My site does not display the images that my staff have uploaded as they have built their courses. We have been users for a few years now but as of yesterday the images no longer load. They are physically still there but they do no display.
Have I been hacked?
We have been hacked before with changes to the config file, pharmacy adds and such. We have not had any issue since the beginning of this school year.
I have looked around config files and php files but do not see anything that stands out.
I do not know what to look for.
Any thoughts
In reply to Michael Wininger
Re: Images do not load. Has my site been compromised?
by Sean Farrell -
Hi Michael,
I think you need to find out the exact address which is being used for one of the missing images. You might be able to right-click and view image on the broken image to see the full URL.
Otherwise, in your browser view the source and find some text near to the broken image and look for the "img" tag.
What happens when you view this URL directly? Do you see the image, or does it return an error or a moodle login screen? Are you able to view uploaded files such as PDF or Word files in the same courses?
It would also be useful to know if the missing image problem changes depending on if someone is logged in, and if they are either a guest or a full member of the course.
It might also be useful to know what version of moodle you are currently using.
--
Sean Farrell
I think you need to find out the exact address which is being used for one of the missing images. You might be able to right-click and view image on the broken image to see the full URL.
Otherwise, in your browser view the source and find some text near to the broken image and look for the "img" tag.
What happens when you view this URL directly? Do you see the image, or does it return an error or a moodle login screen? Are you able to view uploaded files such as PDF or Word files in the same courses?
It would also be useful to know if the missing image problem changes depending on if someone is logged in, and if they are either a guest or a full member of the course.
It might also be useful to know what version of moodle you are currently using.
--
Sean Farrell
Michael & Sean,
This is interesting. I've just run into the same situation and am very perplexed. We have a site up that has images on the front page in the front page label. Also images for each user in their profile.
All of these images have suddenly disappeared. They are gone when logged in, when not logged in....
If I navigate to Site Files and click on one of the images that should load the image in a popup window, I get the popup but it only displays the path to the image. (correct path by the way)
Very perplexed.
This is a very small scale hosted site and I don't have access to the server logs so I can't look into the possibility of suspicious behavior but for some reason it has that feel.
I did login to cPanel and the image is still there on the server at the same path that is being specified by Moodle......???
I'm stumped.
Jason
P.S. This site is hosted on Bluehost....any chance Michael that your site is on Bluehost?
P.P.S. I had some images in a lightboxgallery inside a course on this site and they have all been 'stripped' as well. Seems like this may be a problem related to my hosting server....?
P.P.P.S (Is that legal
) One more note here. When I was jumping around on my site, at one point I saw an AWStats logo for just a moment. Bluehost does use AWStats to log access to sites and I'm wondering if that package is interfering with my Moodle site in some way....?
I promise I'll stop adding to this with this one last comment I've also just noticed that the HTML editor is gone!! No matter where I go and try to edit something (a label, a forum post, etc.) all I get is a text box...not the html editor.....????? 
This is interesting. I've just run into the same situation and am very perplexed. We have a site up that has images on the front page in the front page label. Also images for each user in their profile.
All of these images have suddenly disappeared. They are gone when logged in, when not logged in....
If I navigate to Site Files and click on one of the images that should load the image in a popup window, I get the popup but it only displays the path to the image. (correct path by the way)
Very perplexed.
This is a very small scale hosted site and I don't have access to the server logs so I can't look into the possibility of suspicious behavior but for some reason it has that feel.
I did login to cPanel and the image is still there on the server at the same path that is being specified by Moodle......???
I'm stumped.
Jason
P.S. This site is hosted on Bluehost....any chance Michael that your site is on Bluehost?
P.P.S. I had some images in a lightboxgallery inside a course on this site and they have all been 'stripped' as well. Seems like this may be a problem related to my hosting server....?
P.P.P.S (Is that legal
I promise I'll stop adding to this with this one last comment
Rather than adding to the previous post I'll reply here.
I just cleared my browser cache, restarted it and still have the same thing...
And NOW I have a little icon in the top left of my screen and mousing over it shows the following address
http://new.addfreestats.com/?usr=00911093
Definitely thinking my site has been hacked!
Now, what do I do to fix it? And how do I prevent the bozo that hacked it from doing it again?
Jason
I just cleared my browser cache, restarted it and still have the same thing...
And NOW I have a little icon in the top left of my screen and mousing over it shows the following address
http://new.addfreestats.com/?usr=00911093
Definitely thinking my site has been hacked!
Now, what do I do to fix it? And how do I prevent the bozo that hacked it from doing it again?
Jason
Following up with a little more information here.
This may be completely unrelated but as I've been sifting through the server logs, the only thing that looks a little strange to me so far is a single call from an IP in Russia to the following path on my server
mydomanin.com/help.php?module=data&file=fields.html
Only one call to this which seems a little strange to me. And the subsequent page that is served, while it seems benign, is equally strange.
I get a message that says
This may be completely unrelated but as I've been sifting through the server logs, the only thing that looks a little strange to me so far is a single call from an IP in Russia to the following path on my server
mydomanin.com/help.php?module=data&file=fields.html
Only one call to this which seems a little strange to me. And the subsequent page that is served, while it seems benign, is equally strange.
I get a message that says
Fields
On this screen you can create the fields that will be a part of your database.
Each field allows different types of data, with different interfaces.
and then a link that allows me to see a directory of all help files. ???
Jason
In reply to Sean Farrell
Re: Images do not load. Has my site been compromised?
by Alexandre Ubaldo -
I'm having the problem exactly as you described. When I put the url of my images returns a login screen, even though I was logged in with full permissions. Could you help me, I'm trying to fix for days and nothing. Other kind of files of the same directory, like html, js, or swf appears normally.