Removing Errors from our site - /includes/templates/classic/css/none

As the title says - we've been trawling through our servers error logs and we seem to get a lot of error hits for the file [our address]/includes/templates/classic/css/none

There is no "none" file in that folder, why does this show up?

Thanks in advance for your input

I posted this first in the "other" section which was probably wrong.

As the title says - we've been trawling through our servers error logs and we seem to get a lot of error hits for the file [our address]/includes/templates/classic/css/none

There is no "none" file in that folder, why does this show up?

Thanks in advance for your input

Is the ip address your own or someone elses ? Does it have a referrer ?

There are two class files that could refere to a "non"

admin/includes/classes/phplot.php (which would be you)

includes/classes/shopping_cart.php

which has something to do with file uploads.

MattyMatt:

There are two class files that could refere to a "non"

admin/includes/classes/phplot.php (which would be you)

includes/classes/shopping_cart.php

which has something to do with file uploads.

Neither of those is relevant to stylesheets.

DrByte:

Neither of those is relevant to stylesheets.

I know, but they do reference directory structure and "none" (not non), in shopping_cart we have

$_POST[UPLOAD_PREFIX . $i]] != 'none'

and in upload.php we also have

( zen_not_null($file['tmp_name']) && ($file['tmp_name'] != 'none') && is_uploaded_file($file['tmp_name']) )

and me being the paranoid type, I've looked at the stylesheet section and there appears to be no "none" sub-directory reference anywhere, but there could be some experimentation going on with trying to set the UPLOAD_PREFIX or file['tmp_name'], I can't find any other explanation unless someone has built a theme that references "none" in the classic template which sounds more far fetched.

Are you hosted on a Windows Server? I think that is the Windows way of reporting an error; i.e. none - instead of file not found.

MattyMatt:

I know, ...

... sounds more far fetched.
Quite far fetched.

And, if you know that your answer is irrelevant, don't post it.
There's no point sending the person on a wild goose chase looking in a completely irrelevant place.

DrByte:

Quite far fetched.

And, if you know that your answer is irrelevant, don't post it.
There's no point sending the person on a wild goose chase looking in a completely irrelevant place.

No I meant looking for a css explanation is irrelevant. e.g. looking for a theme built into "classic" rather than an override, that looks for none.

Thanks for your replies, great to hear your input and ideas.

We're on a linux server so that would rule out the windows server replying "none" for "file not found"

IP addresses are totally random and not our own, so thats another thing ruled out.

Here's an example of a line from the error log file, with the addresses taken out for privacy.

[Wed Jan 27 08:10:50 2010] [error] [client 00.00.00.00] File does not exist: /hsphere/local/home/username/domainname.co.uk/includes/templates/classic/css/none

Over 200 of our error entries show up this error every day.

Has anyone experienced this before?

Thanks for your help. :bigups:

epsonprintersrock:

[client 00.00.00.00]
That's especially odd ...

This article on django seems to give a clue

forum.dreamhosters.com/troubleshooting/112491-dispatch.fcgi-not-found.htm

00.00.00.00 could be the internal rewrite ip address in which case then something is rewriting in a .htaccess to "none" which people frequently think apache can understand like

allow from none

where none is incorrect as apache then does a hostname lookup and gets nothing back.

That's a relevant guess btw.

But it wouldn't rewrite a stylesheet filename to 'none' as a result of an "allow from none" directive, esp if "none" is treated as a hostname.

no that was an example of the misuse of none, there are quite a few posts about non-existent files and using mod_rewrite that result in the 00.00.00.00 ip address (good spotting that) "none" could be a mistake in the .htaccess or an unfilled internal variable in mod_rewrite resulting in the the request. Not reall possible to tell without more infomation on the site.

Is it possible that:

includes/templates/classic/css/none

has been "hard-coded" into a custom php file somewhere?

What is returned if you search for that path in

admin >>> tools >>> developer toolkit

I'll check out that article and the hard coding to see what the problem might be.

I rewrote the ip addresses to protect their privacy. They're all different ip addresses, none of them are 00.00.00000 - thats the way I rewrote them.

could it be a difference between the index.php files and the index.html files? That some browsers are automatically looking for a file or a format of a file thats not in that directory so the result comes up as /none ??? random guess!!! :dontgetit

Thanks for your suggestions, I'll let you know how it goes!! :huh:

Thanks for that article MattyMatt, but I don't think there were any clues contained within. But its always good to check out problems! :blink:

Thanks schoolboy for that search idea, I searched in the 'look-up in all files' section but this was my result...

Warning Error: No matching Configuration Keys were found ... /includes/templates/classic/css/none

:shocking:

So no clues there. I think I'll dig up the php file now and see what it says....

Does it have a referer in the error logs ? I fully admit to running after wild geese on this one. If you have the ip address that isn't 00.00.00.00 the you can track that to the time through the access logs and get the refering page.

I think there is something going on behind the scenes, as they say. The number of times the error occurs leads me to believe this is a script output error rather than a error result for a URL.

Have you searched your 'images' dir. for any '.php' files or non-images files that shouldn't be there?

I just counted the errors for yesterday in the error log files, there are about 350 errors all for that file destination. Thats a lot for one day. Sometimes the same ip address requests it 4 times, but then gives up.

thanks for the suggestion website rob, I looked through and there's no php in the images folder. I can't see anything that shouldn't be there.

I've never seen that many 404 errors come up when I browse our website, its quite rare. The thing that confuses me most is that all the errors are for a file thats not there :(

File does not exist: /hsphere/local/home/ourname/ourname.co.uk/includes/templates/classic/css/none

its wierd, it makes me feel like this guy :lamo:

So have you tracked the ipaddress through the normal log and worked out what the computer has been looking at ? If you follow it and look at the source yourself, you should then be able to track your own progress. If you use firebug in firefox, then there is a feature where it shows the requests each page makes, (install the add on, click the little bug, click Net, click "all" on the far left and then reload the page and it will show which request is made and whether the server found it), if you can't find any page referring to none and giving a 404 when you surf the exact same path as the ipaddress, then it's likely to be a probe by a hostile botnet looking for information on your server by bringing up a 404 not found page, that would list OS version, webserver version etc... So you have two candidates, either something in the templating system is wrong and "normal" users are bringing up a 404, or you are being probed, in which case then you can't really deny ip addresses as a botnet will have many varying computers and you would be unlucky to be on their list (there was a peak in botnet actvity last night at 5 am UK time). What you could do is add create a .htaccess file in that folder

ErrorDocument 404 "<html />

the last quote is missed out if you use apache 1.3 and works on 2.0+) that way you are still getting error messages but sending out minimal information and using less server resources just to a botnet (if it is one) it won't stop them but then nothing realistic will and at least you save the bandwidth. Setting up a 403 error message will just still provide the bot net with information, and redireting to your page_not_found would be a bad idea since then for each request you'd end up with 300 database queries multiplied by 350 requests !