Thanks for getting back to me. I did as you asked and filled out a Support Request with all of the information. 

The 'title_keyword=' parameter on the affected page does not properly sanitize input before returning it back into the clients browser, resulting in a non-persistent Cross-Site Scripting attack.

Change this website such that all input is validated and escaped before rendering it in an HTML page. To prevent this attack, transform HTML metacharacters (such as "<" and ">") into entities (such as "&lt;" and "$gt;").

There is also a calendar on their website that they are saying has some issues with the year parameter.

The 'year' URL parameter on the affected page does not properly sanitize input before returning it back into the clients browser, resulting in a non-persistent Cross-Site Scripting attack.

Change this website such that all input is validated and escaped before rendering it in an HTML page. To prevent this attack, transform HTML metacharacters (such as "<" and ">") into entities (such as "&lt;" and "$gt;").

Any help and/or direction is greatly appreciated and I can provide code for anyone that would need it.

Thank you.

Not normally a problem, I duplicated the /admin/uploads/ directory and placed it in the root, /uploads/, and changed the paths in the General Settings to reflect the change. The problem is the images and files that have been uploaded through the WYSIWYG editor is still showing the /admin/uploads/ directory as it's path. Is there a way to change this dynamically or am I in for a lengthy treat of doing this manually?

Thank you for the help.

Just heard back from the client and he said the following:

I just verified permissions.  While the account didn’t have full access, it had read\write access.  It also had a deny entry for deleting files, and I removed that.  I set it to full permissions for now, but I’ll have to discuss with our internal team if it’s safe to keep it that way, I really don’t like giving a public internet facing guest account full control to folders unless it’s absolutely necessary.

I tried to upload a file and I still received the same error I posted earlier. I purchased a Rapid Response ticket this morning hoping we can get this fixed relatively soon.

Thanks,
Chris

They self-host all of their websites on this same server. I think there are about 5 or 6 other CMS installations on there running perfectly fine. I also just upgraded one about a month ago with no issues.

Thank you for the tips and letting me know about the backing up. Damon asked me to open a ticket, which I did, and he helped me out getting the database back. The issue I are still having is being able to upload anything to the server. Below is the error I am getting.

Warning: move_uploaded_file(C:/XXXX/wwwroot/XXXX/uploads//test.png): failed to open stream: Permission denied in 
C:\XXXX\wwwroot\XXXX\adminNew\lib\upload_functions.php on line 183 Warning: move_uploaded_file(): Unable to move 
'C:\WINDOWS\Temp\phpF.tmp' to 'C:/XXXX/wwwroot/XXXX/uploads//test.png' in C:\XXXX\wwwroot\XXXX\adminNew\lib\upload_functions.php 
on line 183 Error moving uploaded file! move_uploaded_file(): Unable to move 'C:\WINDOWS\Temp\phpF.tmp' to 
'C:/XXXX/wwwroot/XXXX/uploads//test.png'

It just, I just confirmed. It's saying it restored just like the uploads was doing earlier in this thread, but nothing ever went through. I will fill out the form as soon as this posts.

Thank you,
Chris

I tried what you suggested, I deleted the is file isInstalled.php and tried to reinstall. I have attached a screenshot of what happened afterwords, the server could not change the permissions of anything. So I tried a fresh install in a new directory, uploaded everything new and ran the installer and got the following:

Error renaming 'C:/XXXX/wwwroot/XXXX/adminNEW/data/settings.dat.php.default'
!Make sure this file and it's parent directory are writable!

I was hoping this was going to be the fix, simple and quick, but now I'm at more of a loss than before.

Thanks,
Chris

I am not able to see uploads on the server if the CMS tells me they were uploaded. I had him try 777, 775 as well as 755 and the same issue happened each time. I think it is a permission issue as well, but I can only go by what the client is saying. This is the 3rd or 4th CMS we've gone through with this client, and we have not had an issue until now.

The settings.dat.php I know for a fact is not 666, so I will have him try that and get back.

EDIT: My contact got back to me and asked me if there is a Windows equivalency to the numbers.

Thanks again,

Chris

Error writing C:/XXXX/wwwroot/XXXX/admin/data/settings.dat.php: 
file_put_contents(C:/XXXX/wwwroot/XXXX/admin/data/settings.dat.php.528139a65ce649.46133844-temp.php): 
failed to open stream: Permission denied (at common.php line 357 in function file_put_contents_atomic)

Our second problem is that we cannot upload anything through the CMS, we have been assured the paths are correct and the permissions are what they should be, but still nothing. When I try and upload something, it goes through the normal process and it says it saves, but does not. I've tried relocating the uploads folder outside of the admin folder and the same happens.  I am at a loss and am not sure where to go from here. Any help is greatly appreciated. 

Thank you.

When the startDateCompage is set as startDateCompare($a, $b) and not $b, $a, it would choose 3 dates and sort them. The dates made no sense as to why the where chosen. No idea why it is working now as it seems only the order of a few things were reverse, but it is.

There was also another query above this one on the same table, but it was using a different variable that was not being called on the page, once it was removed the order of the events came together.

<?php

//INSERT ALL YOUR getRecord() CALLS HERE, REPLACING MINE

list($upcoming_events, $upcoming_eventsMetaData) = getRecords(array(
'tableName' => 'events',
'limit' => '3',
'orderBy' => 'start_date ASC',
));

list($upcoming_courses, $upcoming_coursesMetaData) = getRecords(array(
'tableName' => 'course_occurrences',
'where' => "removeDate >= NOW() OR removeDate='0000-00-00 00:00:00'",
'limit' => '3',
'orderBy' => 'start_date ASC',
));


// put all the records in one list

$allRecords = array_merge(
$upcoming_courses,
$upcoming_events
);


// sort them by date 

function startDateCompare($b, $a) { return -strcmp($a['start_date'], $b['start_date']); } 
usort($allRecords, 'startDateCompare');


// discard everything after the 3rd record

$newestRecords = array_slice($allRecords, 0, 3);

?>

Any help would be greatly appreciated as I am at a loss. I have uploaded the page which will probably explain things a little better than what I did. The code in question starts on line 90.

Thank you,

Chris

Just wanted to attach that screen to show how the list was generated and the default options I was talking about.

Thank you.

I would like all of the options, 4 of them, to all be checked by default. If I just type in a record number it will select only that one, makes sense, but could not figure out how to select them all. I tried "1,2,3,4" and other combinations like that but nothing worked.

2) Upload these files: (replacing your old files)

/[cmsAdmin]/*.*