I'm investigating some files in a website which were hacked and the site is under version control in a Subversion repository, but it doesn't show the files as being modified. How do I stop SVN from ignoring the files so I can check in clean copies?
I'm cleaning up a website that was hacked (relatively minor, some casino links were added to a page header) and the site is hosted from a working copy of an SVN repo. (Yes, it does have a functioning .htaccess file that prevents access to the
.svn folders.) Interestingly, the hacked file has the modification date of the last updated version in the SVN repo,
svn status shows it as being unmodified,
svn log -v <hacked_file> shows no commits past the last updated version in the SVN repo,
svn diff <hacked_file> also shows no difference between the file and the last modified version in the repo. I whipped up some scripts to check logs & diffs between each version and there's nothing modifying that file.
However, I noticed that the file name does appear in
.svn/all-wcprops, as follows:
K 25 svn:wc:ra_dav:version-url V 48 /<repo>/!svn/ver/97/trunk/www.example.com/<hacked_file> END favicon.ico
svn proplist -v <hacked_file> doesn't output anything and
svn propget 'svn:wc:ra_dav:version-url' <hacked_file> returns an error saying it's "a wcprop, thus not accessible to clients".
I'm not seeing any 'svn:ignore' props and
svn status --no-ignore doesn't show the hacked file.
I've done a lot of research and am really not finding any information in SVN 'wcprops' or
.svn/all-wcprops. Is it safe to delete the
Any other possibilities/options/advice other than blowing away the working copy and checking on a fresh copy (this in an all-too-large repo, so it's time consuming and would take a long time to review to make sure everything is working, esp. since I can't trust that there are no modified files that might be lost)? Is this something that was likely modified in the main SVN repo?