| Strange edit issue, possible malicious code? [message #165308] |
Mon, 23 May 2011 14:14  |
gotzoom?
Messages: 20
Registered: December 2006
Location: Silicon Valley, CA
Karma: 0
|
Junior Member |
|
|
I'm having an odd issue on 3.0.2.
When users link to a Google Picassaweb album, the URL displays and clicks through properly. When you quote a post, it displays there properly in the editor box, as well. However, when you edit the post, the "google" portion of the url gets replaces with "cheapairfare." When you save the edited post, the url reverts back to google again and the link operates properly. I have tested with non-google urls and I do not see this behavior.
Example:
[url=https://picasaweb.google.com/viettamluu/1999MiataForSale?authkey=Gv1sRgCL_q7eKW-amo1QE#]this link[/url]
turns into
[url=https://picasaweb.cheapairfare.com/viettamluu/1999MiataForSale?authkey=Gv1sRgCL_q7eKW-amo1QE#]that link[/url]
when the post is edited
I had an issue with spammers posting crap and using email addresses that contained "cheapairfare" so I added an email filter to ban anything from the domain they used.
This feels like a bug rather than the result of a vulnerability to me. Any thoughts on where I can go looking in the code to verify that I haven't been hacked? The server shows no signs of having been compromised.
[Updated on: Mon, 23 May 2011 14:15] Report message to a moderator |
|
|
|
|
|
|
|
|
|
|
|
| Re: Strange edit issue, possible malicious code? [message #165317 is a reply to message #165313] |
Mon, 23 May 2011 16:45  |
gotzoom?
Messages: 20
Registered: December 2006
Location: Silicon Valley, CA
Karma: 0
|
Junior Member |
|
|
I think I'm not explaining this very well, then.
Is this correct:
Replace Mask = the text to be replaced
Replace With = "Replace Mask" is removed and replaced with this
If I have that right, and it is working properly, "abunchoftext" should be replaced by "google." This is not happening. The reverse is what happens. But, it only happens in the text box when you "edit" an existing post.
When you create the post initially, you are able to have a url containing "google" and it displays properly on the post and you go to the expected url when you click the link. If you then edit that post, you see the opposite of what is expected text replacement ("google" gets replaced by "abunchoftext.") When you save that edit, the post goes back to the original url containing "google."
This does not seem to be working in an expected manner to me.
|
|
|
|
|
|
Calendar
Search
Help
Members
Register
Login
Home
]