I found the culprit code. It was uploaded at a /resource/ public directory (which must be public for the images to be loaded). The criminal was able to upload php scripts which contains some code executed by eval() php function.

filesize :9Kb and 10Kb

it is uploaded in every public directory, along with a .htaccess

Options -MultiViews
ErrorDocument 404 //resources/images/hobby/filename.php

the filename at the end is the same as the filename of the php code above.

Finally it also injects its code inside php scripts which can be found by searching the word ‘beajezzazbzii’

I’ve upgraded the to the latest WordPress 2.9.2 just in case.

So far, I’m able to bring back the site, but I still have to fix other directories affected by this attack.

I’ve made some reviews and read some topics regarding this from the lifeRay Community Forum:

http://www.liferay.com/web/guest/community/forums/-/message_boards/search?_19_redirect=%2Fweb%2Fguest%2Fcommunity%2Fforums%2F-%2Fmessage_boards%2Fcategory%2F239390&_19_breadcrumbsCategoryId=239390&_19_searchCategoryId=239390&_19_tabs1TabsScroll=&_19_keywords=PHP

there are many users want to use php to develope porlets in liferay. in the forum you can see people ask all kind of php questions. but it seems none of the liferay developers focus on the php part. you can earn more customers with php i think.

the quercus engine in the liferay is very old and buggy. are there any plans to update it? i trid to update it by myself last year. but i found i can not call liferay java function any more in php. so there must be some tricky part about quercus integrated in liferay.

NO! The lack of help on this forum is really pissed a lot of people off… why offer a cross platform product if the programmers language of choice cannot be replicated? Liferay could someday be a great application if the “developers” of this application would, oh I don’t know, actually come up with some kind of helpful/useful documentation… the “documentation” that is out there is definitely not helpful!

The php portlet isn’t really usable for anything but very simple php scripts. The PHPPortlet use Quercus for executing the php and that part works fine, it’s the post processing which isn’t enough. I’ve looked into it and for example it doesn’t handle paths correctly, doesn’t rewrite other tags than a and form etc. I’m working on addressing those issues but it’s not so easy to accomplish as the whole page returned by php needs to be converted.

If you want to deploy a complex php application under Liferay then there are a few alternatives:

Use Quercus to deploy the php app as a separate war on the same app server. Quercus is a java implementation of php, 5.2 I think.

Use native php with Tomcat, there are several descriptions on the net on how to get php5 to run under tomcat.

Use native php with Apache.

Where are all the PHP functions?

Where are $_POST and $_GET?

How the crap is this framework supposed to support PHP when normal PHP developers CAN’T GET HELP on the forums? Their posts have all gone unanswered for MONTHS.

Sorry, but I have no plans to talk good about this platform because it is seriously lacking. I guess I just don’t see it’s use being widespread because the average developer won’t use it with no support.

Thanks Sean

P.S.: So far it’s been slow as BEANS.

My apologies about being so harsh, but I really feel like there has not been adequate documentation about Liferay.

So, we figured it out on our own after about 12 hours. It took us that long to realize that Liferay hijacks the PHP you write and rewrites any urls, hrefs, file paths, etc. Everything has to be written in a local format, for example:

/page2.php // or page3.php

Also, it looks as though we cannot do any XHR (AJAX) to pull in any data from pages in the same portlet. Apparently the PHP is not parsed at all, and just the contents of the PHP file are returned.

Lastly, without parsing PHP with a XHR request, and forcing a full page to be rendered (no JSON?!) this platform really does not cater to the way most web developers work (Yes, most web developers are using PHP, not Java).

So, how can we do the following things?:

1. Do a normal AJAX request to a page in the same portlet. 2. Return the AJAX response data in JSON (or other parse-able format: XML, regular HTML) without any Liferay template wrappers

mcahornsirup said…

Hi. I’am currently thinking about “enabling” PHP-Developers to build PHP-Portlets. But what is the benefit? Is it possible to use a PHP-Framework they are allready familiar with too? Or, is it just “syntactic sugar”?

What about the persistence? how easy/difficult is it to use the infrastructure provided?

Somehow it looks like a marketing trick…

eichelgartenweg said…

hi,

from my view its only a marketing trick. It is not really useful…

serveresource with php 9/25/09 5:59 AM hi: i have create dynamic content with php for user to download. I have read the portlet download howto guide:

Howto Guide

but I am not really understand it. and i can not make the concept working under php. my php code like below:

$portal = $response->getResponse(); $portal->setContentType(“application/octet-stream”); $portal->addHeader(“Content-Disposition”,’attachment; filename=”test.bin”‘); echo $dynamic_content;

the “setContentType” and “addHeader” method runs happily. but the $dynamic_content is still show on the screen, not to the user for download.

I know I must miss something or misunderstand the whole concept. thanks for help!!

RE: serveresource with php 9/25/09 8:42 PM as a reply to sky tb. hi: i now use another php script runninig under apache to handle the download request. I hope there is a better way to handle this under liferay. I am still studying the concept. any recommend to finish the job?

———

Analysis:

• Portlet PHP Developments lacks documentation and Forum/Community support, Most PHP questions could be given absolute answers, or not answered at all.

• Only supports basic PHP portlets.
• Quercus used for executing PHP script is old and buggy.
• Finally, as PHP/Web developer it did gave me a feeling of it being quite slow, despite being installed and tested in a local machine. I could be wrong though, maybe because it loads a lot of scripts  and css before being displayed…

An alternative here is to use SOAP web service. For example:

PHP (back-end) application, shall be the SOAP server. And that portlets are made in Java, which fetches data from/to SOAP server.

“EtherPad is the only web-based word processor that allows people to work together in really real-time.”

“When multiple people edit the same document simultaneously, any changes are instantly reflected on everyone’s screen. The result is a new and productive way to collaborate on text documents, useful for meeting notes, drafting sessions, education, team programming, and more.”

Its really cool, however I wish it supports more features like GoogleDocs have, and/or better yet an online/web based syntax highlighting editor

Its major features are:

• Edits highlighted in author’s colors Quickly know who contributed what to the document.
• Really real-time Forget emailing files back and forth: changes happen instantly for everyone.
• Infinite Undo History Don’t stress about group mistakes — all changes are saved on the server and can be undone at any time.
• Global list of pads for your organization Track all your pads and sort them by authors.

Speed up the software development process with Workspace, our hosted project management solution.

• Fully featured, ready-to-use environment for small teams
• Keep track of code, collaboration and tasks
• Secure hosting trusted by 1,400 users in just the first month

Why Workspace?

With Workspace you can focus on code, not on setting up servers or configuring code repositories, ticketing systems and valuable project management tools.

Even if you’re not familiar with version control or issue-tracking systems, you’ll quickly become more productive.

Who’s it for?

Software consultancies, online agencies and outsourcers. If you want to keep all your development in one place – be it issue tracking, documentation or code sharing – Workspace is for you.

Workspace is for public, open source projects and private, proprietary code. You control who has access to what and can even customize the workflow.

With Workspace you can collaborate with an unlimited number of contributors. And it’s all online, so it’s ideal for connecting remote teams.

How does it work?

• Get up in running in seconds by pushing an existing repository or starting fresh.
• Create a new project in under 2 minutes.
• Add your source code in just a couple of clicks.
• Set up your blog or wiki in seconds once your project is under way.

Get your FREE account now.

Some have embraced it, some have discarded it as too far in the future, and some have abandoned a misused friend in favor of an old flame in preparation. Whatever side of the debate you’re on, you’ve most likely heard all the blogging chatter surrounding the “new hotness” that is HTML5. It’s everywhere, it’s coming, and you want to know everything you can before it’s old news…

On June 12, 2009, the AKO MISMO dog tags will be made available to the public for the very first time. The dog tags will be sold at P40 each;  the proceeds of which will go to our beneficiary charity partners and to the socio-civic activities which we will be mounting nationwide.  It is such an important event for us that we declared it the AKO MISMO DOG TAG DAY which will be  held at the Bonifacio Global City Open Field in Taguig City.  

The event will start at 2pm when we start selling the dog tags to the public.  The dog tag will be your entrance ticket to the events of the day.

From 2PM onwards,  you have the opportunity to mill around and check out the eleven charity booths we have set up, as well as other activity ! booths.

The charity booths will be distributing information about their respective causes and each of them will carry AKO MISMO T-shirts and lanyards specifically designed for the charity.  People who wish to support a particular charity should simply make a purchase there and proceeds will go towards their charity of choice. Our beneficiary charity partners are Caritas Manila, UN Stand up Against Poverty, World Vision, Dynamic Teen Company, ERDA, UP PGH Cancer Institute Foundation, Gawad Kalinga, Cutis Laxa Benefit, PNP Badge of Honor Foundation, PLDT Smart Foundation and DDB Cares.  

The venue will also have fun interactive booths: Henna Tattooing, Face Painting, Ako Kiss Mo booth, as well as photo and video booths.  There will be food and beverage booths courtesy of McDonald’s and Pep! si.&nbsp ;

From 5 to 7PM, school bands and some up and coming professional bands will perform, interspersed with videos of the different charities and live sharing from their reps. 

From 7 to 9PM, the main concert will take place featuring the hottest bands in the country: Bamboo, Pupil, The Dawn, Kamikaze, Kjwan, and Up Dharma Down. Ely will open with his hit song Sala but with lyrics specially written for  Ako Mismo. There will be a special number with all the bands performing together  to pay tribute to the late Philippine music icon Francis Magalona . 

All registered members of Ako Mismo attending the event will get a chance to win one of five Lenovo laptops and other gadgets being given away that day.  Those who have not registered yet can do so at the Ako Mismo booth. The raffle tickets are also available here. It will a have a portion that will be marked by each of the activity booths. Raffle winners who have at least three marks on their form (meaning they participated in three activities) will get limited edition premium dog tags. 

The venue can accommodate 20,000 people at most. Please do come early as the gates will be closed once the venue is full. 

Food and non-alcoholic drinks will be sold inside the venue, so there will be no food or drinks allowed upon entrance. For security reasons, people will be frisked at the entrance to check against illegal drugs and dangerous weapons. 

We look forward to your participation at the AKO MISMO DOG TAG DAY.  Thank you for your continued support.

AKO mismo is about YOU…

… making a stand and taking real action for the causes you believe in.

Causes that you yourself can truly pursue to make a real, positive difference to your fellow countryman, to your country.

It is for you who still dare to hope that life for millions doesn’t have to be a hopeless battle against problems like poverty, illiteracy, unemployment.

It is for you who believe that not enough is being done about our country’s problems. And that to do right things, you’ll do them yourself.

It is a movement where you can show your patriotism and compassion, and make these traits infectious.

It’s about action that eradicates hopelessness in every Filipino.

How hard will this be to accomplish? Well that will be entirely up to you.
In AKO MISMO you get to choose the cause you wish to pursue. No cause is too small as long as it is a noble one. All we ask is that you make a pledge to do it.

You yourself can pledge anything: from teaching English to your yaya’s kid, to making sure that your barangay is dengue-free.

Or make a pledge to do your part in ending corruption, prostitution, illegal drugs or the inhumane treatment of animals. The choice is yours.

No matter how small, as long as you pledge that you yourself will take action, it’s sure to make a big difference.

Giving more hope for Filipinos to stop merely surviving, and start living. And it starts with you.

MISMO yan.

Click here to register and make your pledge.