xxx
ServerName www.mydomain.net
CustomLog domlogs/mydomain.net combined
ScriptAlias /cgi-bin/ /home/xxx/public_html/cgi-bin/
<IfModule mod_suphp.c>
suPHP_UserGroup xxx xxx <<-- Username appears twice here, but it also is this way in other working domains.
</IfModule>
BytesLog /usr/local/apache/domlogs/www.mydomain.net-bytes_log
</VirtualHost>

Has me confused, how get Not Found and Access Denied via a referance to a folder that doesn't exist

And this only domain its doing i too.

cPanelNick · May 5, 2007

corey4908 said:
Showing the following (where xxx is the username):

[Sat May 5 15:44:40 2007] [error] [client 200.00.0.00] Directory index forbidden by rule: /home/xxx/public_html/admin/
[Sat May 5 15:44:40 2007] [error] [client 200.00.0.00] File does not exist: /home/xxx/public_html/admin/errors/errors.php
[Sat May 5 15:44:42 2007] [error] [client 200.00.0.00] Directory index forbidden by rule: /home/xxx/public_html/admin/
[Sat May 5 15:44:42 2007] [error] [client 200.00.0.00] File does not exist: /home/xxx/public_html/admin/errors/errors.php
[Sat May 5 15:47:59 2007] [error] [client 200.00.0.00] File does not exist: /home/xxx/public_html/admin/admin.gif
[Sat May 5 15:47:59 2007] [error] [client 200.00.0.00] File does not exist: /home/xxx/public_html/admin/errors/errors.php

/home/xxx/public_html/admin/ doesn't even exist! All of those should be in /home/xxx/public_html/ itself. Oddly, /etc/httpd/conf/httpd.conf doesn't have the directory "/admin/" refferanced as root for that directory. It lists the following:

<VirtualHost xxx.xxx.xxx.xxx:80>
ServerAlias www.mydomain.net mydomain.net
ServerAdmin [email protected]
DocumentRoot /home/xxx/public_html
User xxx
Group xxx
ServerName www.mydomain.net
CustomLog domlogs/mydomain.net combined
ScriptAlias /cgi-bin/ /home/xxx/public_html/cgi-bin/
<IfModule mod_suphp.c>
suPHP_UserGroup xxx xxx <<-- Username appears twice here, but it also is this way in other working domains.
</IfModule>
BytesLog /usr/local/apache/domlogs/www.mydomain.net-bytes_log
</VirtualHost>

Has me confused, how get Not Found and Access Denied via a referance to a folder that doesn't exist And this only domain its doing i too.

Check the .htaccess file in /home/USER/public_html

corey4908 · May 5, 2007

and...the drama continues........

cpanelnick said:
Check the .htaccess file in /home/USER/public_html

Options All -Indexes
AddHandler application/x-httpd-php .exe
AddHandler application/x-httpd-php .aspx
DirectoryIndex do.exe do.php
ErrorDocument 400 /errors/errors.php?400
ErrorDocument 401 /errors/errors.php?401
ErrorDocument 402 /errors/errors.php?402
ErrorDocument 403 /errors/errors.php?403
ErrorDocument 404 /errors/errors.php?404
ErrorDocument 500 /errors/errors.php?500

Both AddHandlers , like the rest of the above, had been there and worked before. They were used to confuse any nasty script that may end-up searching for default .html/.htm/.php ect (I believe the common Metasploit - If I'm not confusing something else..lol - comes to mind, which can be used to overwrite server-wide default known-name index files). As stated, all had worked..as this .htacces hasn't been changed in forever. And, site index is "do.php", with some sub-directories using "do.exe" instead - as they have been way before this problem.

By the way, just incase update changed something that would effect the above working. I even tried with a blank .htaccess file and renaming do.php - to no avail, sadly.

But, you're right...Obvious first place to point any newbie to look would be in .htaccess

cPanelNick · May 5, 2007

corey4908 said:
Options All -Indexes
AddHandler application/x-httpd-php .exe
AddHandler application/x-httpd-php .aspx
DirectoryIndex do.exe do.php
ErrorDocument 400 /errors/errors.php?400
ErrorDocument 401 /errors/errors.php?401
ErrorDocument 402 /errors/errors.php?402
ErrorDocument 403 /errors/errors.php?403
ErrorDocument 404 /errors/errors.php?404
ErrorDocument 500 /errors/errors.php?500

Both AddHandlers , like the rest of the above, had been there and worked before. They were used to confuse any nasty script that may end-up searching for default .html/.htm/.php ect (I believe the common Metasploit - If I'm not confusing something else..lol - comes to mind, which can be used to overwrite server-wide default known-name index files). As stated, all had worked..as this .htacces hasn't been changed in forever. And, site index is "do.php", with some sub-directories using "do.exe" instead - as they have been way before this problem.

By the way, just incase update changed something that would effect the above working. I even tried with a blank .htaccess file and renaming do.php - to no avail, sadly.

But, you're right...Obvious first place to point any newbie to look would be in .htaccess

Go ahead and open a ticket

corey4908 · May 6, 2007

cpanelnick said:
Go ahead and open a ticket

Ticket Submitted! Thanks for the help here:D

orware · May 7, 2007

Domain.com or www.Domain.com working but not both

EDIT: Just got a reply from my webhost and they said everything loaded fine at the data center and that it was my browser cache (makes sense...I tend to have about 40 tabs open in Firefox most of the time).

Hi I woke up this morning to this problem as well.

I fixed the List Accounts problem by deleting all of the current home accounts, clearing out the users and group ids from /etc/passwd and /etc/groups and then restored from this morning's daily backup and the websites were visible again (at least some of them).

Then I noticed that I had the same problem with the PHP scripts not being parsed. If you go to one of these sites in Firefox all that pops up a download box (which if you download the file you'll see it's the index.php for your site, unparsed).

Another issue I'm having is that this only happens on either a domain.com or www.domain.com basis. Let me illustrate:

Example 1: defiancemayhem.com will work, but www.defiancemayhem.com will show the cPanel splash page

Example 2: jsconcessions.com will popup with a download box asking you to save a file (your index.php, unparsed), but www.jsconcessions.com takes you to the actual website and parses the php (if you try to go here you'll see something about the license being invalid...that's because I just moved to a new server and the software on the site requires ioncube and tracks the software via IP...the software hasn't been updated yet to accomodate for the new server's IPs).

It's kind of weird and I've put in a support request with my webhost for them to check it out, but I don't know if it would be in their power or not.

Thank you,

-Omar

P.S. I didn't know how to get into that PHP Config page you mentioned (are you talking from within the Update Apache page?)

corey4908 · May 9, 2007

Sorry about late reply, Omar

After got my problem resolved, didn't come back to forums right away.

orware said:
P.S. I didn't know how to get into that PHP Config page you mentioned (are you talking from within the Update Apache page?)

In WHM. I'm not sure what version this was added in. But sure makes changing PHP settings a bit easier than having to SSH into php.ini

orware said:
EDIT: Just got a reply from my webhost and they said everything loaded fine at the data center and that it was my browser cache (makes sense...I tend to have about 40 tabs open in Firefox most of the time).

Glad to hear didn't go round and round like me:p But thankfully, cPanel folks got it all figured out:D

Spiral · May 10, 2007

What you describe is not a function of upgrading to Cpanel 11 but rather
that you got a bad compilation of PHP.

When compiling PHP with Cpanel's EasyApache script, there is 2 things
that can (and often does) happen that will cause your PHP code to
be downloaded instead of executed by the PHP interpreter.

1) EasyApache is not so good with sanity checks and will happily try
to install the PHP module or CGI after the PHP compile failed
which leaves you with a broken PHP installation requiring at the
very least a recompile of PHP.

2) Many times, EasyApache will leave the "LoadModule" line in the
/etc/httpd/conf/httpd.conf line for the PHP module commented
out which effectively disables PHP support and will cause your
PHP scripts to be downloaded instead of executed.

It is because of the above 2 items that I always recommend
manually compiling PHP yourself and not using EasyApache.

It is actually much simpler and fare more reliable to compile
PHP manually than rely on the Cpanel script for that.

Basically ...

1. Download the source from php.net

2. Unpack the archive

3. Run "./configure" with the same options shown in your current phpinfo() screen

4. Type "make"

5. Type "make test"

6. Type "make install"

corey4908 · May 10, 2007

TY Spiral for the advice

flash7 · May 15, 2007

WHM 11.1.0 cPanel 11.2.11-C12007

Can't update from php 4.4.6 to PHP 5.x.x in WHM

Also tryed manualy from source php 5.2.2 with the same error:

Code:

Syntax error on line 58 of /usr/local/apache/conf/httpd.conf:
Cannot load /usr/local/apache/libexec/libphp5.so into server:
/usr/local/apache/libexec/libphp5.so: undefined symbol:
xmlTextReaderSchemaValidate

What can I do?

Thanks

rgripoll · May 20, 2007

Problem with php

Fixed with cpanelnick's solution. Remember to restart your navigator after doing this.

rgripoll · May 25, 2007

It's failing again.

httpd.conf and php.ini seem to be ok... any ideas?

isputra · May 25, 2007

cpanelnick said:
Try this

Update to 11.2.2-CURRENT_11673

Go into the php config editor in whm
Go into advanced mode
Save the config.

After doing this, now my php status give me :

[email protected] [~]# php -v
Failed loading 1: 1: cannot open shared object file: No such file or directory
PHP 4.4.6 (cli) (built: Apr 4 2007 20:14:44)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v1.3.0, Copyright (c) 1998-2004 Zend Technologies
with Zend Extension Manager v1.2.0, Copyright (c) 2003-2007, by Zend Technologies
with Zend Optimizer v3.2.6, Copyright (c) 1998-2007, by Zend Technologies

What's wrong with this ? Please help me.

Thread starter	Similar threads	Forum	Replies	Date
	Litespeed update PHP timezoneDB extension(s)	Web Servers and Applications	39	Aug 12, 2022
V	System PHP-FPM Settings unable to update because cannot write /var/tmp/	Web Servers and Applications	1	Apr 1, 2022
L	I think PHP Web App update to work needed newer PHP version, can you confirm, that's the case	Web Servers and Applications	16	Mar 15, 2021
V	PHP Update	Web Servers and Applications	1	Feb 26, 2021
B	Accounts with subdomains download php files instead display after update EasyApache 4	Web Servers and Applications	2	Sep 2, 2020

Update 11.1 - PHP code exposed

Member

Registered

Administrator

Member

Administrator

Member

Administrator

Member

Administrator

Member

Administrator

Member

Member

Member

BANNED

Member

Well-Known Member

Active Member

Active Member

Well-Known Member