Hi All,
After a recent hack to my site I have been running a cron job site audit. This morning it emailed me to say that manager/frames/nodes.php content had changed. Comparing the file on my site with the 1.0.0 release (which I had already upgraded to a few months ago) I find the only change is at the end of the following line:
Modx-1.0.0 zip line 155
$output .= '<span onclick="treeAction('.$id.', \''.addslashes($pagetitle).'\'); setSelected(this);" onmouseover="setHoverClass(this, 1);" onmouseout="setHoverClass(this, 0);" class="treeNode" onmousedown="itemToChange='.$id.'; selectedObjectName=\''.addslashes($pagetitle).'\'; selectedObjectDeleted='.$deleted.';" oncontextmenu="document.getElementById(\'f'.$id.'\').onclick(event);return false;" title="'.addslashes($alt).'">'.$pagetitleDisplay.$weblinkDisplay.'</span> '.$pageIdDisplay.'<div style="display:none"></div></div>';
My Site line 155
$output .= '<span onclick="treeAction('.$id.', \''.addslashes($pagetitle).'\'); setSelected(this);" onmouseover="setHoverClass(this, 1);" onmouseout="setHoverClass(this, 0);" class="treeNode" onmousedown="itemToChange='.$id.'; selectedObjectName=\''.addslashes($pagetitle).'\'; selectedObjectDeleted='.$deleted.';" oncontextmenu="document.getElementById(\'f'.$id.'\').onclick(event);return false;" title="'.addslashes($alt).'">'.$pagetitleDisplay.$weblinkDisplay.'</span> '.$pageIdDisplay.'</div>';
The modification to my site file breaks the file tree branch expand.
This is strange and worrying. It looks like human intervention as the file is cleanly edited. Is this a reversion to an earlier copy? I am worried if this is some proof of concept hack. Does anyone have a clue?
Many thanks for looking.
Cheers,
Paul
MODX Staff
MODX Staff