WordPress.org

1. katurday
   Member
   Posted 2 years ago #

   I help run a LOLCat humor blog based on Wordpress. A very popular and well-known competing site, called ICanHasCheezburger, has inserted a bit of Javascript on his site, which attempts to do something nefarious with my wp-admin/post-new.php file. While I do not allow connections to the wp-admin folder except from my own IP address, it appears he is attempting to somehow disrupt my wordpress blog. Any ideas on what this code is doing?

   <script type=“text/javascript”>
   function showNav(el) { el.getElementsByTagName(’UL’)[0].style.left=’auto’; }
   function hideNav(el) { el.getElementsByTagName(’UL’)[0].style.left=’-999em’; }
   function pressthis(step) {if (step == 1) {if(navigator.userAgent.indexOf(’Safari’) >= 0)
   {Q=getSelection();}else {if(window.getSelection)Q=window.getSelection().toString();
   else if(document.selection)Q=document.selection.createRange().text;
   else Q=document.getSelection().toString();}}
   else {location.href=’http://www.katurday.com/wp-admin/post-new.php?text=
   ‘+encodeURIComponent(Q.toString())+’&popupurl=’+encodeURIComponent(location.href)+
   ‘&popuptitle=’+encodeURIComponent(document.title);}}</script>

   There is a post on Katurday.com with a screenshot of this code: http://www.katurday.com/?p=1301

2. mdawaffe
   Member
   Posted 2 years ago #

   ICanHasCheezBurger has inserted no malicious code toward your site.

   That is part of the WordPress.com tool bar. Since you're logged in to WordPress.com, you see that toolbar. Part of that toolbar is a "Press This" button.

   That button is a quick shortcut to writing a blog post about the current page. Click it, and you'll be taken to your blog with some fields pre-filled in.

   Go to any WordPress.com blog while logged and you will see the same JavaScript. You'll see katurday, I'll see my blog.

   If you think the Press This button should be referencing a different blog of yours, please contact the WordPress.com support http://wordpress.com/contact-support/ . This is not the proper venue.

Topic Closed

This topic has been closed to new replies.