Wild Ideas Weblog

Forums are down again. I put them back up yesterday after upgrading to the newest version of phpBB, which is supposed to contain all kinds of security upgrade. And just now, I checked my e-mail and discovered that someone was sending out spam under the guise of an admin message from the forums. I checked the headers to see if it had actually come from the board, and it looked like it did — and from under my username at that.

I checked the board itself, and someone had completely deleted the Calyx and Commons forums, lumped all the others into the Et Cetera category, and created four new forums of their own.

So, admin password is changed (again), and the board is disabled until I can do some more investigating.

I am also seriously considering just switching to a different forum program entirely… I am getting really sick of dealing with non-stop security headaches with phpBB.

I restored the forum database from one of the numerous backups my host keeps (another reason to love them — it turns out they keep multiple backups going back as far as 10 months, and you can actually restore them yourself from the web panel!), and all appears well now.

However, I’m keeping the forums disabled for the next few days just because I still need to install the phpBB security upgrade, and I know that’s going to take a little while, and I don’t want an instant replay in the meantime.

Hopefully I’ll have the forums upgraded and back up by Monday.

Some kind and thoughtful individual hacked the forums, so they are temporarily disabled while I see if my host has a recent backup of the database they run on, or if I have to go through it with fine-toothed comb and repair all the damage from scratch.

Note to self: Next time phpBB puts out a security upgrade, install the damn thing right away. Even though phpBB’s lack of a module/plug-in system like WordPress and, well, nearly everything else has means that every feature you want to add has to be done by modifying the actual code, thus making upgrades a tremendous pain in the ass.

Note to self the second: There is a command called “Backup Database” in the admin. Use it once in a while, damn it.

Note to self the third: Maybe I should find a different forum script, which has a better way of allowing modifications than requiring endless PHP code editing…. Oh well. Trying to convert the entire site over to Drupal anyway, so I guess that will take care of itself.