Any known MODx Evo 1.05 security problems being reported?

Not to alarm anyone using MODx Evo 1.05, but I've got a reoccurring issue here as of late that keeps cropping up and I'm not sure if it's related to a security problem with MODx, jQuery or something else.

The client is running MODx Evo 1.05 on Bluehost.com hosting
-- MySQL 5.1.58
-- PHP Version 5.2.17

I had this in the <head>



Twice in the last 3 weeks the site layout is thrashed. When I open the HTML in my browser, the base href will be:



As soon as I take it out, the site is fine. Guess I'm a bit concerned. If more details are needed, please let me know.

You are getting visits from someone sending headers with bogus HTTP_HOST values most likely. The easiest way to avoid this is to have a non-cacheable snippet return the site_url config value rather than using the cacheable settings tag.

Hey Jason,

Thanks for the response. I guess my question then becomes: is this site being hacked? When you say someone is "sending headers with bogus HTTP_HOST", I guess I'm a little confused as to why it would actually effect the site.

I've implemented this on dozens of MODx Evo sites...have no idea why it's happening on just this site.

I had forgotten to mention in my original posting that the client was running MODx Evo 1.0 for about a year and 1/2 with the same code in the head as mentioned above with no problems. The day after we switched from 1.0 to 1.05 the problem first showed up.

I just spoke with a MODx core team member and apparently this is probably more of a bug than a threat. Just posted it in the bug tracker so as soon as it's resolved, I'll post back here.