I'm having a very odd problem. In my WordPress install certain posts are being automatically deleted at 5:30 p.m. I haven't discerned any pattern as to which posts are being deleted or what days this happens on, but I can't figure out why they're being deleted at all. I hooked into delete_post to see which user was doing it, but it comes back with an empty user (ID of 0).
It seems like it's some kind of wayward cron, but I don't have any running. Does anyone have any ideas?
do you have any plugins installed?
A few, but none that delete posts.
None that are supposed to delete posts ;)
Anyway go to phpmyadmin or similar and look in your wp_options table for cron see if you can work out what is being called there (or post it here).Then check those functions to make sure they aren't deleting things.
Additionally - double the check the db to make sure the pages/pots aren't there and just not showing up.
Actually just thought of a third possibility - although remote. Are all changes being lost at 5:30? if so then it may be a database backup is being installed at that time every day - might be worth speaking to your web host as well.
Yeah, I've checked the cron option, and it's empty, but I've disabled the scheduled delete function all the same. It's not that the posts just aren't showing up, they're actually being deleted; I wrote a plugin that sends notifications out when posts are edited, and I've been getting notifications of posts being deleted, which I'm taking to mean that wp_delete_post is being invoked--and they're not just in the trash, they're gone.
I host the site on a local server, where it's been for almost four years. I've never had anything like this happen. I'm starting to think I should just trash the entire install and redo it... it's due for an upgrade anyway... but something like this happening really worries me, and I'd like to know what's going on.
I'm starting to think it might be some kind of malicious code running, even though it seems like kind of a weird attack to write. Have you heard of anything like that?
No I personally haven't come across it before.
what do you mean by this:
but I've disabled the scheduled delete function all the same
If you're hosting locally, have you got anything else running that accesses the database in any way? (including scheduled backups)
I put a check in wp-cron.php for that hook so that it skips it; I assume that has the effect of disabling it.
I've got a bunch of stuff that accesses the database, but nothing that would invoke the WordPress functions for deleting posts. I mean, it's invoking the hooked actions, so the actual delete post function must be being called. That's the part that's strange. I can't figure out what would be calling it, or how.
Could you be overwriting the database daily, at a time when it is supposed to be backed up? This does not have to be from within WordPress - it could be something else running locally.
Posted 1 year ago #
Print out the filter array and see what's hooked onto the delete_post filter/action.
That should at least give you the names of the functions hooking on, you can then track them back to their originating files.
Just about to step away from the PC, but off the top of my head i think the var name is $wp_filter, which shouldn't need to be globalised unless you're printing from within a function, in which case you may need to global the var first.
Sorry for not getting back to you guys sooner. It does have to be coming from within WordPress because the 'delete_post' action is being invoked. That wouldn't happen if the database entries were being deleted outside of WP.
Thanks for the tip about $wp_filter; I'm waiting for something to get deleted again to see what's hooking into this action. I'll post what I find out.
Posted 1 year ago #
You don't need to wait for it to happen or shouldn't do, either the action has a function hooked on or it doesn't, i'd find it strange for a function to be hooked on some of the time, but not at others.
Once you know which functions hook on, it's a simple case of back tracing the function name to an originating file.
Yeah, I find this whole thing very strange. There isn't anything unusual hooked at the moment, but these deletions only happen during cron jobs, so maybe something gets hooked in at that point.
Of course, it's possible that whatever's doing the deleting isn't hooking into anything, in which case it wouldn't put anything in the filter array. For that reason, I'm also dumping a full backtrace when posts are deleted.
At any rate, when it happens again, I'll (hopefully) know exactly what happened, if not how. This has been a very, very strange problem.
This topic has been closed to new replies.
