Blank page when 'updating' resources?

Blank page when 'updating' resources?

by steve loveridge -
Number of replies: 3

Hi all.

I hope someone  can help, I have a problem with my company's moodle installation that is driving me mad (1.8.2 on apache 2.0 and php 5.2.5).  Everything works fine, except for updating resources that are within topic/week areas of a course. When a user, (no matter what their role), clicks on 'update', we just get a blank page. As an example, the URL that the page goes blank on is:

http://moodle.myvle.net/course/mod.php?update=1015&sesskey=sqTwCW0IP8&sr=1

This only happens for resources that are part of the topic/weeks section, and updating any file in the Outline section at the top of the course works fine.  Here is what I have tried so far:

Update resource x  in topic 1 = Blank page

Update resource y in topic outline = update page

Update resource x in topic outline = update page

Update resouce y in topic 1 = blank page

no errors reported in debug.

As you can see, its not a problem with the files themselves. When successfully updating from topic outline section, the url shows:

http://moodle.myvle.net/course/modedit.php?update=1004&return=0

Not being familliar at all with php, should the topic area be utilising modedit.php and the topic 1, 2, 3, etc use mod.php, is this correct? Also, is it logical to assume that mod.php is causing the problem?

Any help would me most gratefuly received.

Average of ratings: -
In reply to steve loveridge

Re: Blank page when 'updating' resources?

by Holly Erickson -
Hi Steve,

I came back from winter break to find the same issues you've described, and I'm afraid our problem was that we'd been hacked. Try reading this post: http://moodle.org/mod/forum/discuss.php?d=102135. I hope this helps!

Best,
Holly
Average of ratings: -
In reply to Holly Erickson

Re: Blank page when 'updating' resources?

by steve loveridge -

Thanks for the pointer, Holly.  I have checked out a couple dozen php files on our server, but I cannot see any traces of the code mentioned in that thread. However, we did have a whole bunch of new user accounts appear several months back, from places like nigeria, russia, ukraine etc etc, and some of the usernames were viagra related.

As I cant locate the code to delete, is my only hope re-copying the moodle files, or upgrading the moodle installation?

Average of ratings: -
In reply to steve loveridge

Re: Blank page when 'updating' resources - We were Hacked!

by steve loveridge -

Well I have tracked the infection to the \moodle\lib folder. There were over 12,000  spam template files there, surprise!, and all the php files in the lib folder had the 64bit encoded hack in the header.

I deleted the lib folder from the server, (after backing up of course), and then replaced it with a fresh copy from the moodle downloads section.  All is working now, so fingers crossed for no repeats.

A big thank you to all the good folk on the forum who have posted info on the hacks which proved invaluable. A special thanks to Holly who gave me a shove in the right direction.wink

Average of ratings: -