What is interext Plugin that is Breaking Upgrade to v3.6?

Discussion regarding Joomla! 3.x security issues.

Moderators: mandville, General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
Windows Defender SmartScreen Issues <-- please read this if using Windows 10.
Locked
bigint
Joomla! Apprentice
Joomla! Apprentice
Posts: 5
Joined: Sun May 20, 2018 3:53 pm

What is interext Plugin that is Breaking Upgrade to v3.6?

Post by bigint » Sat Aug 04, 2018 8:33 am

Hi,

I'm trying to upgrade Joomla using the 3.6.5 upgrade package, but I am getting a 500 error with the below messages. What is interext please and any idea how to overcome this problem?

Thanks.

Strict Standards: Only variables should be assigned by reference in /public_html/plugins/system/interext/interext.php on line 118
Last edited by toivo on Sun Aug 05, 2018 5:00 pm, edited 1 time in total.
Reason: mod note: moved to 3.x Security

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44022
Joined: Sat Apr 05, 2008 9:58 pm

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by Webdongle » Sat Aug 04, 2018 8:59 am

http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".

User avatar
leolam
Joomla! Master
Joomla! Master
Posts: 20652
Joined: Mon Aug 29, 2005 10:17 am
Location: Netherlands/ Germany/ S'pore/Bogor/ North America
Contact:

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by leolam » Sat Aug 04, 2018 3:46 pm

Such plugin does not exist in the Joomla core. (never heard of it either) Also I can see your site is already on Joomla 3.6.5. You should always make sure that your site is up-to-date and we have just released Joomla 3.8.11 so update as the devil since all versions below Joomla 3.8.10 are vulnerable (3.8.11 is a bug fix release) and you can be hacked any moment.

Leo 8)
Joomla's #1 Professional Services Provider:
#Joomla Professional Support: https://gws-desk.com -
#Joomla Specialized Hosting Solutions: https://gws-host.com -

bigint
Joomla! Apprentice
Joomla! Apprentice
Posts: 5
Joined: Sun May 20, 2018 3:53 pm

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by bigint » Sun Aug 05, 2018 3:14 pm

Thank you, for replying.

The site has already been hacked. I only showed part of the 'Strict Standards: Only variables ....' error message and not the full list of messages because there was code hidden in the error messages which said, [DO NOT BUY OUR KITCHEN] - You guessed it's a kitchen website. This malicious message only showed when I previewed the post in the Joomla forum editor, it's not visible in the raw text.

So, I restored the site to a backup taken before being hacked. Now, I'm currently trying to bring this site and another site up to date for a friend. Using the 3.6.5 update package to move from version 2.5 is a step advised on this forum, before moving to 3.8 - that's why we are at 3.6.5 at the moment.

Regarding the interext plugin, inside the interext folder is formfields, jquery and mootools - through research I think it might be a forms plugins.

Updating Joomla from 2.5 to 3.8 is causing me huge pain - these are not even my sites, I'm helping a friend. It's one compatibility problem after another due to out of date extensions and templates. It could have been easier if my friend kept everything up to date.

Thanks again, for your comments.

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44022
Joined: Sat Apr 05, 2008 9:58 pm

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by Webdongle » Sun Aug 05, 2018 4:28 pm

A few points

[DO NOT BUY OUR KITCHEN] is not a hack

Restoring from backup can restore a hack because the hack could have been there sometime.

No need to replace the database ... only the files.

See viewtopic.php?f=714&t=946026
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".

User avatar
JAVesey
Joomla! Hero
Joomla! Hero
Posts: 2621
Joined: Tue May 14, 2013 1:21 pm
Location: Cardiff, Wales, UK
Contact:

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by JAVesey » Sun Aug 05, 2018 5:07 pm

bigint wrote:
Sat Aug 04, 2018 8:33 am
Strict Standards: Only variables should be assigned by reference in /public_html/plugins/system/interext/interext.php on line 118
Incompatible PHP/extension combination?

Also, you need to make sure that all your extensions (components, modules, plugins) have been updated before you update your Joomla core.

As others have said; post your FPA results on here so that you can receive informed advice.
John V
Cardiff, Wales, UK
Joomla 5.0.3 "live" site on PHP 8.2.15 and MariaDB 10.11.7
Joomla 5.0.3 on XAMMP for OSX with PHP 8.2.4 and MariaDB 10.4.28

User avatar
leolam
Joomla! Master
Joomla! Master
Posts: 20652
Joined: Mon Aug 29, 2005 10:17 am
Location: Netherlands/ Germany/ S'pore/Bogor/ North America
Contact:

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by leolam » Tue Aug 07, 2018 6:11 am

This issue can simply be resolved me think after doing some more investigations. This plugin is not compatible with current Joomla/PHP. So simply uninstall the plugin in the extension -->manage overview (search for 'interext' )and after uninstall you should be able to update Joomla

Leo 8)
Joomla's #1 Professional Services Provider:
#Joomla Professional Support: https://gws-desk.com -
#Joomla Specialized Hosting Solutions: https://gws-host.com -

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44022
Joined: Sat Apr 05, 2008 9:58 pm

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by Webdongle » Tue Aug 07, 2018 9:40 am

leolam wrote:
Tue Aug 07, 2018 6:11 am
...and after uninstall you should be able to ...
Unless there are other old incompatible extensions ?
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".

User avatar
fcoulter
Joomla! Ace
Joomla! Ace
Posts: 1685
Joined: Thu Sep 13, 2007 11:39 am
Location: UK
Contact:

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by fcoulter » Tue Aug 07, 2018 10:18 am

Strict Standards: Only variables should be assigned by reference in /public_html/plugins/system/interext/interext.php on line 118
This is not actually a fatal error, just a warning notice, so this is not would be causing the update to fail (although something else in the plugin could be). You need to look for an error message that says 'fatal error' to find what the cause is.

I would remove any old 3rd party plugins to be on the safe side, you can re-install updated versions later.
http://www.spiralscripts.co.uk for Joomla! extensions
http://www.fionacoulter.com/blog my personal website
Security Forum moderator :: VEL team member
"Wearing my tin foil hat with pride"

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44022
Joined: Sat Apr 05, 2008 9:58 pm

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by Webdongle » Tue Aug 07, 2018 11:33 am

fcoulter wrote:
Tue Aug 07, 2018 10:18 am
Strict Standards: Only variables should be assigned by reference in /public_html/plugins/system/interext/interext.php on line 118
...
I would remove any old 3rd party plugins to be on the safe side, you can re-install updated versions later.
Then delete all the folders from the files.
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44022
Joined: Sat Apr 05, 2008 9:58 pm

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by Webdongle » Wed Aug 08, 2018 12:54 am

Then delete all the folders from the files.
should read
Then delete all the folders/files from the server.
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".

User avatar
fcoulter
Joomla! Ace
Joomla! Ace
Posts: 1685
Joined: Thu Sep 13, 2007 11:39 am
Location: UK
Contact:

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by fcoulter » Wed Aug 08, 2018 11:09 am

A few points to clarify:

1. firstly based on what you have said so far there is no evidence that your site has been hacked. The message [DO NOT BUY OUR KITCHEN] is something output by the Joomla Forum Post assistant, I have forgotten the reasons why (no doubt someone else can explain), but it does not indicate anything sinister. It is not something that a visitor to your site would ever see. It is just co-incidence that your site sells kitchens.

2. It is possible that your site has been hacked though, with an old site where updates have been neglected, this is always possible. If you suspect that is in fact the case then the procedure for restoring a hacked site is in the sticky topic at the top of this forum. And if you want to be cautious then it may be wise to assume that this is the case and proceed accordingly.

3. Google has never heard of the interext plugin, nor has the Joomla extensions directory. I think it is likely that this a custom plugin written by or for the original developer of your site. In this case, if it does something that you need, then your only option is either to find a replacement that does something similar, or find a developer who can update the plugin so that it is compatible with the current release of Joomla. Whether you want its functions, your only option is to uninstall it at the moment.

4. Since it is clear that you have already run the FPA, if you require further help it would make sense to post the results.
http://www.spiralscripts.co.uk for Joomla! extensions
http://www.fionacoulter.com/blog my personal website
Security Forum moderator :: VEL team member
"Wearing my tin foil hat with pride"

sozzled
I've been banned!
Posts: 13639
Joined: Sun Jul 05, 2009 3:30 am
Location: Canberra, Australia

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by sozzled » Wed Aug 08, 2018 5:06 pm

Actually, kitchensink is not something output by the FPA; it is an automatic forum response—a "bad word" filter—whenever the text "k*itchensink" appears on the forum. The problem occurs with the FPA when the extension, installed as part of JCE, named WF_K*TCHENSINK_TITLE is displayed on the forum; see example of this at viewtopic.php?f=804&t=962167&p=3535089. I can assure everyone this FPA report was generated on an operational website that was definitely not hacked.

I remember reporting this problem in the "feedback" category and, for a time, the "offending text" was removed from the bad word filter. For some bizarre reason (only known to the person who maintains the bad word filter) the "offensive" text was added back into the bad word list.

In attempting to justify having "k*tchensink" as a bad word, when we discussed the matter publicly some two or three months ago—the discussion has been removed from the forum—it was argued that kitch*nsink was placed on the bad word list because of a "spate of k*tchensink supplier spam" that had plagued the forum [several years ago]. I don't believe that's justification for having k*tchensink as a bad word; that's just justification for being too darned lazy to differentiate between what's legitimate text and obvious spam.

It's unfortunate that the extension named WF_K*TCHENSINK_TITLE happens to include a "bad word" w.r.t. this forum. That's just unfortunate coincidence. The problem, however, that this causes in providing technical help to members of this community is whenever people see kitchensink—rendered in the way that it has been rendered by the bad word filter—this confuses novice and experienced users alike.

In the interests of clearing up this confusion, let's start by saying that having "k*tchensink" as a bad word is a bad thing. It's only a bad word because someone thinks that it's too onerous a task on the forum moderator team to waste their time chasing after spam. Well, that's not a good excuse. As a responsible member of this community, I report spam when I see it and, generally, the forum moderators take care of the problem. If someone higher up in the food chain thinks that the forum moderators are incapable of dealing with spam then I think they should acknowledge this to the moderator team (or get extra forum moderation help). The current situation is unacceptable, in my opinion.

User avatar
fcoulter
Joomla! Ace
Joomla! Ace
Posts: 1685
Joined: Thu Sep 13, 2007 11:39 am
Location: UK
Contact:

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by fcoulter » Wed Aug 08, 2018 5:21 pm

Sozzled, thanks for the explanation. I totally agree, the current situation is just plain silly.
http://www.spiralscripts.co.uk for Joomla! extensions
http://www.fionacoulter.com/blog my personal website
Security Forum moderator :: VEL team member
"Wearing my tin foil hat with pride"

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44022
Joined: Sat Apr 05, 2008 9:58 pm

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by Webdongle » Wed Aug 08, 2018 6:17 pm

+1 Sozzled
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".

sozzled
I've been banned!
Posts: 13639
Joined: Sun Jul 05, 2009 3:30 am
Location: Canberra, Australia

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by sozzled » Wed Aug 08, 2018 6:38 pm

Thanks, guys. The k*tchensink issue is off-topic to OP's question. Although kitch*nsink is something that needs to be addressed (and it's for the moderation team to thrash it out) and I could go on ad nauseam trying to figure out how many different ways to cram k*tchens*nk into a post without being reported for attempting to hijack the topic, there are two important points to make.

Point 1: I don't know what the "interext" plugin is or how it came to be installed in the OP's website. I don't know how k*tche**inks came to be discovered in the FPA report (because there is no FPA report that I can see for the OP's website). I don't know how we've concluded or failed to conclude if the OP's website has been hacked. The only thing we know is that something on the OP's website causes the PHP interpreter used by the website to object and issue a "strict standards" warning.

Point 2: The only real expert in the room is the OP (because only the OP knows what is installed and what is not installed on their website); the rest of us are playing catch-up (and playing this game inefficiently because we're working in an information vacuum). It it was my website and I saw the message

Code: Select all

Strict Standards: Only variables should be assigned by reference in /public_html/plugins/system/interext/interext.php
I would be examining every third-party extension I'd installed and I would uninistall every extension, one by one, until I'd removed the source of the problem.

The fact that the affected website uses J! 3.6.5 suggests that the "expert" has not been paying attention. J! 3.6.5 was released nearly two years ago—13 December 2016—and there have been two dozen releases of Joomla in that time. Allowing a website to continue to use outdated (and vulnerable) software is an invitation to problems (like this one) surfacing and then causing people to rush into a blind panic to try to patch things up.

If someone has a problem with an extension that's causing HTTP 500 External Server Errors then fix it! If it's a third-party/non-core extension, then delete it. It's [almost] that simple. And, if you can't fix it yourself, and something is important to someone's business, then (a) engage a professional consultant to deal with the problem, even if it costs a few hundred dollars, or (b) start again and do things right. 8)

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44022
Joined: Sat Apr 05, 2008 9:58 pm

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by Webdongle » Wed Aug 08, 2018 8:07 pm

sozzled wrote:
Wed Aug 08, 2018 6:38 pm
... I don't know how we've concluded or failed to conclude if the OP's website has been hacked. ...
bigint wrote:
Sun Aug 05, 2018 3:14 pm
...
The site has already been hacked. ...
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".

sozzled
I've been banned!
Posts: 13639
Joined: Sun Jul 05, 2009 3:30 am
Location: Canberra, Australia

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by sozzled » Wed Aug 08, 2018 8:20 pm

@Webdongle: supposition (probably valid but who knows?)

bigint wrote:
Sun Aug 05, 2018 3:14 pm
Updating Joomla from 2.5 to 3.8 is causing me huge pain - these are not even my sites, I'm helping a friend. It's one compatibility problem after another due to out of date extensions and templates. It could have been easier if my friend kept everything up to date.
@bigint: My earlier observations—aside from "let's suppose the site has been hacked" notwithstanding—remain. Your friend's site contains an extension that no-one's heard about; fair enough ... fix it/get rid of it and move on with the J! 2.5 -> J 3.8 migration.

I've migrated several J! 1.5/2.5 website to J! 3.x. It usually takes a couple of hours to build the basics. As for "out-of-date extensions and templates", who cares? Ask your friend "What's important? Is it important that we spend a week or two trying to patch up site clutter or do you want a trouble-free site?" That's really the only choice that a site owner needs to make.

Sometimes you have to be hard-headed about these things, especially when someone leans on someone else (takes advantage of their generosity, I mean) and drags them down. I've just been through that ordeal where I spent four months providing help-for-a-friemd and it cost me in terms of lost hours, fruitless email exchanges and zero dollars. Ultimately we parted ways and I can breathe easily again.

UPDATE: Minor edit to clarify that I was replying to two different people on two different, but interrelated, matters.
Last edited by sozzled on Wed Aug 08, 2018 9:41 pm, edited 1 time in total.

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44022
Joined: Sat Apr 05, 2008 9:58 pm

Re: What is interext Plugin that is Breaking Upgrade to v3.6?

Post by Webdongle » Wed Aug 08, 2018 9:36 pm

He's not my friend. But yes uninstall that (and any other incompatible extensions) ... then delete all the files.

And my previous comments still stand.
Webdongle wrote:
Sun Aug 05, 2018 4:28 pm
...
No need to replace the database ... only the files.

See viewtopic.php?f=714&t=946026
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".


Locked

Return to “Security in Joomla! 3.x”