VirtueMart Forum

VirtueMart 2 + 3 + 4 => Virtuemart Development and bug reports => Development & Testing => Topic started by: DaggaTora on July 16, 2012, 13:08:00 PM

Title: [SOLVED] Hacking my own store message in 2.0.8d
Post by: DaggaTora on July 16, 2012, 13:08:00 PM
Hi,

everytime a user change something in his profile, like the adress, he recieves the following message:"Info: Stop try to hack this store, you got logged".

;D


----------------------------------
Solved by Milbo I The Great
Title: Re: Hacking my own store message in 2.0.8d
Post by: Milbo on July 16, 2012, 17:52:02 PM
Please try the attached file, ,remove the .txt and copy it to \administrator\components\com_virtuemart\helpers

[attachment cleanup by admin]
Title: Re: Hacking my own store message in 2.0.8d
Post by: DaggaTora on July 16, 2012, 19:06:47 PM
Tried but still remains the hack message.

I've change this file before in the morning when the orders didn't appear: http://forum.virtuemart.net/index.php?topic=105220.15 (http://forum.virtuemart.net/index.php?topic=105220.15)

Thanks Milbo
Title: Re: Hacking my own store message in 2.0.8d
Post by: Milbo on July 17, 2012, 09:50:58 AM
hmm this file is in the e version and I tried it as normal user, as administrator and as shopowner. It works always without any message.
Title: Re: Hacking my own store message in 2.0.8d
Post by: DaggaTora on July 17, 2012, 10:08:53 AM
The thing is that it also says: Info: Data saved. So, is there a way to just comment that line or hide it someway?
Title: Re: Hacking my own store message in 2.0.8d
Post by: Milbo on July 17, 2012, 10:18:08 AM
Did you installed version e?
Title: Re: Hacking my own store message in 2.0.8d
Post by: DaggaTora on July 17, 2012, 11:06:51 AM
Nope, yesterday i couldn't find it but i see now its in dev.

I'll install and report!
Title: Re: Hacking my own store message in 2.0.8d
Post by: DaggaTora on July 17, 2012, 12:12:40 PM
Updated... same result  :-\
Title: Re: Hacking my own store message in 2.0.8d
Post by: Milbo on July 17, 2012, 13:20:49 PM
Do you have multivendor enabled?
Which kind of users is it?
Title: Re: Hacking my own store message in 2.0.8d
Post by: DaggaTora on July 17, 2012, 13:31:54 PM
No multivendor,

Is a normal shopper user.

If I do it with a vendor i get the following:

Info: Datos de usuario almacenados
Info: Datos de vendedor guardados
vmError: TableVendors El Nombre Vendedor ya existe.
vmError: VmTableData Sef Alias falta en registro ! No se puede guardar el registro sin Sef Alias.
vmError: store vendor
Title: Re: Hacking my own store message in 2.0.8d
Post by: Milbo on July 17, 2012, 14:50:41 PM
There is more broken in your store. Please go into your vmusers table. Ensure that only the shopowner is_vendor and has the vendorId=1
Title: Re: Hacking my own store message in 2.0.8d
Post by: DaggaTora on July 17, 2012, 17:06:37 PM
Yes, only me is admin and vendorId=1
Title: Re: Hacking my own store message in 2.0.8d
Post by: DG on July 25, 2012, 06:48:04 AM
I can confirm the same error in 2.0.8e also (upgrading from 2.0.7d on Joomla 2.5.6)
Title: Re: Hacking my own store message in 2.0.8d
Post by: DG on July 25, 2012, 07:31:11 AM
I can also tell you that after downloading a backup .tar file of the site and unpacking it, that this file was caught by my virus program and deemed "Trojan Horse PHP - BackDoor.CK":

administrator/components/com_virtuemart/classes/payment/paypal_api/certificate/ibinc.php
Title: Re: Hacking my own store message in 2.0.8d
Post by: DaggaTora on July 25, 2012, 09:58:12 AM
Mmmm yesterday my hole site was deleted from the server. Hope it has nothing to do with this.
Title: Re: Hacking my own store message in 2.0.8d
Post by: DG on July 25, 2012, 10:16:25 AM
I'd like to know if it's native to VM - if so, it needs to be addressed quickly.
Title: Re: Hacking my own store message in 2.0.8d
Post by: celticwebs on July 27, 2012, 00:32:04 AM
I am now having the same issue, client contacted me a little bit paniced that it was stating the store was being hacked by them!  This most definitely needs fixing soon!
Title: Re: Hacking my own store message in 2.0.8d
Post by: Milbo on July 30, 2012, 00:29:10 AM
Please try always first to disable your template overrides.

I am quite sure it is connected to it.
Title: Re: Hacking my own store message in 2.0.8d
Post by: Martin. on August 02, 2012, 16:43:09 PM
I have similar problem but I get this error when I m completing an order. When I go to checkout choose shipment, payment and then move to final stage where the order is submited and order summary is displayed I get a message "Info: Stop try to hack this store, you got logged" and below that another message.
"Info: Message sent to .... user mail@domain.com ". It cant me related to template overrides cause it even happens on default joomla templates, it happens on every template. My VM version is 2.08e and Joomla 2.5.6. Any idea what is causing this problem ?
Title: Re: Hacking my own store message in 2.0.8d
Post by: Martin. on August 06, 2012, 13:32:16 PM
If you dont know the cause of this problem then please atleast tell me what file is generating this error so I can comment out this function.
Title: Re: Hacking my own store message in 2.0.8d
Post by: dorriGa on August 23, 2012, 08:41:32 AM
in VM 2.0.10 still the warn..... I comented the line 527 in administrator\components\com_virtuemart\helpers\vmtable.php:
vmWarn('Stop try to hack this store, you got logged');
and line 581:
vmWarn('Stop try to hack this store, you got logged');

¿is there a solution for do not coment line?
Title: Re: Hacking my own store message in 2.0.8d
Post by: Milbo on August 23, 2012, 09:18:28 AM
Then you have an other error dorriGa.
Title: Re: Hacking my own store message in 2.0.8d
Post by: dorriGa on August 23, 2012, 19:20:03 PM
yes, another error :(

And quiting all overwrites layount dont work.
Title: Re: Hacking my own store message in 2.0.8d
Post by: Milbo on August 23, 2012, 20:36:22 PM
What do you do to get this? FE or BE? As user? as admin?
Title: Re: Hacking my own store message in 2.0.8d
Post by: dorriGa on August 28, 2012, 02:04:09 AM
This msg show with FE with user default registered.

I did this and still the message:
Update VM to the last 2.0.10 and vm aio too.
Erase all layount in template.

another way without results...
change template to default template like Beez2 or Beez5 and chenge to default layount in VM configuration, and the msg again showing.

I update all files layount from original com_virtuemart/view to my template and insert the personal css changes , but still showing that I m hacking me self :O

the user is loged just in FE like default register, there are not admin user loged in the same time .

the url to user dails is this
index.php?option=com_virtuemart&view=user&layout=edit
Title: Re: Hacking my own store message in 2.0.8d
Post by: smcpaiva on August 28, 2012, 22:00:47 PM
Dear,

The message "Stop try to hack this store, got logged" appears because the option Multi Vendor is active!

;)

Title: Re: Hacking my own store message in 2.0.8d
Post by: dorriGa on August 29, 2012, 00:31:26 AM
Quote from: smcpaiva on August 28, 2012, 22:00:47 PM
Dear,

The message "Stop try to hack this store, got logged" appears because the option Multi Vendor is active!

;)


Hi, tankyou smcpaiva  for answer, but dont work. so... I will change the message for "wellcome to the site" or something like.

(https://fbcdn-sphotos-f-a.akamaihd.net/hphotos-ak-snc7/308381_10150875903228078_868180036_n.jpg)

(https://fbcdn-sphotos-d-a.akamaihd.net/hphotos-ak-ash4/293008_10150875903103078_1549473622_n.jpg)
OMG!! I was logged...Im scared, the admin will.....wait a moment.. Im the admin o_0

Title: Re: Hacking my own store message in 2.0.8d
Post by: Milbo on September 02, 2012, 18:52:23 PM
you are an admin, but not the storeowner,... I think due an old version your admin has the vendorId=1, but there should be only one person with vendorId=1, so I think you just should check your db, check the vmusers table and assure that all users have vendorId=1 except your real store admin (the one with your shop addresses)
Title: Re: Hacking my own store message in 2.0.8d
Post by: dorriGa on September 04, 2012, 10:07:17 AM
thank you very much Milbo !!

Indeed, you are correct in your assumption, in the database had more than one user as "vendor = 1". And actually all users.
I guess with the move from VM1, users spent as vendor = 1. Now I modified the 900 users as "vendor = 0" except the owner of the store and the problem has been resolved.
With this change, no warning message appears.
I really appreciate your help, now I will not change the message in code
:D.
Title: Re: [SOLVED] Hacking my own store message in 2.0.8d
Post by: Milbo on September 10, 2012, 20:15:21 PM
Great
Title: Re: [SOLVED] Hacking my own store message in 2.0.8d
Post by: batboiko on September 12, 2012, 18:42:04 PM
How can i change that that for All users ? I don't whant to go and change it on by one. I have 3000 users

Title: Re: [SOLVED] Hacking my own store message in 2.0.8d
Post by: Milbo on September 13, 2012, 09:30:12 AM
Execute on your db (for example via phpmyadmin)
UPDATE `#__virtuemart_vmusers` SET `virtuemart_vendor_id`="0" WHERE  `user_is_vendor`= "0"

just replace the #_ with your prefix