500 error with gallery.

[landyvlad]

The gallery link: https://gsx1400owners.org/forum/index.php?action=gallery
as you can see currently generates a 500 error.

HISTORY

I was getting the 500 error as above and the error log contained:

Guest
 (IP address)
 d62cd46c0b4c4ffa6255407149e35b63
 https://gsx1400owners.org/forum/index.php?action=gallery;sa=view;id=135
 /home/gsxowner/public_html/forum/index.php (Line 455)  Backtrace information

Type of error: General
Error messageSelect
2: require_once(/home/gsxowner/public_html/forum/Sources/Gallery2.php): Failed to open stream: No such file or directory

One of my fellow admins who's more conversant with the backend side of things, said:

there is a file  called Gallery2.php keeps deleting itself, I have no idea why
I keep putting it back, and they gallery works again. but it just goes again.

I realised I was using a previous version of gallery pro so downloaded and installed the latest version (as at the date of this post). This seemed to fix the issue. Briefly.

Presumably this reinstall meant that, once again, there was a Gallery2.php in the directory again but yes, it soon disappeared.

Ultimately tracked this down to

CPGuard is detecting Gallery2.php as possibly malicious because of some base64 string manipulations.
The match is: {HEX}Malware.Expert.php.ini.ini.ini.ini.ini.ini.chmod.base64.decode.base64.decode.php

My host added the file to the whitelist so it's not disappearing any more.
HOWEVER the 500 error persists.

I again checked with my host and they have confirmed

The file is there and permissions all look normal.
I can't see a reason for the error 500 being logged in the domlogs or in the LiteSpeed global log.
Everything looks normal on this end, nothing tripping in Mod_Sec (WAF) either.

So my questions are:

• What might be causing this error, and how should I proceed to address it?
• What's a base64 line? Should it be in that file?
• Is every instance of gallery2.php identical or is it something that changes between installations?
• What does Gallery2.php actually DO?

It was suggested that (assuming the gallery lite version) I should remove line 384-ish

Code: [Select]

die(base64_decode('UG93ZXJlZCBieSBHYWxsZXJ5IEZvciBTTUYgIG1hZGUgYnkgdmJnYW1lcjQ1IGh0dHA6Ly93d3cuc21maGFja3MuY29t'));
but what does this line do? And what would be the impact of removing it?

I'm unsure whether the same applies to the Pro version so seeking guidance here before I touch anything.


I'd like to extend my appreciation to @vbgamer for his support this far.

[landyvlad]

OK so several hours later it is online again. Some icons missing etc but that can wait).

My host tells me he identified a "PHP Fatal error" and that he has managed to fix that.
I've really no idea what that means and have asked for more details and will pass those on.

For knowledge purposes etc I'd still appreciate answers to the questions in my earlier post.

[SMFHacks]

Which icons? I would reupload the gallery folder as that has all the icons and graphics files.

[landyvlad]

The icons I mean are the custom icons - don't worry about that I'll figure it out.

My host says PHP was throwing a fatal error because the virus scanner quarantined several files.
In any event that seems to be sorted now.

But when you have a chance (not urgent) if you could explain what a base 64 line is, what it does and what would be the impact of removing it?
eg

Code: [Select]

die(base64_decode('UG93ZXJlZCBieSBHYWxsZXJ5IEZvciBTTUYgIG1hZGUgYnkgdmJnYW1lcjQ1IGh0dHA6Ly93d3cuc21maGFja3MuY29t'));

Thank you.

[SMFHacks]

That line is just is an internal think I use to display the SMF Gallery Pro version

[landyvlad]

AH OK and it has to be a base64 thing I assume.

Anyway seems to be resolved mate thanks for all your help.

[SMFHacks]

Great glad you have it resolved!