5

I created a website for a small bed and breakfast, but I found a problem, which I don’t understand if it is depended on WordPress or the server.

This website uses a pop-up animation to show the room description. The problem is that this popup has stopped working in the last week. From browser console, I noticed that the whole thing depends on a 404 error (admin-ajax.php not found). Here it is the detail:

jquery.js?ver=1.12.4:4 POST http://lettoacastello.net/wp-admin/admin-ajax.php 404 (Not Found)
send @ jquery.js?ver=1.12.4:4
ajax @ jquery.js?ver=1.12.4:4
(anonymous) @ script.js?ver=4.9.1:207
dispatch @ jquery.js?ver=1.12.4:3
r.handle @ jquery.js?ver=1.12.4:3

To be able to solve the problem temporarily, I simply reinstall WordPress from dashboard. The problem doesn’t occur again for a whole day, all works fine! But the next day all starts over and the problem presents again (this cycle continues like this every day). For this reason I do not understand if it is a server problem or not.

A last very important thing. The popup has no problems if I am logged into WordPress admin panel (the browser recognizes “admin-ajax.php” file).

The code was not written by me (the developer says that the problem does not depend on him).

However, I believe this is the portion of code that controls room popup:

jQuery(document).ready(function($){

$('.special-room button.btn, .rooms-sec button.btn').live('click', function(e){

    e.preventDefault();

    $('#room.modal').html('');

    var thislink = this;

    var page_id = $(this).data('id');



    $.ajax({

        url: ajaxurl,

        method: 'POST',

        data: 'action=_sh_ajax_callback&subaction=sh_room_detail&post_id='+page_id,

        success: function(res){

            $('#room.modal').html(res);

        }

    });



});

Please, can I ask you for help? Unfortunately I’m not very technical.

Thank you

Meng
  • 51
  • 1
  • 1
  • 2

3 Answers3

3

I am taking this out of your comment:

Thanks @NicoHaase and @LawrenceCherone! After tinkering a bit with the admin-ajax.php file, I found the string that causes the problem. If I remove it, everything works correctly until the next day, when the string is automatically recreated.

The problem is that your website got Hacked, and script/software is injecting your website with this code.

Alex Frenkel
  • 409
  • 5
  • 15
1

If everything works when you are logged in, this is not a direct problem of your code, but a security issue: of course you are not allowed to call any stuff in /wp-admin/ (which is the folder for backend actions) if not logged in, but your code does not handle that very well.

If you need to run this without a login, some more work has to be done in PHP code. But helping out is difficult if we cannot see that code

Nico Haase
  • 11,420
  • 35
  • 43
  • 69
  • you would think, but `wp-admin/admin-ajax.php` is both for front end and backend ajax calls :/ though you're meant to do `if ( is_admin() ) {//back} else {//front}` - https://codex.wordpress.org/AJAX_in_Plugins – Lawrence Cherone Dec 09 '17 at 08:48
  • If it could be useful, I share with you my "admin-ajax.php" file. https://www.dropbox.com/s/ftez6ctvnxri84q/admin-ajax.php?dl=0 Any hint? – Meng Dec 09 '17 at 09:10
  • Thanks, @LawrenceCherone - I was not aware of that... but that page give the hint that the plugin @Meng uses should register itself for the hook `wp_ajax_nopriv_sh_ajax_callback`, and probably has only done so for `wp_ajax_sh_ajax_callback` – Nico Haase Dec 09 '17 at 12:49
  • Thanks @NicoHaase and @LawrenceCherone! After tinkering a bit with the admin-ajax.php file, I found the string that causes the problem. If I remove it, everything works correctly until the next day, when the string is automatically recreated. If you see the file that I have shared with you through Dropbox, you will see that the first string is very strange ( – Meng Dec 10 '17 at 08:26
0

Comment file: wp-admin/.htaccess --> #Order Allow,Deny AND #Deny from all Example:

<FilesMatch ".*\.(phtml|php)$">
#Order Allow,Deny
#Deny from all
</FilesMatch>
<FilesMatch "(index).php$">
#Order Allow,Deny
#Allow from all
</FilesMatch>

Greetings from Peru :D

Dharman
  • 30,962
  • 25
  • 85
  • 135
Jimmy Anthony Bazán Solis
  • 1