Errors in the logs...

[dr_brown]

Hi, I get these errors in the logs:

[Mon Jul 29 00:21:27.038603 2019] [:error] [pid 16335] [client 148.251.120.201:53605] exception 'CHV\\LockException' with message 'Unable to destroy delete-expired-images lock in CHV\\Lock->process()' in /var/www/dr_brown/data/www/**********/app/lib/classes/class.lock.php:109\nStack trace:\n#0 /var/www/dr_brown/data/www/**********/app/lib/classes/class.lock.php(61): CHV\\Lock->process('destroy', Array)\n#1 /var/www/dr_brown/data/www/**********/app/loader.php(409): CHV\\Lock->__call('destroy', Array)\n#2 /var/www/dr_brown/data/www/**********/app/loader.php(409): CHV\\Lock->destroy()\n#3 [internal function]: CHV\\{closure}()\n#4 {main}
[Mon Jul 29 00:21:27.039701 2019] [:error] [pid 16335] [client 148.251.120.201:53605] exception 'CHV\\LockException' with message 'Unable to destroy clean-unconfirmed-users lock in CHV\\Lock->process()' in /var/www/dr_brown/data/www/**********/app/lib/classes/class.lock.php:109\nStack trace:\n#0 /var/www/dr_brown/data/www/**********/app/lib/classes/class.lock.php(61): CHV\\Lock->process('destroy', Array)\n#1 /var/www/dr_brown/data/www/**********/app/loader.php(422): CHV\\Lock->__call('destroy', Array)\n#2 /var/www/dr_brown/data/www/**********/app/loader.php(422): CHV\\Lock->destroy()\n#3 [internal function]: CHV\\{closure}()\n#4 {main}
[Mon Jul 29 06:07:47.598842 2019] [:error] [pid 24679] [client 95.108.181.119:58227] exception 'CHV\\LockException' with message 'Unable to destroy delete-expired-images lock in CHV\\Lock->process()' in /var/www/dr_brown/data/www/**********/app/lib/classes/class.lock.php:109\nStack trace:\n#0 /var/www/dr_brown/data/www/**********/app/lib/classes/class.lock.php(61): CHV\\Lock->process('destroy', Array)\n#1 /var/www/dr_brown/data/www/**********/app/loader.php(409): CHV\\Lock->__call('destroy', Array)\n#2 /var/www/dr_brown/data/www/**********/app/loader.php(409): CHV\\Lock->destroy()\n#3 [internal function]: CHV\\{closure}()\n#4 {main}

the strangest thing is that the ip address is not on my server.
I understand that the deletion of expired images and not confirmed users is blocked.
How do you delete guest images in general? Did you find cron problems in the instructions?

 

[Rodolfo]

Hi,

Which version is this?

 

[dr_brown]

3.13.3

here today

[Tue Jul 30 06:03:01.437673 2019] [:error] [pid 32294] [client 5.9.144.234:50863] exception 'CHV\\LockException' with message 'Unable to destroy clean-unconfirmed-users lock in CHV\\Lock->process()' in /var/www/dr_brown/data/www/**********/app/lib/classes/class.lock.php:109\nStack trace:\n#0 /var/www/dr_brown/data/www/**********/app/lib/classes/class.lock.php(61): CHV\\Lock->process('destroy', Array)\n#1 /var/www/dr_brown/data/www/**********/app/loader.php(422): CHV\\Lock->__call('destroy', Array)\n#2 /var/www/dr_brown/data/www/**********/app/loader.php(422): CHV\\Lock->destroy()\n#3 [internal function]: CHV\\{closure}()\n#4 {main}

 

[Rodolfo]

The problem is your filesystem permissions. The system can create locks but it can't remove them.

Make sure that permissions are OK.

            case 'destroy':
                if(file_exists($lock_file) && !@unlink($lock_file)) {
                    throw new LockException('Unable to destroy ' . $this->lock . ' lock in ' . $method);
                }
            break;

 

[dr_brown]

Which files and folders and which permissions should be 666 or 777?

 

[bilderupload]

Chevereto requires write access in the /content, /images and app/content/languages/cachefolders.

 

[dr_brown]

777 or 666 ?

 

[Rodolfo]

777 or 666 ?

None of them. Run your webserver with appropriate user permissions.

 

[dr_brown]

Look, my server IP is 91.234. *. *, The specialization of deleting pictures and the user comes from different IPs (192.151.145.178; 192.99.13.228 etc.) that are not related to my server, naturally they have no rights to such changes and the script blocks them. Now the question. are there any Cheveretto security violations that other IPs, for example bots, can specialize deletion of pictures or users? Nginx was configured according to your requirements from the documentation.

 

[Rodolfo]

The locks are files used to avoid concurrency issues. The system is able to create these, but not delete. If the system can't delete these files is because the permissions are wrong. Simple as that.

The security issues of using chmod 777 is something that you should investigate on your own. Is not about bots deleting files, is about a path publicly writable.