OJS 3.1.2: Access to files broken

Software Support
1

I have OJS 3.1.2 running for a long time, with PHP 7.3.
In fact, I need to update it, but I am afraid.

Nevertheless, without any change in the server, all links to issues and articles are not working. I get a ‘200’ code when fecthing (example is https://linguamatica.com/index.php/linguamatica/issue/download/32/32) but I get an empty file.

I am trying to look into PHP and NGINX logs, but nothing new.
This is my log when I access that file:

linguamatica_linguamatica_nginx.1.si4eq1wcjo9l@dictionaries    | 10.0.1.15 - - [29/Aug/2024:09:49:33 +0000] "GET /index.php/linguamatica/issue/download/32/32 HTTP/1.1" 200 31 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0"
linguamatica_linguamatica_nginx.1.si4eq1wcjo9l@dictionaries    | 2024/08/29 09:49:33 [error] 30#30: *115 FastCGI sent in stderr: "PHP message: PHP Warning:  Declaration of CustomHeaderPlugin::register($category, $path) should be compatible with LazyLoadPlugin::register($category, $path, $mainContextId = NULL) in /app/root/plugins/generic/customHeader/CustomHeaderPlugin.inc.php on line 0PHP message: PHP Notice:  Only variables should be assigned by reference in /app/root/classes/issue/IssueGalleyDAO.inc.php on line 169" while reading response header from upstream, client: 10.0.1.15, server: www.linguamatica.com, request: "GET /index.php/linguamatica/issue/download/32/32 HTTP/1.1", upstream: "fastcgi://10.0.1.29:9000", host: "linguamatica.com"

While this looks problematic, I did not change anything in the last days, so not sure why things stop working.

Any help is most welcome.

EDIT:

When accessing the files through the administrative interface, I saw that the URL is quite strange: https://linguamatica.com/index.php/linguamatica/$$$call$$$/api/file/file-api/download-file?fileId=2013&revision=1&submissionId=424&stageId=3

2

Hi @ambs,

Check your files_dir in your config.inc.php to make sure it’s set correctly and that OJS can access the contents of that directory.

The URL to the editorial back-end file download looks fine to me.

I do definitely recommend upgrading to the latest LTS! OJS 3.1.2 is very significantly out of date. Upgrading will only get harder if you wait longer.

Regards,
Alec Smecher
Public Knowledge Project Team

3

Dear @asmecher,

Indeed, that was the problem.

Now trying to figure out how that was changed. It does not make sense.
Also, I do not think a hacker would enter in the system and change that, they would delete the data.Very strange indeed.

Nevertheless, it is fixed, thank you.

I will try to update to a docker environment, to make things easier (I am already running in docker, so, it seems a good idea).

Thanks!

4

I confim, somehow the site got hacked. :frowning: