WordPress MU

I just completed the upgrade from 2.7 to 2.8.4a

It all seemed to be going so well.

But there are certain member posts that now have picked up date from other member's posts.

Consider http://bjstone.blogpeoria.com/

It's theme is the one being used by http://peoriastation.blogpeoria.com/

Also, the blog name for http://bjstone.blogpeoria.com/the one being used by http://peoriastation.blogpeoria.com/

And the admin email is switched and when I try to click on comments to one blog, a comment from a different blog appears on my screen.

This is happening all over the site.

I downloaded the database before I did the upgrade.

How do i fix this?

Turn off javascript in your browser and go through the whole user list looking or users without a username

... OK ... and what do I do when I find them?

remove them. If you can't remove using admin go to the database and do it. If you find one then that's what's causing your problem.

Thanks! Here's a poser: How do i turn of Javascript in IE or even Firefox? ;-)

Well, I was able to disable javascript in Firefox and looked at every user. I couldn't find any that didn't have a username.

I haven't looked at the backend/data of a blog/install that had been hacked so I don't have a specific list of things I can tell you to look for.

If you use the same DB username/password combo across your installs, then they could be doing it from another install. Also, if code has been added to one or more of your plugins and/or themes, the code could be doing it.

So, check the user list in all of your installs with the js turned off. Then search all of your plugins & themes for base64_ functions. Some people also reported extra files being on their server. There's a long thread in the wordpress.org forum on it.

I don't think my site has been hacked. It was working perfectly before the upgrade.

How do I search for base-64 functions?

Is the simple solution to upload my old database?

Did you use the auto upgrader? If you did, have you trying upgrading the manual way?

"How do I search for base-64 functions?"

Download the php files and search with a text editor (notepad if you have windows). You are looking for base64.

I upgraded manually. And when I find a "base64" this means the file is corrupted and needs to be replaced?

Seriously, all it's doing is mixing up settings for certain blogs.

I replaced every file except those in themes and plugins and mu-plugins.

And before I start what could take WEEKS, Are you sure it's a hacking incident? I experienced no problems at all BEFORE the upgrade. And this is very similar to what happened the last time I tried to upgrade. I fixed that by going back to earlier, pre-upgrade installation.

OK. I deleted, then uploaded all my themes. All is well now. I'm going to sleep.

The problem went away last night. Now, it's happening again.

It just started five minuted ago. Every single blogpeoria.com blog I visit renders in my browser using the theme theme selected for http://americanguesser.blogpeoria.com. The widgets are the widgets running for that blog. The title at the top of the page is "American Guesser." The posts are correct. When I click on the title, the blog American Guesser appears.

Blogs that have displayed this behavior are http://blogpeoria.comm
http://peoriastation.blogpeoria.com
http://orangestreet.blogpeoria.com
http://witchesbrew.blogpeoria.com

And I write this, the problem has stopped. PLEASE, PLEASE, PLEASE someone tell me how to fix this. This is NOT a work or a hack. This is exactly what happened immediately after I tried to upgrade several months ago.

Well, actually, I did have a hacker problem. Someone using "admin" was creating blogs and trying to delete blogs. I deleted a bunch of users, changed my password and deleted a bunch of suspect themes.

So I am going to delete ever single theme I have and manually upload a fresh Farms 100 pack.

any advice for other themes?

I'm sorry, but this issue is not resolved.

Yes, I did have a hacker in here causing problems.

Bu8t I have since cleaned out any and all unknown users. I have changed my admin password to something new -- a completely random string of numbers and letter. I am fully upgraded.

There are no themes of files that are not fresh out of the box. All themes are recently downloaded from Farm's 100 pack of downloaded directly from WP.

THIS is the issue, and it is intermediate. And it happened immediately after the upgrade to 2.8.4a. It also happened after I first tried to upgrade to 2.78.

When I visit some sites, like http://orangestreet.blogpeoria.com is displayed using the theme and sidebar and widgets for http://americanguesser.blogpeoria.com. The title reads "American Guesser" and clicking on the title takes me to americanguesser.blogpeoria.com. That site is currently rendering how it is supposed to.

The site works well, then it doesn't.

Other than just telling me ... "sounds like you've been hacked," I need specific advice. Please help.

OH, and this is happening on multiple computers at two different locations.

Bumping this to the top:

Folks, I am still having the exact same problem.

Today, the problem happens with http://centraldesk.blogpeoria.com.

It's sidebar and theme keep getting nixed up with those of http://americanguesser.blogpeoria.com.
Central Desk loads correctly at first, but when the admin pages are accessed, it seems to show the admin panel for American Guesser. naturally, this has the blog owner quite upset.

Thought I'd bump this one up again.

Have you tried with turning off all your plugins and see if the same thing happens?

In the blog settings, does the blog title match what's in the top left corner of the admin screen?

- check your error logs
- check every other folder on the server for files that shouldn't be there
- check your passwords. If the admin password, ftp or cpanel, and database passwords are all the same, change them. they shoudl all be different.

- log in to the backend of these blogs yourself. We can't see what you see. Check the widgets page. Check each blog's info in the database, make sure the tables have the right info in them for each blog.

- and turn off plugins. Yes, it will hurt. Turn them off, then visit the problem blogs and see if it goes away.

Yes, I do see the same issue on a couple of blog. This is an unusual problem, so this is likely why nobody is answering. And really, nobody can find out WHY unless they log in and poke around.

Otherwise without any of the above information, all anyone can do is guess.

I'll follow your advice.

I can say right now that sometimes when i go to the back end of some of these malfunctioning blogs, I seem to be getting the backend of a different blog. Right now, that blog seems to be the backend for the American Guesser blog.

I'll look at the error log and change all my passwords tonight.

I deleted all the original files and uploaded ONLY original files. I'll make a note of the plugins I am running and deactivate them site wide, too.

I'll probably have to to this sometimes later this week.

Thanks for the advice.

Another thing to check under edit blog in site admin is the home option of the blogs that seem to be going to the wrong admin area.

I checked in "edit blogs" [/wpmu-blogs.php] and all these sites have the the appropriate address. For example, http://centraldesk.blogpeoria.com. lists "home" as "http://centraldesk.blogpeoria.com/".

My error log:

`[Sat Sep 12 13:55:48 2009] [error] [client 190.144.44.36] File does not exist: /home/blogpeor/public_html/admin_users.php
[Sat Sep 12 13:55:48 2009] [error] [client 190.144.44.36] File does not exist: /home/blogpeor/public_html/wp-admin/admin_users.php
[Sat Sep 12 12:59:46 2009] [error] [client 97.87.24.153] File does not exist: /home/blogpeor/public_html/wp-content/themes/citrus
[Sat Sep 12 12:09:16 2009] [error] [client 66.82.9.100] File does not exist: /home/blogpeor/public_html/wp-content/themes/default/images/submit_comment.gif, referer: http://peoriastation.blogpeoria.com/2009/04/22/keokuk-junction-rwy-gets-new-customer/
[Sat Sep 12 11:21:51 2009] [error] [client 69.134.249.111] File does not exist: /home/blogpeor/public_html/wp-content/themes/arclite/favicon.ico
[Sat Sep 12 11:21:50 2009] [error] [client 69.134.249.111] File does not exist: /home/blogpeor/public_html/wp-content/themes/arclite/favicon.ico
[Sat Sep 12 11:21:48 2009] [error] [client 69.134.249.111] File does not exist: /home/blogpeor/public_html/wp-content/themes/arclite/favicon.ico
[Sat Sep 12 11:03:44 2009] [error] [client 66.82.9.100] File does not exist: /home/blogpeor/public_html/wp-content/themes/default/images/submit_comment.gif, referer: http://bjstone.blogpeoria.com/2008/10/11/is-lee-county-fl-sheriff-mike-lee-still-on-the-job-why/
[Sat Sep 12 10:56:26 2009] [error] [client 66.82.9.100] File does not exist: /home/blogpeor/public_html/wp-content/themes/default/images/submit_comment.gif, referer: http://bjstone.blogpeoria.com/2009/03/02/update-on-whoi-news-situation/
[Sat Sep 12 10:46:21 2009] [error] [client 66.249.68.238] File does not exist: /home/blogpeor/public_html/wp-content/themes/coffee-desk/images/rss.jpg
[Sat Sep 12 10:31:52 2009] [error] [client 219.91.245.133] File does not exist: /home/blogpeor/public_html/wp-content/themes/barbie_gone_bad/tabright.gif, referer: http://askewednews.blogpeoria.com/2007/08/10/new-litter-slogan/comment-page-2/
[Sat Sep 12 10:31:42 2009] [error] [client 219.91.245.133] File does not exist: /home/blogpeor/public_html/wp-content/themes/barbie_gone_bad/tabright.gif, referer: http://askewednews.blogpeoria.com/index.php?s=slogan+of+diseases
[Sat Sep 12 10:31:03 2009] [error] [client 219.91.245.133] File does not exist: /home/blogpeor/public_html/wp-content/themes/barbie_gone_bad/tabright.gif, referer: http://askewednews.blogpeoria.com/2007/08/10/new-litter-slogan/comment-page-2/
[Sat Sep 12 10:22:06 2009] [error] [client 66.82.9.100] File does not exist: /home/blogpeor/public_html/wp-content/themes/default/images/submit_comment.gif, referer: http://peoriastation.blogpeoria.com/2009/08/29/ri-trail-no-help-to-toulon/
[Sat Sep 12 10:17:36 2009] [error] [client 66.82.9.100] File does not exist: /home/blogpeor/public_html/wp-content/themes/default/images/submit_comment.gif, referer: http://peoriastation.blogpeoria.com/2009/08/29/ri-trail-no-help-to-toulon/
[Sat Sep 12 09:57:57 2009] [error] [client 66.82.9.100] File does not exist: /home/blogpeor/public_html/wp-content/themes/default/images/submit_comment.gif, referer: http://bjstone.blogpeoria.com/2009/06/16/stay-classy-cubs-organization/
[Sat Sep 12 09:35:03 2009] [error] [client 66.82.9.100] File does not exist: /home/blogpeor/public_html/wp-content/themes/default/images/submit_comment.gif, referer: http://billscontent.blogpeoria.com/2007/02/13/for-are-friends-for-if-not-for-nipple-slips/
[Sat Sep 12 09:24:51 2009] [error] [client 81.35.92.100] File does not exist: /home/blogpeor/public_html/wp-content/default-avatar-36.png, referer: http://greatwolf.blogpeoria.com/2006/08/25/in-which-i-discuss-the-de-profundis-blog-game/
[Sat Sep 12 09:21:31 2009] [error] [client 66.82.9.100] File does not exist: /home/blogpeor/public_html/wp-content/themes/default/images/submit_comment.gif, referer: http://bjstone.blogpeoria.com/2009/08/18/sean-is-really-a-sick-twisted-f/
[Sat Sep 12 09:19:39 2009] [error] [client 98.214.65.169] File does not exist: /home/blogpeor/public_html/wp-content/default-avatar-50.png, referer: http://peoriastation.blogpeoria.com/wp-admin/
[Sat Sep 12 09:19:39 2009] [error] [client 98.214.65.169] File does not exist: /home/blogpeor/public_html/wp-content/default-avatar-50.png, referer: http://peoriastation.blogpeoria.com/wp-admin/
[Sat Sep 12 09:19:39 2009] [error] [client 98.214.65.169] File does not exist: /home/blogpeor/public_html/wp-content/default-avatar-50.png, referer: http://peoriastation.blogpeoria.com/wp-admin/
[Sat Sep 12 09:11:21 2009] [error] [client 209.85.66.83] File does not exist: /home/blogpeor/public_html/wp-signup
[Sat Sep 12 09:07:29 2009] [error] [client 98.214.193.126] File does not exist: /home/blogpeor/public_html/wp-signup
[Sat Sep 12 09:05:27 2009] [error] [client 98.214.193.126] File does not exist: /home/blogpeor/public_html/wp-signup, referer: http://peoriapundit.com/blogpeoria/1

It's interesting seeing that log - all dated September 12, 2009

Since September 12, 2009 NONE of my RSS Feeds on my wpmu installation works now, after upgrading to 2.8.4a. I have 37 sites on wpMU store/blogs and prior to Sep12th the RSS feed was being served out to my twitter account via twitterfeed. Twitterfeed claims that the RSS feed of any site - seen by their server - stops at Sep 12, 2009. When I click the RSS button and see the feed myself, I see everything up to date. Feed validator site stops at Sep 12th though.

Any ideas why my RSS feed doesn't work?

My portal site, if anybody can help is http://HARTmarket.com/shops/

HART aka PetLvr

In Billy's case, his issues went away when he deactivated BuddyPress.

Your feed issues - check the posts around that date. There could very likely be some wonky characters or code in an entry that killed the feed. especially if someone pasted from MS Word.

Also, if there's rss caching in the database for twitterfeed, clear that out too.

I am occasionally finding a blog that temporarily assumes the settings and admin page from a different blog. The problem is usually fixed by choosing a new theme the site.

Yeah, but Buddy Press will remain off. the value doesn't exceed the headaches. Your math may differ.