Hello webmasterworld!
Please bear with me if in the process of exposing my ignorance here i happen to connect issues that should be raised in multiple threads (or if i otherwise out-newb other newbs in my newbie-ness) - and accept my sincere thanks & appreciation in advance for any tolerance of mind you'll give me.
Would anyone kind enough to help (and capable of doing so) please review the .htaccess contents below and advise on whether something therein would either:
A. cause PHP processes to drive MySQL queries without end or produce some sort of loop that could explain repeated CPU overloads and other performance issues
and/or
B. restrict access to an add-on domain which appears in cpanel as a subdomain under the root -- (restrict access = trigger cpanel error when trying to upload files and "server not found" msg. when URL is entered in a browser)...
I've tried to research the matter online for over a month (& related opensource matters for over a year) - sifting through seemingly endless forum threads, technical apache/PHP manuals/documentation, online tutorials, etc. but with limited success.
Alas, now having thoroughly re-confirmed that i am not qualified to be a webmaster (yet) - i am crash-landing in webmasterworld to seek guidance from those who apparently are...so ANY help with this topic (and those likely to follow) would be appreciated loads!
If it makes any difference, it's a Joomla site (still 1.5.25) on a VPS running apache 2.2.21, PHP 5.3.8 & MySQL 5.1.56-log...
Apparently, the site was hacked a while ago and then "restored," but it seems that either the hacker left a back door or the added security measures were insufficient because i found an "allow from ip ..." included on the line before the last </limit> tag at the top of the code below, which matched that of a dictionary attacker active around when the site was hacked...so at this point, ANY input you have regarding the below would be super helpful - thank you!
Begin .htaccess excerpts:
IndexIgnore .htaccess */.?* *~ *# */HEADER* */README* */_vti*
#<Limit GET POST>
#order deny,allow
#deny from all
#allow from all
#</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
Allow from 123.18.235.243
</Limit>
AuthName example.org
RewriteEngine On
RewriteCond %{HTTP_HOST} ^.*$
RewriteRule ^cityname1$ "http\:\/\/example\.org\/all\-locations\/ab\-cde\-fgh\-ijk\-lmnopqrs\-tu" [R=301,L]
RewriteCond %{HTTP_HOST} ^.*$
RewriteRule ^cityname2$ "http\:\/\/example\.org\/all\-locations\/zy\-nameofplace\-cityname2\-state" [R=301,L]
RewriteCond %{HTTP_HOST} ^.*$
RewriteRule ^cityname3$ "http\:\/\/example\.org\/all\-locations\/nameofplace\-cityname3" [R=301,L]
RewriteCond %{HTTP_HOST} ^.*$
RewriteRule ^cityname4$ "http\:\/\/example\.org\/all\-locations\/ab\-cdefg\-h\-ijk\-lmnop" [R=301,L]
RewriteCond %{HTTP_HOST} ^.*$
RewriteCond %{HTTP_HOST} ^example.org$ [OR]
RewriteRule ^Seminar2011$ "http\:\/\/oldeventname\.com " [R=301,L]
RewriteRule ^seminar2011$ "http\:\/\/oldeventname\.com " [R=301,L]
Options +FollowSymLinks
RewriteEngine On
# Block out any script trying to set a mosConfig value through the URL
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
# Block out any script trying to base64_encode crap to send via URL
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
# Block out any script that includes a <script> tag in URL
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
# Block out any script trying to set a PHP GLOBALS variable via URL
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
# Block out any script trying to modify a _REQUEST variable via URL
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
# Send all blocked request to homepage with 403 Forbidden error!
RewriteRule ^(.*)$ index.php [F,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/index.php
RewriteCond %{REQUEST_URI} (/|\.php|\.html|\.htm|\.feed|\.pdf|\.raw|/[^.]*)$ [NC]
RewriteRule (.*) index.php
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
RewriteCond %{HTTP_HOST} ^.*$
RewriteRule ^seminar2011$ "http\:\/\/example\.org\/component\/content\/article\/33\/123\-event\-2011" [R=301,L]
RewriteCond %{HTTP_HOST} ^example\.org$ [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.org$
RewriteRule ^(.*)$ "http\:\/\/example\.org\/$1" [R=301,L]
----------
End of .htaccess
----------
Note that i've used alphabet letters in the cityname rewrite rules instead of the SEF url that contained a proper name...sorry if that's confusing!
If you've made it this far down my post - thank you SOOO much for your time and attention!
Note: I can't say i'll help answer other people's posts here - but i can assure you i'll copy & paste old-thread solutions into the threads of new people who didn't read them as often as i can:) Either way, please help! :)
