Bug Users complaining of losing all their "gold"

[Jester]

From my experience, vb's notifications for template updates only apply to vbulletin's templates, not those of addons.

If you expand the template group for vbcredits in your only enabled style you will see the ones that are edited are written with red instead of black text.

if you want me to be specific ill log back into your site to get the titles.

Thanks a bunch, should be all set now.

 

[Jester]

Hi again,

Now that we've upgraded and it's been running for a day, one of the members who keeps losing his gold informed me today that he lost it again. All he did was log out yesterday, and when he logged in today, his gold was zero'd out.

The upgrade did not cure it unfortunately.

 

[Darkwaltz4]

Does your login still work? I'll take a wide look at your settings. Also, let me know which member(s) this keeps happening to

 

[Jester]

Does your login still work? I'll take a wide look at your settings. Also, let me know which member(s) this keeps happening to

I put the password back to the one I gave you before.

Users so far:

AntP - has happened 3x
Fiery Esmeralda - has happened 2x
Austin IceBlade - has happened 1x

Thanks Dark

 

[Darkwaltz4]

It is kind of late, can I check it in around 12 hours? (you can switch password back then) sorry

 

[Jester]

I put the password back to the one I gave you before.

Users so far:

AntP - has happened 3x
Fiery Esmeralda - has happened 2x
Austin IceBlade - has happened 1x

Thanks Dark

Just happened again for AntP. :/

 

[Jester]

Hi Dark,

How can I get the info you need to fix this?

Thanks

 

[Ozzy47]

I'll tag Darkwaltz4 just in case he is not getting notifs of new posts in this thread.

 

[Jester]

I just had a different member come to me complaining about his disappearing "gold". :/

 

[Darkwaltz4]

Alright, lets get to the bottom of it this weekend:
Could you please create and PM me with a temporary FTP and AdminCP account?

For security reasons, we recommend you create a new FTP account only for DBTech support, then disable or delete it after we have both confirmed the issue has been solved and there are no further issues.

The same applies to AdminCP accounts; they should ideally be temporary accounts created for us only. If we have created an account on your site already, you can optionally boost that account to Administrator and then de-admin this account once the issue has been solved.

If you use a .htaccess password protection for your AdminCP directory, it is recommended that you create a new authorised user for DBTech and remove this user once the issue has been solved.

Please test any temporary accounts you create to ensure that the FTP account has access to the forum files, and that the AdminCP account can access the administrative controls for the product we are assisting you with.

Ensuring this is all in order before submitting the information will significantly speed up the process of assisting you. We will alert you via PM if there's any issues with the login information you have provided.

When sending the PM, for your security you should also un-tick the "Save a copy in my Sent Items folder" checkbox. When the access details have been received, we will delete the PM from our inbox. Ensuring you have not kept a copy of the PM reduces the risk of security breaches.

Thank you for helping us debug our products and allowing us to assist you, we appreciate it

 

[Jester]

Alright, lets get to the bottom of it this weekend:
Could you please create and PM me with a temporary FTP and AdminCP account?

For security reasons, we recommend you create a new FTP account only for DBTech support, then disable or delete it after we have both confirmed the issue has been solved and there are no further issues.

The same applies to AdminCP accounts; they should ideally be temporary accounts created for us only. If we have created an account on your site already, you can optionally boost that account to Administrator and then de-admin this account once the issue has been solved.

If you use a .htaccess password protection for your AdminCP directory, it is recommended that you create a new authorised user for DBTech and remove this user once the issue has been solved.

Please test any temporary accounts you create to ensure that the FTP account has access to the forum files, and that the AdminCP account can access the administrative controls for the product we are assisting you with.

Ensuring this is all in order before submitting the information will significantly speed up the process of assisting you. We will alert you via PM if there's any issues with the login information you have provided.

When sending the PM, for your security you should also un-tick the "Save a copy in my Sent Items folder" checkbox. When the access details have been received, we will delete the PM from our inbox. Ensuring you have not kept a copy of the PM reduces the risk of security breaches.

Thank you for helping us debug our products and allowing us to assist you, we appreciate it

Hiya Dark,

I don't run an FTP daemon on my server, never installed it, don't use one. Is there some other way?

 

[Ozzy47]

How do you upload files and such, phpmyadmin?

 

[Jester]

How do you upload files and such, phpmyadmin?

WinSCP :: Free SFTP and FTP client for Windows SSH/SFTP

 

[Darkwaltz4]

Okay, SFTP works fine too

 

[Jester]

Okay, SFTP works fine too

That would require me giving you "root" access. The authentication is handled by SSH and the protocol is sftp. There is no configurable sftp daemon running. If files need to be uploaded, I would be happy to do so. As far as AdminCP access goes, just let me know when you wish to work on it and I will give you what you need.

There has to be some automatic mechanism somewhere in vbcredits that removes credits. This is not something I ever wish to do, can this mechanism be disabled? I find it hard to believe that I would be the only one affected, I am running vB4.2.0+.

Thanks Dark!!

 

[Darkwaltz4]

Lots of people are using the latest vbcredits with the latest vb4.2 and youre the only one reporting this...
There is no single "mechanism" for deducting credits. It is based on your settings, which apparently are fine (I looked them over many weeks ago when you first sent it). I don't have any ideas to try, except to go the debugging route with file system access.

You do NOT have to give me root access. All servers I've ever known (and I've worked with plenty that are SSH/SFTP only) include a regular user for mundane tasks. A system with only a root account would be very insecure.
I cant give you "files to upload" because debugging involves lots of little tiny edits and checking how the output fits expectations due to those edits. It would be a very long and tedious process for both of us to keep passing whole files and waiting for the other guy.

 

[Jester]

Lots of people are using the latest vbcredits with the latest vb4.2 and youre the only one reporting this...
There is no single "mechanism" for deducting credits. It is based on your settings, which apparently are fine (I looked them over many weeks ago when you first sent it). I don't have any ideas to try, except to go the debugging route with file system access.

You do NOT have to give me root access. All servers I've ever known (and I've worked with plenty that are SSH/SFTP only) include a regular user for mundane tasks. A system with only a root account would be very insecure.
I cant give you "files to upload" because debugging involves lots of little tiny edits and checking how the output fits expectations due to those edits. It would be a very long and tedious process for both of us to keep passing whole files and waiting for the other guy.

Understood. Nobody else touches my servers, I've never had need to give a regular user any sort of access.

I'll set up an ftp server temporarily. I'll be back in touch.

 

[Jester]

Lots of people are using the latest vbcredits with the latest vb4.2 and youre the only one reporting this...
There is no single "mechanism" for deducting credits. It is based on your settings, which apparently are fine (I looked them over many weeks ago when you first sent it). I don't have any ideas to try, except to go the debugging route with file system access.

Alright, it's now happening on a second server of mine. I do not know if the problem on the original site is still happening because I've had no complaints to report lately.

I've resorted to backing up my user table separately each night so I can look up the complaining members' balances from the day prior. It's a major pain and unfortunately a large, busy site.

Please let me know when you will have time to devote to this. I will need to work out ssh/scp access for you first though.

 

[Fillip H.]

Understood. Nobody else touches my servers, I've never had need to give a regular user any sort of access.

I'll set up an ftp server temporarily. I'll be back in touch.

I just wanted to follow up on the point about not having to give regular user any access - that's not the issue, the issue is that if you install and run your site as root then you better be 100% sure that none of the PHP scripts you run have any form of vulnerability (which, btw, is 100% impossible to guarantee) otherwise a malicious user will have full access to your server and can install any form of malware they so desire without you knowing about it.

The mantra that Linux doesn't get malware is only true because you have to go out of your way to grant root access to scripts - in a normal environment. No app will ever ask for root access, and system apps / libraries are updated via a secure connection to servers maintained by the people who made your distro.

All that is thrown out the window if you run your web server as root. I cannot stress enough how monumentally bad the idea is. If that is the way your server is set up, I would suggest you devote 100% of your attention to resolving that immediately, and if possible coupled with a full OS reinstall from source to ensure any malware that may exist on your server is nuked.

Normal systems run Apache (or whatever other web server) as either apache, nobody or generate an individual account for each site running on the server (we have only 1 site on this server, so only 1 web server user).

 

[Jester]

I just wanted to follow up on the point about not having to give regular user any access - that's not the issue, the issue is that if you install and run your site as root then you better be 100% sure that none of the PHP scripts you run have any form of vulnerability (which, btw, is 100% impossible to guarantee) otherwise a malicious user will have full access to your server and can install any form of malware they so desire without you knowing about it.

The mantra that Linux doesn't get malware is only true because you have to go out of your way to grant root access to scripts - in a normal environment. No app will ever ask for root access, and system apps / libraries are updated via a secure connection to servers maintained by the people who made your distro.

All that is thrown out the window if you run your web server as root. I cannot stress enough how monumentally bad the idea is. If that is the way your server is set up, I would suggest you devote 100% of your attention to resolving that immediately, and if possible coupled with a full OS reinstall from source to ensure any malware that may exist on your server is nuked.

Normal systems run Apache (or whatever other web server) as either apache, nobody or generate an individual account for each site running on the server (we have only 1 site on this server, so only 1 web server user).

My scripts are run as user "nginx".