XF 2.0 .core files

[JoyFreak]

Guys I need your help!

There are .core files spamming my public_html folder and I spoke to my hosting provider and they said it's related to a script. What is it? How do I find the cause of it? How do I stop it!

Thanks!

 

[Bryan]

GET https://www.gnonline.net/proxy.php?image=https%3A%2F%2Fi.imgur.com%2FEEGMkiV.jpg&hash=908fafcd14ea6b5f4628cfdb6ac9eaa9 500 ()
GET https://www.gnonline.net/proxy.php?image=https%3A%2F%2Fi.imgur.com%2FC8BAGGD.jpg&hash=08c667ddda62c75e313947033b6f3bc3 500 ()
GET https://www.gnonline.net/proxy.php?image=https%3A%2F%2Fi.imgur.com%2Fil77cxD.jpg&hash=f2582fea41edd820c3010e1a2bab171c 500 ()
GET https://www.gnonline.net/proxy.php?image=https%3A%2F%2Fi.imgur.com%2F1i8oNkD.jpg&hash=25d9b8c282791ed3263061fa74bdfad4 500 ()

 

[JoyFreak]

What is proxy.php I don't even know. I think I may have enabled 'Image and link proxy' in the options in admin-cp.

• Proxy images
• Proxy links

Both enabled? Is this by default ? What does this do.

 

[JoyFreak]

Woah, so many core files produced then. Looks like its neither of them add-ons.

 

[Bryan]

It allows you to keep your SSL padlock when fetching images from non SSL sources.

 

[JoyFreak]

Ok so it's useful then and shouldn't really break anything.

 

[Bryan]

I've never had a problem with it

 

[JoyFreak]

The thing is, the earliest .core file is dated back to the 16/01/2018 and that thread was created today. So it's something to do with images and proxy in general.

 

[Jeremy P]

If PHP is crashing, it's likely to be a bug in the interpreter itself. PHP code shouldn't be able to crash the interpreter.

 

[JoyFreak]

I have no idea what an interpreter is lol.

 

[Bryan]

I'm not sure why proxy.php is involved here, those images are from imgurl so should be in media tags surely?

Like so?

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[JoyFreak]

I have no idea why?

 

[JoyFreak]

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[JoyFreak]

I think the .core files are linked to this url not embeding into my forums: https://i.imgur.com/ 1i8oNkD.jpg (without the space)
however this https://imgur.com/ 1i8oNkD (without the space) does embed.

Do you know why that is?

 

[Anomandaris]

I am getting the same thing on my forum with both Image & link Proxy disabled. The core.###### files are indeed memory dumps, ELF files.

How can I go about finding the source of the problem? I have no server error logs and looking at the Apache logs has not been helpful thus far, I'm looking 5 minutes before the dump occurs but not seeing anything weird or causing any dumps by visiting those pages...Also no requests to proxy.php so I think it's unrelated to that.