Question

i have been tasked with changing a bit of css for a site that i did not build and is quite old. Long story short – building the site from scratch is not an option. There are two CSS stylesheets associated with the site. I have tried combining them with no luck. The first stylesheet is declared in the head section of the document as normal. The second seems to be pulled from the following code:

<script type="text/javascript">
<!--
function P7_StyleLoader(tS) { //v1.3 by PVII
var tH = '',
    tDoc = '',
    tA = '<LIN' + 'K REL="stylesheet" HREF=',
    tB = ' TYPE="text/css">';
if (document.getElementsByTagName) {
    var bb = document.getElementsByTagName("LINK");
    if (bb) {
        for (var k = 0; k < bb.length; k++) {
            if (bb[k].rel.toLowerCase() == "stylesheet") {
                var h = bb[k].href,
                    x = h.lastIndexOf("/");
                if (x > 0) {
                    tH = h.substring(0, x + 1);
                }
                bb[k].disabled = true;
                tDoc = tA + '"' + tH + tS + '"' + tB;
                document.write(tDoc);
                break;
            }
        }
    }
}
}
P7_StyleLoader('STYLE-SHEET-2.css');
//-->
</script>

if i merge them and drop one of these stylesheets from the html, the site pretty much breaks in terms of layout. Could someone tell me if the above code is doing anything else besides just pulling “STYLE-SHEET-2.css”? My thinking is that i’d like to use either the above code and put the other styles into it or vice-versa? Am i missing something here?

thanks!

Answer 1

Yeuk. That is some nasty javascript.

What it’s doing is roughly this: It scans through any <link> elements in the document already and disables them. It loads the stylesheet specified in the function call instead.

In addition, it works out what the directory path was in the original CSS include, and appends that to the front of the stylesheet it’s loading, so that it is loaded from the same path as the original would have been.

The code is (slightly) obfuscated as well, presumably to prevent automated scripts from detecting what they’re doing.

The question is why would anyone actually go to all that trouble?

I can’t think of too many reasons why they may have done this. The only thing that makes sense would be to fool spam bots into loading the wrong styles or something similar to that. Make the page look different to a bot to how a human would see it. Possibly trying to fool search engine bots too, but that would be considered a very bad move – if Google catches on to that you’d get black-listed.