By alliax on

Hello,
since tonight I've noticed that all my content is not accessible anymore to me as the admin user or as a guest, despite the fact that I've changed nothing at all since the last time I've checked and everything was working fine (this morning)

Every content pages now show:

"
Access denied
You are not authorized to access this page.
"

And in listing as in front page and blog listing I get n/a instead of a content teaser, as in:
http://www.senserely.com/blog

My site is a community site based around AdSense, updated to the 4.7.2 version of Drupal, and could be a target for naughty hacking as a way of taking revenge because some members have to be banned from it.

I've checked in ACCESS CONTROL and nothing has change and surely the node module/access content permission is set for all users.

Do you have an idea of what went wrong and how to fix this?

Cheers,
James

⋅ Categories: Drupal 4.7.x

Comments

alliax’s picture

alliax commented

Note that I cannot access content, neither in ADMIN/CONTENT for editing individual blog post, it simply doesn't work anymore, I get the same access denied message.

myriad’s picture

myriad commented

I just have to ask... are you logging in as user 1, the super admin? because the php code ignores permissions if you are the super admin.
Do your menus work? can you get to the admin page? Have you tried using your browser history to access a node you looked at recently to see if you have access?

alliax’s picture

alliax commented

Hi, yes I'm loggued as user 1 the admin.

Now there's even worse, I don't have access to the RECENT POST, nor the statistics, it says PAGE NOT FOUND and the recent post item is not part of the menu anymore.

In the watchdog I have numerous entries, in fact several megabytes :

"
Table 'db157906129.node_revisions' doesn't exist query: SELECT n.nid, n.vid, n.type, n.status, n.created, n.changed, n.comment, n.promote, n.moderate, n.sticky, r.timestamp AS revision_timestamp, r.title, r.body, r.teaser, r.log, r.format, u.uid, u.name, u.picture, u.data FROM node n INNER JOIN users u ON u.uid = n.uid INNER JOIN node_revisions r ON r.vid = n.vid WHERE n.nid = 163 in /homepages/26/XYZ123456789/htdocs/includes/database.mysql.inc on line 120.
"
And yes, I've checked in my mysql database and there's no node_revisions table anymore!

It seems the situation is worsening as I write..

I will simply go to sleep and hoping tomorrow everything will be fine again, because I have no means to understand what is happening, so hopefully it's something to do with my hosting at 1and1.com and they will sort it out soon.

Problem is I have another drupal site on 1and1 and no problem there..

alliax’s picture

alliax commented

That part was due to my own panic, I forgot that I've made tracker and statistic modules part of the THROTTLE module, so they would be disabled when there're too many users:

"
Now there's even worse, I don't have access to the RECENT POST, nor the statistics, it says PAGE NOT FOUND and the recent post item is not part of the menu anymore.
"

So I stay with my current problem, table node_revisions doesn't exist anymore for unknown reason.

alliax’s picture

alliax commented

Still having the problem, I don't have a backup of my database in order to recreate the missing table.

How did it go in the first place? Is there a known security issue since 4.7.2 that can allow a hacker to drop a table?

myriad’s picture

myriad commented

I wish I had a solution for you! That node_rivisions table is kind of important and if you don't have a backup then there is nothing to look at on you site. All of the body and teaser content is stored in that table.

Still stretching, but are you sure your config file is setup accurately. Are you connecting to the proper database? Did you upgrade before everything went nuts?

lol, nice site-offline message

Make sure you change your passwords including your drupal account and your hosting account.

alliax’s picture

alliax commented

Yes, I'm sure about connection, I've looked at my database and the table is really missing, hosting company 1and1 is unhelpful for the moment and it's been 3 days. On monday I'll take a decision. But I'll then use DBA module in drupal to do a weekly backup sent by email on gmail account, I am as much to blame for this as the motherfucker who dropped the table.

But how he did it is what makes me wonder most.

junter’s picture

junter commented

I have a problem like that.

Some hours ago I can't access any content of my drupal site, main-page, forums, etc ... all shows the same 'access denied' page.

I did any changes to the site, onlye added some storys yesterday.

Mysql database seems to be ok.

Any ideas?

alliax’s picture

alliax commented

you says database sees to be ok, what do you mean? can you list the tables you have? at least those starting with node_ ?

junter’s picture

junter commented

I solved it ... easily ...

I went to access control (in admin mode) and reset all access to anonymous user (unmark node access for anonymous user, save changes, mark again and save again).

Now it works for me.

junter’s picture

junter commented

Here is where I found the answer, there are some other ways to do it modifying mysql database directly if you can't access as admin:

http://drupal.org/node/12757

Good luck.