[05:09] morning peeps [05:09] hi tumbleweed havent you gone to bed yet? [05:10] Kilos: might do so soon [05:10] whew [05:10] have a good sleep and a good day [05:11] thanks :) enjoy your day, too [05:12] ty [05:42] morning [05:42] hi Squirm [06:06] More almal [06:07] hi bduk [06:11] Genoeg gereen Kilos [06:11] nee man net 10mm [06:11] Darem 150 by ons maar die meter wys net 50 [06:11] sjoe [06:53] more inetpro [06:53] hi bushtech [06:54] Hi Kilos [07:17] hi Xethron [07:17] morning superfly hows the family? [07:20] hi Kilos, all good. [07:20] nice [07:25] hi ThatGraemeGuy, finally got to work? [07:25] hi ThatGraemeGuy [07:26] morning, yes [07:26] hour and a half to travel 7km, happy monday :) [07:30] ouch [07:30] what broke [07:34] http://www.tygerburger.co.za/200182/news-details/n1-into-cape-town-closed-due-to-accident [07:35] eish [07:52] eish indeed [08:29] would be awesome to have a freenode server in africa [08:36] speak to the hetzner peeps, their servers are lekker fast [09:40] good morning all [09:43] hi magespawn [09:44] hello Kilos [09:44] important meet tomorrow night hey [09:44] wb ThatGraemeGuy [09:55] yes i saw the mails. was it added to the agenda? [09:55] thanks man i couldnt get to do that [09:56] oh no if you can will you please. i keep getting lost there [09:56] when i login i go to me not the agenda page [09:59] i will if i get a chance, i am trying to sort a hacked website [10:00] anybody have any idea how they are redirecting canefields.co.za to http://ansainmobiliaria.com/wp/wp-content/plugins/Paypal-Account/ ? [10:02] sjoe [10:03] ill go have another go with the agenda, but things changed from last time. and when i go to G+ i dont see circles anymore [10:03] sort your site lad. lemme see [10:04] magespawn: I think it's in the index.html of canefields [10:05] cool thanks Squirm, will check there [10:05] or their index.php [10:05] because when I ping canefields.co.za, I get a reply from the company they use as their nameservers(must be their hosting providers too), found that on co.za [10:06] so you're getting to the correct site, then being directed after that [10:06] i thought as much Squirm, just could not see how it was happeningn [10:07] a redirect is as simple as: header("Location: " . http://blah.blah); [10:07] in php [10:13] I even tried to download that file, but even wget gets redirected [10:14] so I can't see the infected file either [10:15] could also be .htaccess if the hacker somehow got access to write that file [10:17] magespawn: what is the IP address of the server it's hosted on? [10:17] let me check [10:18] 198.38.82.161 [10:18] the one it's meant to be hosted on [10:18] maybe look in cpanel? [10:27] Squirm, i can't find anything there [10:33] Connecting to canefields.co.za (canefields.co.za)|198.38.82.161|:80... connected. [10:33] HTTP request sent, awaiting response... 302 Moved Temporarily [10:33] ok [10:33] so it looks like that's how they're doing it [10:35] magespawn: it could very well be in the .htaccess ? [10:36] okay [10:36] .htaccess in the public_html folder? [10:36] it'll be in the root of the website [10:36] so probably that one [10:37] unless something has happend on the hosts side [10:38] look for the code 302 [10:38] http://pastebin.com/E8CP0Anb this is the .htaccess file [10:39] :/ [10:43] I have a feeling you're going to have to create a ticket with your host. Tell them is seems your website is being redirected through the status code 302 [10:43] maybe they can have a look [10:44] thanks Squirm [10:44] yeah... I'm not sure where they're hiding that [10:44] or what else could be wrong [10:45] Squirm, you got some time? [10:46] i go to agenda then login and end up in ubuntu wiki [10:46] http://bit.ly/1sKcgnI [10:46] https://wiki.ubuntu.com/ZATeam/Meetings/20141028 [10:47] lemme look [10:47] why do you have to login? [10:47] to add an item to the agenda [10:47] one logged in, try go to that link again? [10:48] there used to be an add button on the thing to add [10:48] i dont see it anymore [10:49] just creating an account quick [10:49] ok ty [10:50] weenie broke it [10:50] it's hanging on the login screen :/ [10:50] it takes long to login [10:51] 5 mins last time [10:51] i thought ubuntuone was given up but i see its there when you login and thats what takes the time [10:52] I think nuvolari_ has made it unchangable [10:52] top left, it says Immutable Page [10:52] oh ya nuvolari_ hmm... [10:52] Immutable being unchangable [10:52] nuvolari_, ping [10:52] I'll drop him a message [10:53] please do and remind him he is chairing tomorrow night [10:54] yep [10:54] magespawn: you should look at your index.php again, i think it is in there, because: http://pastebin.com/HGixejRf [10:54] lunch time [10:54] or any of the files included by index.php [10:55] TinuvaMac: I checked. but look at the status code, 302 Temporarily Moved. that's usually something you put in a .htaccess or maybe even in the httpd config [10:55] lunch time :) [10:57] squirm, even php header('Location: http://somesite') will cause a code 302 redirect [10:57] ah [10:57] ok [10:58] for example: header('Location: http://somesite.com/',true,302); [10:59] http://uk3.php.net/manual/en/function.header.php [10:59] ok [10:59] I see [10:59] so I am 100% sure, there is a line like that either in index.php or any of the files included by index.php [10:59] Kilos: once logged in, go back to the meeting page [10:59] top left is the edit button [11:00] you have to be logged in though [11:02] ok so check this http://pastebin.com/RWyEWGA5 [11:02] when i query another url on that same domain, the 302 code doesnt pop up [11:04] good idea to also go on lunch now [11:10] ai! i dunno what to add in the edit page, used to be a add item button [11:15] ok its added. hope it didnt need anything in from of it [11:44] Still searching no luck so far [12:02] download a copy of the website, and do a grep through the files for files with the "header" word in it [12:02] good idea [12:03] I think they use Redirect in javascript too [12:03] yeah manually searching is going to be a hit and miss scenario you want to avoid [12:03] its all about doing it as fast as possible [12:12] i have used this site http://aw-snap.info/ which helped a bit but did not list the file just the line [12:15] i got this back http://is.gd/ZUqDxY [12:58] Squirm, ty for the help earlier [12:59] good afternoon [12:59] magespawn: have you checked your nginx configs? [13:00] no do not know how [13:04] sorry got a bit lost there [13:04] inetpro, no, how do i do that/ [13:05] uh [13:05] how do you manage your server? [13:06] through cPanel [13:07] eish! Don't you have a nginx option? [13:08] or web server configs [13:08] sorry, I don't do cpanel stuffs [13:10] not that i can see let me look under the whm login, it is shared hosting [13:11] okay found nginx admin under the whm [13:15] and get the error message that i do not have the proper permissions to edit [13:16] hi inetpro [13:16] hi Kilos [13:17] magespawn: make the call to the guy with permissions [13:30] good call inetpro [13:30] fixed magespawn ? [13:31] magespawn: who owns the server? [13:31] i have started with the support dept [13:32] mochahost [13:55] back again [13:55] wb [14:00] gotta go again, need to get myself down to Empangeni [14:01] go safe [14:03] chat later [14:37] home time [14:37] what a day... [16:32] evening [16:34] hi Squirm [16:52] whew i get lotsa stuff in my circles [16:53] and it eats data grrr [16:59] good evening [16:59] Maaz: coffee on [16:59] * Maaz puts the kettle on [17:03] Coffee's ready for charl! [17:05] Maaz: thanks [17:05] charl: Okay :-) [17:18] hi charl [17:29] hi Kilos [17:29] how are you doing [17:29] im ok ty and you? [17:29] tell me [17:29] i spose this is a stupid question [17:30] i'm better [17:30] is there a different bell.ogg file for 64bit [17:30] no it's a .ogg so it's a sound file [17:30] what you mean you better? [17:30] it isn't a binary executable so it doesn't need 54bit [17:30] *64bit [17:31] i had a cold for a couple of days [17:31] still recovering [17:31] no man what i mean is , i had to bring my old bell.ogg here from old 10.10 files [17:32] so it doesnt change, maybe its hexchat that dont like using it [17:32] im sure it was crystal clear on konversation [17:32] ah [17:32] yeah sounds like it's related to hexchat [17:32] kinda muffled on hexchat [17:33] ill try konversation again to check [17:33] ok [17:34] lemme close here or im gonna hear it twice [17:35] yeah its clearer on konversation [17:36] grrr [17:41] we got better speed since our local repo was pointed to kenya [18:15] hello [18:25] hi Kilos [18:25] ohi kbmonkey wb [18:27] how gaan it Kilos [18:27] goed dankie en self kbmonkey [18:28] lekker soos n cracker [18:28] hehe [18:29] keke [18:30] voel lekker moeg vanaand [18:30] hi Kilos\ [18:31] we gotta have a serious chat about this re evalution thing tomorrow [18:31] hi my fly [18:31] hi the fly! [18:32] i hope maia kan get online tomorrow night, she couldnt connect last time [18:36] :) [18:37] wb magespawn [18:38] hi Kilos ty [18:46] did you fix that server magespawn ? [18:47] not yet i had some other things to do, going to be working on it now [18:47] whew [18:47] have you got permissions at least [18:51] hi inetpro meeting tomorrow night hey [18:52] you have to chair [18:53] uh, may unfortunately not be here [18:53] not the nginx permissions [18:53] I have my reminder set, I should be here in time too [18:53] inetpro ok ill get nuvolari_ to chair if you can just attend [18:54] hgehe [18:54] hehe too [18:54] lol [18:55] magespawn how are you supposed to fix it without admin permissions [18:57] that is just for the configuration of the server itself, if that is the problem the hosting company has to sort it out [18:57] ah [18:57] i need to make sure that it is not something in my files [18:57] ok good luck then [18:58] just busy downloading the site now so that i can use local search to find the offending line [18:58] ok [18:59] something like this header('Location: http://ansainmobiliaria.com/wp/wp-content/plugins/Paypal-Account/'); [18:59] why does it want me to login with paqypal account [19:20] magespawn: go rename your index.php and create a new one with just hello world [19:21] then we test and see whether it still gets redirected [19:26] magespawn: hello!! [19:26] ai! [19:28] hehe [19:28] hy dink man [19:28] en konsentreer [19:40] he probably went sleepy [19:43] time for me to say good night [19:43] or for late supper or a shower while that site is downloading [19:43] me too. night all. sleep tight [19:47] hi inetpro [19:47] was just catching a quick snooze [19:54] magespawn: ok, did you see what I said above? [19:58] good evening inetpro, magespawn