Injected JavaScript in the template options

P2W · 2026-08-03T11:51:38+00:00

Hi Pascal habe auf die einte Website diese Meldung, würde es gerne analysieren, aber ich verstehe nicht woher dieses Inhalt genommen wird, aus der DB oder ein php oder ein sonstiges file? Danke für deine Unterstützung P2W

P2W

Hi Pascal
I’m getting this message on one of my websites and would like to analyze it, but I can’t figure out where this content is coming from — is it from the database, a PHP file, or some other file?

Thanks for your help
P2W

Pascal

P2W Hi, this is what's in the database in the #__menu table, ID #9 in the params field.
Looks harmless at a glance – a false positive related to YooTheme.

You can mark it as safe using the green button.

To help me improve detection (more easily), could you post the full content of the params field here – you can access it via phpMyAdmin (database management).

Cheers
Pascal

P2W

I logged in via phpMyAdmin and opened the DB, but it’s tough to find the #__menu table, ID #9 right now. I see all the tables listed as jos_XXX, how can I figure out which table this content is in? 😬
I checked the jos_menu table -> record with ID 9, but the param field is empty 😶

Maybe it wouldn’t be a bad idea to have the output window also show info about exactly where the code comes from in the future...

Cheers | P2W

Pascal

Sorry, I messed up quickly — it says Template Options, not Menu.

#__template_styles.params
Style #9

This is where it is, and somewhere in the Yootheme config there’s embedded JavaScript.
I’m currently tracking down the culprit (most likely FP), and the fix (including a clearer message showing exactly where the code comes from, with highlighting of the exact spot instead of the cut-off start of the params) will be included in 2.6.2.

If you find it in that table, feel free to post the full field here anyway.

P2W

Okay, I found it now 😆
It's in the table jos_template_styles
But the field params has a lot of code in it, including API keys and stuff, so I can't really post the code here. Sorry
Is there any way I can send it to you anonymously?

For your info, in the YT Editor under Settings, there's a field that lets you add custom scripts in the Head or Body. I've got various code in there like Google Analytics scripts, etc.
And in the table jos_template_styles, field params, the entire code shows up exactly, so that's probably why HTProtect is triggering an alert 😎

Pascal

You can send it as a .txt to mail@htprotect.app (without API keys).

And I could use that to test version 2.6.2 – to see if it then clearly shows/highlights the "Mark as safe" option for those who are no longer blind to it 🙂

And I would then update the whitelist accordingly.