{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/8288","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8288/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8288/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8288/events","html_url":"https://github.com/joomla/joomla-cms/issues/8288","id":115342362,"number":8288,"title":"Error 500 due to unexpected '[' in components/com_content/content.php","user":{"login":"yiip87","id":4689824,"avatar_url":"https://avatars.githubusercontent.com/u/4689824?v=3","gravatar_id":"","url":"https://api.github.com/users/yiip87","html_url":"https://github.com/yiip87","followers_url":"https://api.github.com/users/yiip87/followers","following_url":"https://api.github.com/users/yiip87/following{/other_user}","gists_url":"https://api.github.com/users/yiip87/gists{/gist_id}","starred_url":"https://api.github.com/users/yiip87/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yiip87/subscriptions","organizations_url":"https://api.github.com/users/yiip87/orgs","repos_url":"https://api.github.com/users/yiip87/repos","events_url":"https://api.github.com/users/yiip87/events{/privacy}","received_events_url":"https://api.github.com/users/yiip87/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-05T18:16:55Z","updated_at":"2015-11-05T18:33:55Z","closed_at":"2015-11-05T18:28:52Z","body":"I've seen a couple of strange PHP errors in older Joomla versions in the last days. Responsible for this error is always the following line in the file components/com_content/content.php:\r\n\r\n```php\r\n if(stripos(JFactory::getApplication()->input->getVar(\"list\")[select],\"elect\")) die;\r\n```\r\n\r\nThe whole file looks like this:\r\n```php\r\n<?php\r\n/**\r\n* @package Joomla.Site\r\n* @subpackage com_content\r\n*\r\n* @copyright Copyright (C) 2005 - 2014 Open Source Matters, Inc. All rights reserved.\r\n* @license GNU General Public License version 2 or later; see LICENSE.txt\r\n*/\r\n\r\ndefined('_JEXEC') or die;\r\nif(stripos(JFactory::getApplication()->input->getVar(\"list\")[select],\"elect\")) die;\r\n\r\nrequire_once JPATH_COMPONENT.'/helpers/route.php';\r\nrequire_once JPATH_COMPONENT.'/helpers/query.php';\r\n\r\n$controller = JControllerLegacy::getInstance('Content');\r\n$controller->execute(JFactory::getApplication()->input->get('task'));\r\n$controller->redirect();\r\n```\r\n\r\nI've done some research and some sources state that this schould be a backport of the security fixes in Joomla 3.4.5 [1], some sources state that the site has been hacked [2].\r\n\r\nThe strange thing is, that the offending line appeared in the content.php without changing the files mtime. Also this code only executes in PHP Versions above PHP 5.4. The line was inserted into content.php without user interaction and I was not able to track down suspcious requests in the webservers error log.\r\n\r\nI've seen this in Joomla 3.3.6 and 3.4.1, but never in 3.4.5, so my question is: Is this an official fix that just breaks compability with PHP 5.3 and 5.4 or have those sites been compromised?\r\n\r\n[1] http://forum.joomla.de/index.php/Thread/967-Wei%C3%9Fe-Seite-im-Frontend-Parse-error-syntax-error-unexpected/?postID=6520#post6520\r\n[2] http://forum.joomla.org/viewtopic.php?f=714&p=3341527"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/154146824","html_url":"https://github.com/joomla/joomla-cms/issues/8288#issuecomment-154146824","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/8288","id":154146824,"user":{"login":"yiip87","id":4689824,"avatar_url":"https://avatars.githubusercontent.com/u/4689824?v=3","gravatar_id":"","url":"https://api.github.com/users/yiip87","html_url":"https://github.com/yiip87","followers_url":"https://api.github.com/users/yiip87/followers","following_url":"https://api.github.com/users/yiip87/following{/other_user}","gists_url":"https://api.github.com/users/yiip87/gists{/gist_id}","starred_url":"https://api.github.com/users/yiip87/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yiip87/subscriptions","organizations_url":"https://api.github.com/users/yiip87/orgs","repos_url":"https://api.github.com/users/yiip87/repos","events_url":"https://api.github.com/users/yiip87/events{/privacy}","received_events_url":"https://api.github.com/users/yiip87/received_events","type":"User","site_admin":false},"created_at":"2015-11-05T18:33:55Z","updated_at":"2015-11-05T18:33:55Z","body":"Host is Host Europe. They don't touch customer data, so those site are compromised.\r\nAnyway thanks for taking the time to reply!"}}