We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

Closed: Something modified my manager/frames/nodes.php -any ideas?

    • 28042 ☆ A M B ☆
    • 24,524 Posts
    sottwell Reply #21, 16 years, 11 months ago
    It’s not adding the hidden div, it’s removing one! That is the odd thing about it.
      Studying MODX in the desert - http://sottwell.com
      Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
      Join the Slack Community - http://modx.org
      • 3749
      • 24,544 Posts
      BobRay Reply #22, 16 years, 11 months ago
      Quote from: sottwell at Oct 09, 2009, 03:21 PM

      It’s not adding the hidden div, it’s removing one! That is the odd thing about it.
      Ah .. I read it the other way. That makes a little more sense, I guess. A utility to undo some hack might do that, though it’s still a stretch.
        Did I help you? Buy me a beer
        Get my Book: MODX:The Official Guide
        MODX info for everyone: http://bobsguides.com/modx.html
        My MODX Extras
        Bob's Guides is now hosted at A2 MODX Hosting
        • 26461
        • 2 Posts
        scuba Reply #23, 16 years, 11 months ago
        I’m on lunarpages as well.
          • 23203
          • 12 Posts
          Pharscape Reply #24, 16 years, 11 months ago
          My hosting company has not been able to find any evidence (except for my activities replacing/modifying the files) and the modification continues. The change always happens between 23:00 and 00:00 while my ftp activities are logged at 01:00+ hrs. I have given them as much info as I know.

          I completely removed and reinstalled Gallery 2.5 with reduced features and generally tightend things up - no actual evidence that that was the vector.

          I am currently trying an experiment - I’ve broken up the string in to smaller chunks that I think will be hard for any automated script to unmangle to see what (if anything) now happens.

          @scuba and asdfasdf : if you still have this issue please contact Lunarpages direct and link to this forum message - hopefully they will treat it as one common problem and not offer the standard advice to you.
            • 23203
            • 12 Posts
            Pharscape Reply #25, 16 years, 11 months ago
            Whatever it is has modified a comment line I put in as a test. But nodes.php still works due to my code obfuscation.

            My audit report now identifies where the change occurs - I am thinking this could be useful to integrate in to MODx??

            File contents changed. 1
/home/******/public_html/manager/frames/nodes.php
--- REFERENCE 
+++ /home/******/public_html/manager/frames/nodes.php 
@@ -155,7 +155,7 @@
                    	#This is my NODES.php - is the file replaced or edited in place??
 					$output .= '<span onclick="treeAction('.$id.', \''.addslashes($pagetitle).'\'); setSelected(this);" onmouseover="setHoverClass(this, 1);" onmouseout="setHoverClass(this, 0);" class="treeNode" onmousedown="itemToChange='.$id.'; selectedObjectName=\''.addslashes($pagetitle).'\'; selectedObjectDeleted='.$deleted.';" oncontextmenu="document.getElementById(\'f'.$id.'\').onclick(event);return false;" title="'.addslashes($alt).'">'.$pagetitleDisplay.$weblinkDisplay.'</span> '.$pageIdDisplay;
 					$output .='<div'.' style'.'="'.'display'.':none"></'.'div>'.'</div>';
-//$output .= '<span onclick="treeAction('.$id.', \''.addslashes($pagetitle).'\'); setSelected(this);" onmouseover="setHoverClass(this, 1);" onmouseout="setHoverClass(this, 0);" class="treeNode" onmousedown="itemToChange='.$id.'; selectedObjectName=\''.addslashes($pagetitle).'\'; selectedObjectDeleted='.$deleted.';" oncontextmenu="document.getElementById(\'f'.$id.'\').onclick(event);return false;" title="'.addslashes($alt).'">'.$pagetitleDisplay.$weblinkDisplay.'</span> '.$pageIdDisplay.'<div style="display:none"></div></div>';
+//$output .= '<span onclick="treeAction('.$id.', \''.addslashes($pagetitle).'\'); setSelected(this);" onmouseover="setHoverClass(this, 1);" onmouseout="setHoverClass(this, 0);" class="treeNode" onmousedown="itemToChange='.$id.'; selectedObjectName=\''.addslashes($pagetitle).'\'; selectedObjectDeleted='.$deleted.';" oncontextmenu="document.getElementById(\'f'.$id.'\').onclick(event);return false;" title="'.addslashes($alt).'">'.$pagetitleDisplay.$weblinkDisplay.'</span> '.$pageIdDisplay.'</div>';
                     array_push($closed2, $id);
                 }
             }


            Paul
              • 25663 MODX Staff
              • 12,272 Posts
              Ryan Thrash Reply #26, 16 years, 11 months ago
              Hi Paul that sounds like a very useful utility indeed. We’d love to know more.

              Do your logs show the access time/IP address of who is making the changes? If they’re consistent I’d alert your host to it and have them watch it like a hawk to figure out what’s going on.
                Ryan Thrash, MODX Co-Founder
                Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
                • 23203
                • 12 Posts
                Pharscape Reply #27, 16 years, 1 month ago
                Long overdue but I now have an answer - Lunarpages admins informed me that a security script they were running got a false positive on nodes.php. Not normally a problem except their script also failed to advise them of the event so no one knew it was happening. All now sorted.

                Cheers,
                Paul