By mike211175 on

Hello

For about one year I have been running a website www.legaltree.ca using drupal. I originally installed 4.7 and upgraded to 5.1, which is what I am currently running.

A very strange thing happened this morning: when I clicked the "Save blocks" button at the bottom of the "Blocks" page (administer / Site building / blocks), instead of updating the changes I had made to the blocks page (which is what normally happens) I got taken to http://disney.go.com/index , a Disney (the entertainment company) website.

I would be extremely grateful if anyone could tell me what might have caused this. Has someone hacked into my site and tampered with the scripts?

Another strange thing is that every now and then (maybe once out of every 15 attempts, it does not take me to that Disney site but just refreshes the blocks page like one would expect it to.

Here is the source code for the "Save blocks" button:

<input type="submit" name="op" id="edit-submit" value="Save blocks"  class="form-submit" />
<input type="hidden" name="form_token" id="edit-block-admin-display-form-token" value="f130c25b3f7205e84019a347727a7b8d"  />
<input type="hidden" name="form_id" id="edit-block-admin-display" value="block_admin_display"  />

Is there anything in this code that looks obviously wrong?

Any help would be much appreciated.

Regards

[Edited: Added <code> and </code> around code: nevets]

⋅ Categories: Drupal 5.x

Comments

nevets’s picture

nevets commented

The first is make sure the index.php has not been hacked.

The other is to use a tool like firebug to look for any event handlers attached to the form and/or submit button.

mike211175’s picture

mike211175 commented

As strangely as it started doing that, it seems to have stopped - weird!

Thanks for your suggestions, I will keep a record of them in case it starts up again

bonaparte’s picture

bonaparte commented

Another reason why this could happen is virus infection. When it happens again, try saving blocks from another computer and see what happens. Ignore this tip if you are running GNU/Linux.
--------------------
Sudheer. S
Binary Vibes Information Technologies Pvt. Ltd.
www.binaryvibes.co.in | www.binaryvibes.in | www.lampcomputing.com | www.sudheer.net

socrates.awmn’s picture

socrates.awmn commented

http://drupal.org/node/314723#comment-1051432