XF 1.4 Looping PC

[Nelson T.]

So I imported the pc's.

In one, I ask a few members to give me their correct date of birth.

The pc keeps being sent to the members, over and over.

It is ticking them off.

What happened, and how can I stop it? I tried leaving the conversation and setting it to no more replies permitted.

 

[Optic]

Most likely cause indeed, other links besides the index seem to work:
http://www.hobby-machinist.com/members/

 

[Paul B]

It was indeed a blank index.html file.

I have just logged in via FTP and removed it.

http://www.hobby-machinist.com/

 

[Nelson T.]

Apparently, there was. How did that happen. Were we hacked?

 

[Paul B]

It was either uploaded manually or via an auto installer add-on.

 

[Nelson T.]

It appears we were hacked. How do I prevent this? Delete the Install directory (like on VB)?

 

[Amaury]

Delete the Install directory (like on VB)?

That is not required on XenForo. If it's a concern, though, you can protect it with .htaccess.

 

[Nelson T.]

Ok, where should I put the .htaccess files to insure protection? (I will IP protect like I did on VB)

 

[Nelson T.]

I assume I need to find the admincp directory and put it in there. Which directories do I put the .htaccess in?

 

[melbo]

The XF install directory is not vulnerable like vB
https://xenforo.com/community/threads/just-installed-it-delete-the-install-folder.32656/

 

[CTXMedia]

Apparently, there was. How did that happen. Were we hacked?

It's entirely possible that the file only partially uploaded or began but didn't complete, leaving you with a zero byte file.

Are you sure you were hacked i.e. someone gained unauthorised access and modified your file/s?

 

[Nelson T.]

It's entirely possible that the file only partially uploaded or began but didn't complete, leaving you with a zero byte file.

Are you sure you were hacked i.e. someone gained unauthorised access and modified your file/s?

Pretty sure, yes.

Where do I put those .htaccess files?

In VB, I had them in admin, modadmin and includes directories, and it worked great.

 

[CTXMedia]

@Brogan has helpfully put instructions for this here - hope it helps:

https://xenforo.com/community/resou...and-the-install-directory-using-htaccess.353/

Cheers,
Shaun

 

[Nelson T.]

That file states:


Using IP address based protection instead of passwd
You can also use IP address protection instead of a passwd file. In which case you would just have this in the .htaccess file for admin.php:
Code:
<Files admin.php>
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</Files>
And this for the /install directory:
Code:
Order Deny,Allow
Deny from all
Allow from 127.0.0.1

Replace 127.0.0.1 with your actual IP address. You can find out your IP address here.
Additional allowed IP addresses can be added on a new line.

However, the admin.php file is in the main forum directory. If you restrict IP access to that directory, people cannot access the site.

So, I repeat my previous questions, which directory or directories do I place the .htaccess file with the IPs that are allowed in?

 

[Paul B]

Protecting the directories or deleting them is completely unrelated to the blank index file which was present in the installation root.

 

[Nelson T.]

Protecting the directories or deleting them is completely unrelated to the blank index file which was present in the installation root.

Hopefully, but I would still like to IP protect the Admincp. How can I do that if it is in the main directory?

 

[Paul B]

The resource linked to earlier works for any XenForo installation.
The instructions are from my own site, which is similarly protected.

The protection is being applied to the admin.php file, not the directory.

 

[Nelson T.]

The resource linked to earlier works for any XenForo installation.
The instructions are from my own site, which is similarly protected.

The protection is being applied to the admin.php file, not the directory.

So I put the .htaccess commands in the admin.php file?

I'm lost, Sorry.

 

[Paul B]

I recommend reading the instructions as it is clearly explained there: https://xenforo.com/community/resou...and-the-install-directory-using-htaccess.353/

 

[Nelson T.]

I did that (see above), but cannot figure out how to protect the Admin area.

 

[CTXMedia]

I did that (see above), but cannot figure out how to protect the Admin area.