ATTENTION there is a TROJAN.
This file has been modified: /classes/index.php
Replace it with any other index.php from another folder.
The content MUST BE the following:
<?php
/**
* Copyright ETS Software Technology Co., Ltd
*
* NOTICE OF LICENSE
*
* This file is not open source! Each license that you purchased is only available for 1 website only.
* If you want to use this file on more websites (or projects), you need to purchase additional licenses.
* You are not allowed to redistribute, resell, lease, license, sub-license or offer our resources to any third party.
*
* DISCLAIMER
*
* Do not edit or add to this file if you wish to upgrade PrestaShop to newer
* versions in the future.
*
* @author ETS Software Technology Co., Ltd
* @copyright ETS Software Technology Co., Ltd
* @license Valid for 1 website (or project) for each purchase of license
*/
if (!defined('_PS_VERSION_')) { exit; }
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
header("Location: ../");
exit;
Post automatically merged:
Following my previous comment, to clean the module you need to remove the following injections.
Open the file ets_payment_with_fee.php
remove this row 85
View attachment 125170
Then remove the whole function Installation() from row 1271
View attachment 125171
I find this Trojan in 2 modules posted by the user Spasoo. If you download more, search for this. There is an injection in the main file, in the root directory, calling a Installation() function, this is pointing to the file classes/index.php that has been modified.
For sure you are doing some mistakes manipulating the code. Do you know PHP?thanks for sharing, great module!!!!!
Post automatically merged:
By making this modification, the module cannot be installed afterwards! shows error.
Gracias por compartir este modulo, vamos a probar que tal funciona
Set extra fees (surcharge) for any PrestaShop payment module and card payment such as cash on delivery (COD), bank wire, PayPal, Stripe, Google Pay, etc., and create an unlimited number of custom payment methods with/without payment fees easily.
Demo : Link
It sends the data to an email during installation.Hi Eleos, Many thanks for pointing that out! Will check what the index.php is doing ..
Post automatically merged:
Looks like the trojan is creating a user, collects some data and downloads them. Then delete the activities. Do not USE!
big thx you for info! i too always check modules from publicATTENTION there is a TROJAN.
This file has been modified: /classes/index.php
Replace it with any other index.php from another folder.
The content MUST BE the following:
<?php
/**
* Copyright ETS Software Technology Co., Ltd
*
* NOTICE OF LICENSE
*
* This file is not open source! Each license that you purchased is only available for 1 website only.
* If you want to use this file on more websites (or projects), you need to purchase additional licenses.
* You are not allowed to redistribute, resell, lease, license, sub-license or offer our resources to any third party.
*
* DISCLAIMER
*
* Do not edit or add to this file if you wish to upgrade PrestaShop to newer
* versions in the future.
*
* @author ETS Software Technology Co., Ltd
* @copyright ETS Software Technology Co., Ltd
* @license Valid for 1 website (or project) for each purchase of license
*/
if (!defined('_PS_VERSION_')) { exit; }
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");
header("Cache-Control: no-store, no-cache, must-revalidate");
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
header("Location: ../");
exit;
Post automatically merged:
Following my previous comment, to clean the module you need to remove the following injections.
Open the file ets_payment_with_fee.php
remove this row 85
View attachment 125170
Then remove the whole function Installation() from row 1271
View attachment 125171
I find this Trojan in 2 modules posted by the user Spasoo. If you download more, search for this. There is an injection in the main file, in the root directory, calling a Installation() function, this is pointing to the file classes/index.php that has been modified.