[SOLVED] Popup Window Just Says "1"

Puye

I have not found any posts about this. Whenever I click on certain menus, for example Admin Panel > Agents > Departments and then click any department, a popup window will come up that just has the text "1". Nothing else. Here are screenshots, the first from Chrome and the second from Firefox.

This issue isn't breaking anything, but it is annoying. I don't even know where to start with troubleshooting this. Any ideas?

KevinTheJedi

Puye

Did an Agent attempt to put XSS or something in the department name? Do you have any code customizations? This is not how core functions. Someone modified your code or you have some sort of customization or someone attempted XSS or something along those lines.

Post a screenshot of Admin Panel > Dashboard > Information.

Cheers.

Puye

I certainly hope no one attempted XSS, but if they did they probably didn't accomplish much. This issue has been around for a few months, ever since we upgraded osTicket. I just didn't bother to try to fix it as it was low priority compared to other tasks. We do not have any code customizations.

Here's the screenshot:

ntozier

I would re-download the core files
osticket.com/download

And re-upload them to your site.

Puye

ntozier I just tried this but no luck. I downloaded the files for 1.17.5 and replaced both the scripts and upload directories in my osTicket server with the ones from the download (and of course copying the ost-config.php file from the old upload folder to the new). This screenshot shows that osTicket is now on version 1.17.5 but the issue is still occurring:

KevinTheJedi

Puye

Well this is odd.. I don't think I've seen this one before. Do you use a hosting provider or run your own server? Do you have any mods/themes/plugins installed?

Share a screenshot of the Department names and anything else you click on that shows the popup.

Cheers.

Puye

KevinTheJedi I'm glad I can keep things interesting with this new issue!

We are running our own Ubuntu server as a VM. I do not know of any customizations like that, though osTicket was installed in this environment well before I came around. The upload/include/plugins directory only has 3 files: auth-2fa.phar, auth-oauth2.phar, and updates.pem. Not sure what that last one does. I am using Dark Reader on my browser because that's my preference, but even incognito tabs or private windows (Chrome and Firefox respectively), which don't have Dark Reader on my setup, still have the same issue.

Here are the departments:

The popup actually shows up twice in a row when clicking the names of any of the agents under Admin Panel > Agents > Agents. I have the names scrubbed out in the screenshot because we operate in a highly confidential environment and I just want to be on the safe side. The popup shows up twice in a row if you click anything under the "Names" column, such as Admin Local:

Also, interestingly enough, clicking Roles at the top there brings up the popup as well. Then, if you click something like "All Access" in there, and then click backspace on the browser, the popup shows up again. So the issue is definitely tied to these specific pages.

I have tried everything else in the Admin panel and it does not show up anywhere else. So it's only showing up on things under the Agents tab.

Also, I found this anomaly under Agent Panel > Users > User Directory:

There are 65 of these (1) users total.

KevinTheJedi

Puye

The (1) user issue seems like maybe an install issue or configuration issue or old bug or something where the users name was not available or was improperly formatted or something. You can go through and update the names to the correct ones although it will be time consuming. If it’s not causing any issues and it’s not happening recently then I’d say ignore it.

As far as the popup issue goes, do you have any custom Apache site rules or configurations?

Can you setup a different test server, install osTicket there, and see if you have the same issues? If you can’t replicate the same issues it may be worth setting up a whole new server, exporting the db from the old one, importing it to the new one, copying over the osTicket config file from the old one to the new one, and make a switch to the new server.

It could be something the previous person did before you that’s causing issues.

Cheers.

Puye

KevinTheJedi I don't know of any custom Apache settings, I didn't find anything in our server that looked like it could be causing the issue. I'll try standing up a test server but that's going to take some time as there's higher priority issues than a simple annoying popup.

Puye

So we got a new sysadmin who took over this issue and found the problem. Definitely looks like an injection attempt:

No alarms in our environment have gone off so I don't think it's a real security incident. We do have a company that does periodic pentests for us so maybe one of their pentesters did this to explore what they could do. We have that code removed and everything is good now.