Website hacked? :(

[REDDemon]

Website got hacked again I think. I have a strange layout now

[CuteAlien]

Hm, not seeing anything. Maybe SF server was overloaded - when that happens it messes things up sometimes (not loading certain files etc). But corrects itself usually again after a while.

[Brainsaw]

I got a "database connection error" this morning and was afraid the site got hacked again. But half an hour later all seemed fine so I guess it was some sourceforge problem

[REDDemon]

Yeah it seems gone. I was displaying only half webpage.

[Cube_]

generally any database errors is a server problem, showing half the web page is a resource problem (typically either on your end or on server end) such as the css failing to load or send.

[MartinVee]

Hum... With the developer tool in Chrome, I can see that the shadow-root has a CSS that contains links to websites I did not expect to see on the Irrlicht website.

I'm not entirely sure what loaded this content, but there's a suspicious-looking script at the bottom of the DOM (you can see it here) that seems to be loading an iframe.

[Cube_]

I can't find the shadow-root css linked anywhere in the document and a quick ctrl+f in the chrome developer view didn't find it either, but it's possible ublock or one of my user scripts stripped it if it's part of an ad or other known intrusive element.
It's also possible that it's only included in some pages, I only checked this topic page and the root page at irrlicht.sourceforge.net


As for the include script, that's part of wordpress oembed module for embedding content iirc - you can do a cursory google search on part of it and you'll find plenty of results, you can find very similar scripts on a lot of other pages like this government page (Seems to be the unminimzed version of the script at cursory glance):
https://gapanalysis.usgs.gov/padus/wp-j ... 2Fpadus%2F

[MartinVee]

Here's the screenshot of the DOM Explorer in Chrome that shows the shadow-root for the main page at [url]http://irrlicht.sourceforge.net/[url].

[CuteAlien]

Uhu - that doesn't look good :-(

But that other file doesn't seem to be the problem, that's an original file from wordpress: https://core.svn.wordpress.org/branches ... bed.min.js

Now... I have to learn about what a Shadow-DOM is (I'm not a web developer...)

[CuteAlien]

Hm, not seeing anything so far (no shadow-dom at all). There's 2 more options. One is - you are not seeing the current homepage but still our hacked version. Is the newest post you see already about "Schwarzerblitz" or do you have some older news? And second option - it might be your system that's compromised. Did you check if other websites are fine?

[MartinVee]

Argh, you're right! That comes from Adguard AdBlocker! I'm so sorry!

In and of itself, the shadow DOM isn't a problem. It's a way of having two separate DOM trees in the browser. This enables you, for example, to develop a widget that you can reuse and include everywhere without fearing of having it's style messed up because another website uses the same CSS style than your widget.

[CuteAlien]

Ah ok. Well, glad we're fine for now :-)

[Cube_]

I saw google ads there so for a moment I was about to say "well there it is, ad code - of course that won't be in my version of the page since it gets stripped" but then you pointed out it's from your adblocker so that makes a bit more sense to me now.