Free Source Network - e107 addicted : Blog

We are so alive

SecretR — 2013-05-18T11:48:59+03:00

Yep, we are pretty much alive. I just had a quick look and I personally got the feeling... we are dead. So I decided to write a quick post, just to make sure this is not true.We had hard times (company wise), hopefully all bad news are in the past. We finally got the time and energy to continue the work on our primary goal - e107.org and brand new e107 version. The result should be visible in weeks and yes, this is true, I never write it otherwise. I hope the future changes and improvements will bring the so long waited positivism in our community and end up the exhausting process of 'doing everything alone' process. I also hope this will be the start of so long waited way up for e107. We, as persons and company, who have put so much energy and effort in just an idea, are eager to see e107 as a competitor of all world leading CMS systems. Actually I believe this will happen. I also want to thank for the great support of our FS Net and e107.org community - we had a great time with you, and I believe the best is yet to come. Take care.e107 addicted

objectHandles 2.0 - create custom handles with Adobe Flash Builder 4 (Flex 4)

SonicE — 2013-05-18T11:48:59+03:00

I'm writing this blog post because it was a nightmare for me to find useful information about using of objectHandles 2.0 with Flex 4 SDK. If you decide to use this library in your project and your project is based on Flex 4 SDK, then you should prepare your self for a real battle. We are currently working on a project for online creation of Photo books, and our "book customizer" is written in Flex 4. I need to tell you that I'm not a flash, flex or AS 3 guru, but with my earlier experience in AS 2 it was not so difficult to start learning AS 3, Flex SDK, AIR etc. So this blog post is for what I've learned these days working on this project.Let start with building our custom handles. First you need to crate a new HandleFactory. Open a new AS 3 file and place this code inside:/src/CustomFlex4HandleFactory.as

// ActionScript file

package
{
import mx.core.IFactory;

public class CustomFlex4HandleFactory implements IFactory
{
public function CustomFlex4HandleFactory()
{
}

public function newInstance():*
{
return new MyCustomHandlesClass();
}
}
}

SyntaxHighlighter.Manager.add("AS3");

As you can see this code is only used to create a new instance of of custom handle, so we need to create now a class which will define or custom handle visual style. Create a new file called "MyCustomHandlesClass.as"/src/MyCustomHandlesClass.as

// ActionScript file

package
{
import com.roguedevelopment.objecthandles.HandleDescription;
import com.roguedevelopment.objecthandles.IHandle;

import flash.events.MouseEvent;

import spark.core.SpriteVisualElement;

public class MyCustomHandlesClass extends SpriteVisualElement implements IHandle
{

private var _descriptor:HandleDescription;
private var _targetModel:Object;
protected var isOver:Boolean = false;

public function get handleDescriptor():HandleDescription
{
return _descriptor;
}
public function set handleDescriptor(value:HandleDescription):void
{
_descriptor = value;
}
public function get targetModel():Object
{
return _targetModel;
}
public function set targetModel(value:Object):void
{
_targetModel = value;
}

public function MyCustomHandlesClass()
{
super();
addEventListener( MouseEvent.ROLL_OUT, onRollOut );
addEventListener( MouseEvent.ROLL_OVER, onRollOver );
//redraw();
}

protected function onRollOut( event : MouseEvent ) : void
{
isOver = false;
redraw();
}
protected function onRollOver( event:MouseEvent):void
{
isOver = true;
redraw();
}

public function redraw() : void
{
graphics.clear();
if( isOver )
{
graphics.lineStyle(1,0x3dff40);
graphics.beginFill(0xc5ffc0 ,1);
}
else
{
graphics.lineStyle(1,0);
graphics.beginFill(0xaaaaaa,1);
}

graphics.drawRect(-5,-5,10,10);
graphics.endFill();

}
}
}

SyntaxHighlighter.Manager.add("AS3");

Well this is a good start. To create your own style you should edit the redraw() function. What we have done in this example is to replace the default rectangular handle with circle. Now is time to use this code in our project. In your application file place this code:

xmlns:s="library://ns.adobe.com/flex/spark"
xmlns:objecthandles="com.roguedevelopment.objecthandles.*"
xmlns:mx="library://ns.adobe.com/flex/mx" minWidth="400" minHeight="300" creationComplete="application1_creationCompleteHandler(event)" viewSourceURL="srcview/index.html"> import net.freesource.CustomFlex4HandleFactory;
import com.roguedevelopment.objecthandles.Flex4ChildManager;
import com.roguedevelopment.objecthandles.HandleDescription;
import com.roguedevelopment.objecthandles.HandleRoles;
import com.roguedevelopment.objecthandles.ObjectHandles;

import mx.events.FlexEvent;

protected var objectHandles:ObjectHandles;

override protected function initializationComplete() : void
{
var handles:Array = [];

handles.push( new HandleDescription( HandleRoles.RESIZE_UP + HandleRoles.RESIZE_LEFT,
new Point(0,0) ,
new Point(-16,-16) ) );

handles.push( new HandleDescription( HandleRoles.RESIZE_UP + HandleRoles.RESIZE_RIGHT,
new Point(100,0) ,
new Point(-16,-16) ) );

handles.push( new HandleDescription( HandleRoles.RESIZE_DOWN + HandleRoles.RESIZE_RIGHT,
new Point(100,100) ,
new Point(-16,-16) ) );

handles.push( new HandleDescription( HandleRoles.RESIZE_DOWN + HandleRoles.RESIZE_LEFT,
new Point(0,100) ,
new Point(-16,-16) ) );

objectHandles = new ObjectHandles( mainGroup ,
null,
new CustomFlex4HandleFactory(),
new Flex4ChildManager()
);

objectHandles.registerComponent( img, img );

super.initializationComplete();

}

protected function application1_creationCompleteHandler(event:FlexEvent):void
{
//This line can be removed, is for axample only
objectHandles.selectionManager.addToSelected(img);
}

]]>

SyntaxHighlighter.Manager.add("AS3");

Demo: objectHandles 2.0 - create custom handles with Adobe Flash Builder 4 (Flex 4)Download: objectHandlesWithFlex4.zip

Installatron Integrates e107

SecretR — 2013-05-18T11:48:59+03:00

Installatron, a leader in web application automation, today announced the availability of the e107 content management system, through Installatron Applications Installer, its multi-platform web application auto-installer and auto-upgrader software.Installatron Applications Installer is the leading multi-platform web application auto-installer and auto-upgrader plugin for the cPanel/WHM, DirectAdmin, Plesk Linux, Plesk Windows, and Kloxo/LxAdmin web-hosting control panels, and a multi-user integration API is available for any hosting control panel or graphical user interface. Installatron Applications Installer was launched in 2004.For more information about Installatron, including a live demo and a free version, please visit: http://www.installatron.comSource: installatron.com

Secure server configuration - stop the madness

SecretR — 2013-05-18T11:48:59+03:00

We all were witnesses of a great panic and a lot of accusations of how weak and non-safe is e107 recently. The reason was a massive attack against most of the e107 based (community and non-community) sites and e107.org itself. Let's summarize the facts first. It's true that a number of security holes was recently reported, and some of them were bad - really bad. I'll write in a separate post the sad story behind some of the reports, which caused SO MUCH damage to a lot of e107 based sites and hosting companies (sad, because it was done by PHP security adviser owner of php-security.org - a popular person - who acted as a teenager - understand totally unprofessional). I'm pretty much sure this story triggered the start of the attack against e107 but this is not a subject of this article.The reaction of the core development team was fast enough - we did quick fixes, we released number of quick patches and security releases. We were already prepared with a notification system which delivered the information about the recent available security patches direct to site owners' administration area. We also published a lot of information (news on e107.org), all the information we got. I don't think the whole could have been done better.The panic came AFTER the last security patch. It was caused by a number of bot attacks which were trying to go through an ALREADY PATCHED security hole (the so popular recently contact.php). Bots were following (exactly) the INSTRUCTIONS pointed in one of the advisories - php-security.org/2010/05/19/mops-2010-035-e107-bbcode-remote-php-code-execution- vulnerability/index.html (do you remember the sad story I was talking about earlier?)What exactly happened? The bad guys used the fact that this vulnerability was first published and spread around the World Wide Web without the knowledge of e107 core development team. They attacked and infected servers (not secured enough - see below). All infected servers was made attackers. They infected more servers, etc. The number of infected servers was low at the beginning of the attack - at this time patch was already available. The problem is people do not pay enough attention on this even if shown on the top of their site administration panel, so patching required time. Those who were late, lost the game. Unfortunately those who weren't late, didn't win the game. They were attacked by all infected servers. Although the hole was patched, attacks became DDOS. They affected all servers which can't handle such attacks. What can do e107 CMS about all this? Near nothing, nor any other CMS/PHP script can do more. e107 core development team could do one thing only - security patch, preventing php code execution in this particular case. Neither development team nor PHP itself are able to help you stop the requests to your site. I hope everyone understand this.I saw all kind of advises as 'delete contact.php', 'add .htaccess rules', etc. This could work in very short term. Here are blocked requests from the logs on this server:Treasures/Download/Free-e107-Plugin-Corllete-Lab-Gallery/contact_phpTreasures/Download/Free-e107-Plugin-Corllete-Lab-Gallery/contact.phpTreasures/Download/Free-e107-Widget-Blank-Simple/show/contact_phpAs you see, there is only one solution - server security software.Solution? I can point server owners/shared hosting companies to a solution based on our current experience. It involves an installation of a free software package on a Linux web server, best suitable for RedHat or derivative Linux platforms (read more details about different software requirements below). The solution is fully integrated with Cpanel/WHM server management system.Additionally, the company behind some applications of this package is offering low cost Cpanel configuration services which allows you to order installation and configuration of all required software on a dedicated server(s) for a very fair price. Learn more about the ConfigServer Cpanel services.I'll try to explain how the whole is working in few words. Real time protection (active scanning)Requests to the server are being analyzed (e.g mod_security rules, suhosin) and temporary blocked if recognized as a hacking attempt. Temporary blocked IPs doesn't have access to the server for 300 seconds (default value). Additionally, number of temporary blocks are resulting in permanent block (csf.deny file). Permanent blocks are added to the server's iptables. The default max number of permanent blocked IPs is 100. You could increase the number if required but be careful:DENY_IP_LIMIT configuration variable comments wrote ...This can be important as a large number of IP addresses create a large number of iptables rules (4 times the number of IP's) which can cause problems on some systems where either the number of iptables entries has been limited (esp VPS's) or where resources are limited.You should find the appropriate number based on your server resources and the strength of the (eventually) current attack against your server.Server monitoring (on-demand scanning)ConfigServer Firewall comes with Login Failure Daemon (lfd) which effectively blocks IPs based on the number of login failures. You should start number of cron jobs for various checks (e.g. rkhunter, Chkrootkit which is not listed here etc). In the end you should be able to be informed about the state of your server just reading email reports once per day. eXploit Scanner (if installed) will add additional server monitoring (beside its active scanning, it's able to perform scanning of files, directories and user accounts for suspected exploits, viruses and suspicious resources). Just a side note - I'm not saying people who has the software below will be 100% secure. There is no such a thing when you are plugged-in to Internet. I'm just saying you'll be as much secured as possible, it'll work for you in most if not in all cases. This article is not intending to explain How to protect yourself (installation/configuration instructions) but what to install to be protected. Links to appropriate resources are provided together with every product listed below.Atomic ModSecurity & ModSecurity RulesOverview and installation instructions: http://www.configserver.com/cp/csf.htmlAdditional help by configuring the rules: http://www.atomicorp.com/wiki/index.php/Mod_securityThis is a part of the Atomic Secured Linux (ASL) project. Mod Security is an open-source web application firewall. Atomic Rules are set of predefined mod_security rules which are updated on a regular basis. For a Cpanel users, the best option is to install mod_security via the Easyapache module. See below why.ConfigServer ModSecurity Control (cmc)Product page: http://www.configserver.com/cp/cmc.htmlThe product provides you with an interface to the cPanel mod_security implementation from within WHM. It gives you additional GUI control over your ModSecurity installation. SuhosinProduct page: http://www.hardened-php.net/suhosin/Suhosin is an advanced protection system for PHP installations. It is designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core.iptables SPI firewall (ConfigServer Firewall - csf)Product page: http://www.configserver.com/cp/csf.htmlYou'll find full feature list and all required installation instructions.You pretty much need 3-4 shell lines:
rm -fv csf.tgz
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

SyntaxHighlighter.Manager.add("Bash");

ClamAVProduct page: http://www.clamav.net/lang/en/It's an open source (GPL) anti-virus toolkit for UNIX, nothing more or less.ConfigServer eXploit Scanner (cxs)Product page: http://www.configserver.com/cp/cxs.htmlThis is the only non-free product in this list. You may or may not buy & install it. I suggest you install it.It does active scanning of files as they are uploaded to the server. It has Cpanel GUI control panel.MailScannerProduct page: http://www.mailscanner.info/intro.htmlMailScanner is an e-mail security and anti-spam package for e-mail gateway systems. It supports Clam Anti Virus.Rootkit HunterProduct page: http://www.rootkit.nl/projects/rootkit_hunter.htmlRootkit scanner is scanning tool to ensure you for about 99.9%* you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running various tests.Fine tuningI'll update this section in the future with information about what could break your e107 site installations and how it can be tweaked/re-configured.Summary - be smart, not paranoidPanic creates paranoid thoughts. You need to find the balance between security and flawless working web applications on your server(s). People using hosting services want to be secure and not to block the access of half of the world to their sites. I'll try to keep an updated list here in the future of common needed for e107 installation configuration changes needed to make the CMS and its plugins work well (and not to block/ban innocent visitors).Anyway, the idea is you should be safe enough against both exploit & DOS attacks. I can confirm that the access the contact form on FS is blocked (403 error) very efficient from mod_security currently. There are many blocked daily attempts and no CPU overload on this server. This is the reason I decided to share all this. It may (it should) work for you as well.

Aptana and Eclispe - Code Formatter for PHP Development Tools for Eclipse

SecretR — 2013-05-18T11:48:59+03:00

The storyThose of you who are using the 'PHP development tools' (PDT ) plugin for Eclipse should know this is the most wanted ever feature from the PDT development team (Zend company). I think I know the reason why it's still not implemented - it's available for the commercial PDT analogue - Zend Studio for Eclipse. I did a wide research half year ago and didn't find anything even close to useful. The breakthrough came a month ago. I call it pure luck - I don't know how I ended up to a site (free hosted) in totally illegible for me language (Chinese?) except it's title Eclipse PDT (PHP Development Tools) - PHP Code Formatter Plugin (prototype) I was able to (almost) understand the rest thanks to Google Translate project. However I wasn't able to find any reference to the person/team behind this page. If someone can give me information in this matter, please do it. I really wanna say "Thank you" to this guy.To understand better how lucky I was, I'll tell you that some days later I was trying to open this page with no success - it was restricted to US IP's only (and I'm far from US located). RequirementsJRE 6.+Aptana 2.+ (tested on 2.0.2) OR Eclipse 3.4+ Eclipse Web Tools Platform (WTP) 3.+ - tested on v3.1.1Eclipse Dynamic Languages Toolkit (DLTK) 1.+ - tested on v1.0.1PHP Development Tools (PDT) 2.+ - tested on v2.1.2DownloadProject URL: http://atlanto.web.fc2.com/pdt/workshop/formatter_plugin.htmlDirect download (free-source.net mirror) PDT 1.3: va000137.pdt.tools.formatter_0.92.4.jarDirect download (free-source.net mirror) PDT 2.x: va000137.pdt.tools.formatter_0.92.4.v20081027.jarInstallationCopy the downloaded .jar file to your Aptana/Eclipse 'dropin' folder (INSTALL_PATH/dropins), restart Aptana/Eclipse, done. Yep, so easy it is. Now go to Preferences / PHP / Code Style / Formatter and set your preferred code styling options.EDIT: Thanks to tgtje who pointed me to PDT Tools project on SourceForge Japan. You can download the most recent version of Code Formatter dropin from there and I can say: "Thank you so much atlanto from sourceforge.jp" :)

Find us on IRC

SecretR — 2013-05-18T11:48:59+03:00

Our only wish is to stay close to the community, so we added one more option for 'real time discussions' to our site services - join our newly created channel #fsnet at irc.freenode.netFor those of you not familiar with IRC, here are some nice & popular IRC clients:Chatzilla (Fiirefox extension): OS independent xChat : available for Windows and Linux (note: windows build requires donation, but you could google for free Windows build)

Testing Free-Source.net from mobile phone

SonicE — 2013-05-18T11:48:59+03:00

I'm just sitting in a public area and testing veskoto's new nokia phone and its browser. Well, I need to say 'Good job to all from the FS Team'. There are some small JS bugs, but I'll fix them in a zero time :). It is a time that we need to start optimize all of our work not only for all major browsers, but also for mobile phones. Until then - it's party time!PS: Sorry for any typos, I'm typing on phone keyboard.

Start using 960 grid system in your e107 themes

SonicE — 2013-05-18T11:48:59+03:00

OverviewThe 960 Grid System is an effort to streamline web development workflow by providing commonly used dimensions, based on a width of 960 pixels. There are two variants: 12 and 16 columns, which can be used separately or in tandem (source http://960.gs)In addition to this I need to say that you can use this great grid system not only with 12 or 16 columns grid. You can also create your own grid based on 18, 20, 22, 24 ... XX columns. The point of 960px is that it subdivides nicely into lots of equal column sizes so is a very versatile width. It also happens to be slightly less than the minimum width you can actually use when a browser is maximized on a 1024 pixel wide display. As you might have heard, we've already created an e107 theme Blue City using this great concept. In this blog post I'll try to explain you how to use 960 Grid System in your e107 themes.All modern monitors support at least 1024 × 768 pixel resolution. 960 is divisible by 2, 3, 4, 5, 6, 8, 10, 12, 15, 16, 20, 24, 30, 32, 40, 48, 60, 64, 80, 96, 120, 160, 192, 240, 320 and 480. This makes it a highly flexible base number to work with.Why using a grid sytem?The answer is very simple. It saves time when writing your HTML and CSS code and is easy to use. It is also very useful in creating the graphic design for your theme.ToolsYou can use various tools in your theme creation process.Variable Grid System - http://www.spry-soft.com/gridsGrid System Generator - http://www.gridsystemgenerator.com960 Gridder - http://gridder.andreehansson.se960-Grid-System Templates - http://github.com/nathansmith/960-Grid-System/tree/master/templatesGraphic DesignWell I'm not a guru in creating graphic concepts, because we have one of the best designers in e107 (and not only e107) Stoewarius, nevertheless I'll show you how to use 960 Grid System in your graphic design. I my all day work I prefer to use Adobe Fireworks for slicing but you can also us Adobe Photoshop. Go to http://960.gs and download the template package. Inside this package you can find useful templates for your preferred graphic software. I'll use the 12 column one for Fireworks. Browse the package to /templates/fireworks and open 960_grid_12_col.png. As you can see there are 12 red columns and this is your working grid. Every column is 60px wide with 10px left and 10px right margin. The whole width is 960px and the real content width is 940px.With this template you can easy create you layout. Let say you need in your header logo and banner areas, left column, center column and two menu areas after the header area. I'll not create a real design for a theme, I'll only show you how to use this grid system for your layout.Using 960.cssThe ZIP you've already downloaded (download again) comes with a lot of stuff to help you design with the 960 system, including PDF grid paper, templates for Fireworks, OmniGraffle, Photoshop, Visio, and CSS framework with demo HTML. We'll only used the CSS files, which is all you need for coding your site. The system comes with 3 CSS files.960.css – Sets up the grid system, the 12-, and 16-column containers, alpha, omega, and prefix. This file is necessary to the grid system.reset.css - “Initializes” the system so that all margins and paddings are 0, outline is 0, etc… This file is necessary to the grid system.text.css - Sets the font sizes including headers, adds margins to lists, etc… This file is not technically needed for the 960 grid system - we can ignore this file960.css uses the following classes to structure the page:container_XX is used in the outermost box to determine how many columns. You can use container_12 or container_16.grid_XX is the bread and butter of the system. XX is for how many columns you want the block to be. For example, grid_10 will be 10 columns wide. The exact pixel width is determined by how many columns you’ve divided the grid into.prefix_XX allows you to add in blank columns before a block. XX specifies how many blank columns you want.sufix_XX allows you to add in blank columns aftera block. XX specifies how many blank columns you want.push_xx and pull_xx. These classes can be used for &amp;amp;amp;amp;quot;Content first&amp;amp;amp;amp;quot; layouts.alpha is for if you have children blocks. If you do this, you’ll want the first child to have no margin on the left side. alpha makes that happen.omega is similar to alpha, except that it gives no margin on the right side. Use it for the last childclearfix and clear - Clear Floated Elements, more info at http://sonspring.com/journal/clearing-floats and http://perishablepress.com/press/2009/12/06/new-clearfix-hackThere are lot of tutorials over the web on how to combine and use all this classes.960 in actionNow it is a time to start creating your first 960gs based theme. Copy 960.css to your theme folder. Open theme.php and add these lines to the theme_head function.

function theme_head() {
echo '

';
}

SyntaxHighlighter.Manager.add("Php");

Because theme_head function will load after the main style.css file we need to put the contents of reset.css at the top of your style.css. Copy the code from reset.css and paste it to the top of style.cssThe last step is to create your $HEADER and $FOOTER. You can easy create your HTML code for the layout without any line of CSS code. Everthing is don by 960.css.
//In the code below remove the empty space after the " { " (left curly brace )
$HEADER = '

{ SETSTYLE=menu_area}
{ MENU=2}

{ SETSTYLE=menu_area}
{ MENU=3}

{ SETSTYLE=menu_area}
{ MENU=1}

{ SETSTYLE=center}
';

$FOOTER = '

';

SyntaxHighlighter.Manager.add("Php");

As you can see your layout is done by these few lines. The only thing you need to remember is that you always need to add DIV with class CLEAR after every grid column combination. Every grid_xx is floated to the left and you need to clear these floats to start a new "row" with columns.I hope this post was helpful. Just try 960.gs and you'll find how easy to use is this grid system and how many time you'll save when writing your code. Happy coding !!!

eCheck Security PHP tool - find malware on your site

SecretR — 2013-05-18T11:48:59+03:00

OvervieweCheck Seciruty is a tiny tool for detecting malicious PHP scripts and code portions on your website. It was originally build to check e107 CMS based sites, but it can be actually used on any kind of PHP based projects.This tool is licensed under GNU General Public License - http://www.gnu.org/licenses/gpl.txtBefore you start using the tool, I have to warn you - DON'T PANIC when you first see the 'suspicious' results. Be sure you read the 'Analyzing the results' chapter.Download most recent version of eCheck Seciruty hereShell script (echeck.php)Copy echeck.php somewhere on your server. In this example I'm copying it in /home/secretr/
[secretr@SecretR /]$ cd /home/secretr/
[secretr@SecretR ~]$ ./echeck.php -v
eCheck 1.0 beta
Report issues or get help on http://free-source.net or irc://irc.freenode.org/e107
[secretr@SecretR ~]$

SyntaxHighlighter.Manager.add("Bash");

You can always get quick help
[secretr@SecretR ~]$ ./echeck.php -v
eCheck 1.0 beta
Report issues or get help on http://free-source.net or irc://irc.freenode.org/e107

[secretr@SecretR ~]$ ./echeck.php -h
This is a command line PHP script for checking for/cleaning PHP malicious code.

Usage:./echeck.php [options] /path/to/wwwroot
Options:
-v Script version
-I Output a list with infected files only
-S Output a list with suspected files only
-C Clean files (MAKE A BACKUP BEFORE DOING THIS), confirmation is required
-r number Directory depth level

[secretr@SecretR ~]$

SyntaxHighlighter.Manager.add("Bash");

Now, the only thing you need to know is the path to your web root (e107 root for e107 user). In my case this is /home/secretr/public_html and my e107 Installation is located in e107_0.7 folder. There are two alternatives. You could let eCheck know the path to your web root:
$ ./echeck.php -I -S ./public_html/e107_0.7/

SyntaxHighlighter.Manager.add("Bash");

or the opposite - navigate to web root and call the script with the proper path:
[secretr@SecretR ~]$ cd public_html/e107_0.7/
[secretr@SecretR e107_0.7]$ /home/secretr/./echeck.php -I -S ./

SyntaxHighlighter.Manager.add("Php");

Here is the output of eCheck scan on fresh e107 v0.7 CVS copy:
[secretr@SecretR ~]$ ./echeck.php -I -S -r 10 ./public_html/e107_0.7/
Directory depth set to 10

./public_html/e107_0.7/backend.php...SUSPECTED (shell execution)
./public_html/e107_0.7/e107_plugins/pdf/pdf.sc...SUSPECTED (shell execution)
./public_html/e107_0.7/e107_handlers/resize_handler.php...SUSPECTED (shell execution)

Files checked: 1040
Files suspected: 3
Files infected: 0
Files cleaned: 0
Clean errors: 0
Clean warnings: 0

NOTE: SUSPECTED DOES N0T MEAN INFECTED! DIFF AGAINST TRUSTED COPY OF SUSPECTED FILES TO BE SURE EVERYTHING IS OK.
SUSPECTED FILES ARE NOT CLEANED!

[secretr@SecretR ~]$

SyntaxHighlighter.Manager.add("Bash");

There is (still experimental) cleanup option you could try if eCheck finds files marked as INFECTED. I recommend to make a backup of your files first. Additionally, you need write permission on all checked files (e.g. run eCheck as root) and your PHP version should be at least 5.0.I'll put infected and real malicious files inside my local e107 system to show you what happens:
[secretr@SecretR ~]$ ./echeck.php -C -I -S ./public_html/e107_0.7/
Directory depth set to 100

Did you make a backup? Be sure you did it! Type 'yes' to continue:

SyntaxHighlighter.Manager.add("Bash");

You need to confirm (type yes and press enter) to continue the operation
[secretr@SecretR ~]$ ./echeck.php -C -I -S ./public_html/e107_0.7/
Directory depth set to 100

Did you make a backup? Be sure you did it! Type 'yes' to continue: yes
./public_html/e107_0.7/echeckwww.php...SUSPECTED (eval/base64_decode found)
./public_html/e107_0.7/backend.php...SUSPECTED (shell execution)
./public_html/e107_0.7/index.php...INFECTED...CLEANED
./public_html/e107_0.7/e107_plugins/pdf/pdf.sc...SUSPECTED (shell execution)
./public_html/e107_0.7/e107_files/public/shell.php...SUSPECTED (eval/base64_decode found)
./public_html/e107_0.7/e107_handlers/resize_handler.php...SUSPECTED (shell execution)

Files checked: 1043
Files suspected: 5
Files infected: 1
Files cleaned: 1
Clean errors: 0
Clean warnings: 0

NOTE: SUSPECTED DOES NOT MEAN INFECTED! DIFF AGAINST TRUSTED COPY OF SUSPECTED FILES TO BE SURE EVERYTHING IS OK.
SUSPECTED FILES ARE NOT CLEANED!

[secretr@SecretR ~]$

SyntaxHighlighter.Manager.add("Bash");

Our index.php was infected with known infection, so eCheck was able to clean it. Note we have one new line - './public_html/e107_0.7/e107_files/public/shell.php'. We'll talk about this one later.One last example - let's execute eCheck as root (your current user should be sudoer), output everything (all checked files) and write the output to a file - log.txt in our case.
[secretr@SecretR ~]$sudo ./echeck.php ./public_html/e107_0.7/ > ./log.txt
[secretr@SecretR ~]$cat log.txt | more
Directory depth set to 100

./public_html/e107_0.7/install_.php....CHECKING...OK
./public_html/e107_0.7/user.php....CHECKING...OK
./public_html/e107_0.7/rate.php....CHECKING...OK
./public_html/e107_0.7/search.php....CHECKING...OK
./public_html/e107_0.7/online.php....CHECKING...OK
./public_html/e107_0.7/fpw.php....CHECKING...OK
./public_html/e107_0.7/print.php....CHECKING...OK
./public_html/e107_0.7/upload.php....CHECKING...OK
./public_html/e107_0.7/page.php....CHECKING...OK
./public_html/e107_0.7/links.php....CHECKING...OK
./public_html/e107_0.7/e107_languages/English/lan_notify.php....CHECKING...OK
./public_html/e107_0.7/e107_languages/English/lan_np.php....CHECKING...OK
./public_html/e107_0.7/e107_languages/English/lan_usersettings.php....CHECKING...OK
./public_html/e107_0.7/e107_languages/English/lan_membersonly.php....CHECKING...OK
./public_html/e107_0.7/e107_languages/English/lan_sitelinks.php....CHECKING...OK
./public_html/e107_0.7/e107_languages/English/lan_upload_handler.php....CHECKING...OK
./public_html/e107_0.7/e107_languages/English/lan_fpw.php....CHECKING...OK
./public_html/e107_0.7/e107_languages/English/lan_download.php....CHECKING...OK
--More--

SyntaxHighlighter.Manager.add("Bash");

Scan via a browser (echeckwww.php)For those who don't have shell access to their sites (most common case for shared hosting) there is an alternative.Copy echeckwww.php to your site root (in my case /home/secretr/public_html/e107_0.7/) and just call it in your favorite browser like this:yoursite.com/echeckwww.phpYou should see something like this (click to enlarge)Keep in mind you don't have any options you can set in this case. Auto-clean is not available as wellAnalyzing the resultsScripts are analyzed in two ways:Known infections - based on hackers code infection that I inspected in the time - files are added to output list as INFECTED, auto-cleaning is possible in some cases - on your responsibility though ;) Suspected infections (heuristics) - based on most common hackers habits - files are added to output list as SUSPECTED, cleaning is not possibleSuspected doesn't mean files are infected in some way. Most of the phrases (generic php functions) are used in all kind of software. The process of analyzing the results is your responsibility. If you know the structure of your site, and you have generic knowledge of 'what, where happens', it would be easy to identify the problems (if there are any).I'll use the example above, more precisely this line from our latest shell example:
./public_html/e107_0.7/e107_files/public/shell.php...SUSPECTED (eval/base64_decode found)

SyntaxHighlighter.Manager.add("Bash");

Every e107 user should know that /e107_files/public/ folder should not contain any scripts. Experienced admins would know what to do from now on - checking the file last modified date and investigating the Apache logs to find out how was this file uploaded on the server, eventually reporting the problem to e107 core team.In other hand we see
./public_html/e107_0.7/backend.php...SUSPECTED (shell execution)
./public_html/e107_0.7/e107_plugins/pdf/pdf.sc...SUSPECTED (shell execution)
./public_html/e107_0.7/e107_handlers/resize_handler.php...SUSPECTED (shell execution)

SyntaxHighlighter.Manager.add("Bash");

lines are appearing on and on. These are the false positives I'm talking about. You'll have many of them on a live site with a lot of 3rd party code. You just need to investigate all you see - it's pretty easy to distinguish malicious from creative code.Where can I get help?Support forumsUse support forums to report problems or just give me a feedback. irc://irc.freenode.org/e107Get help on e107 IRC channel