Взломали AjaxSnippet

/** @var array $scriptProperties */
if (!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {return;}

if (empty($snippet)) {return 'You must specify snippet!';}
elseif (!$modx->getCount('modSnippet', array('name' => $snippet))) {return 'Could not found snippet "'.$snippet.'"';}

/** @var xPDOFileCache $cache */
$cache = $modx->cacheManager;
$cache_key = '/ajaxsnippet/';
$key = sha1(serialize($scriptProperties));
$modx->lexicon->load('ajaxsnippet:default');

Тут вот дописали переменную $spinner, я сократил поскольку большая.
Ну и по ходу дописали вызов скрипта после событий
$spinner = 'data:image/gif;base64,R0lGODlhF4F25rAQEzC4m0EBy8b+7h5KMzdAps+FEC45NuInXQ0KfxtwphHdGnxEyuUe/U6CWwbwTMTwRJuOCmir8MBAyePboS3az8hAgozGL0ODU/T7i/okszoYkzfCv38HyUsf/v0WXhtXhAAOw==';

if (!empty($wrapper)) {$wrapper = $modx->getChunk($wrapper);}
if (empty($as_mode)) {$as_mode = 'OnLoad';}
if (empty($as_target)) {$as_target = '#'.$key;}

$script = '
$.post("'.$modx->context->makeUrl($modx->resource->id, '', 'full').'", {as_action: "'.$key.'"}, function(response) {
	if (typeof response.output !== "undefined") {
		$("'.$as_target.'").html(response.output);
		spinner.remove();
		$(document).trigger("as_complete", response);
	}
}, "json");';
$cache->set($cache_key . $key, $scriptProperties);

$output = '';
switch (strtolower($as_mode)) {
	case 'none':
		if (empty($wrapper)) {$wrapper = '<div id="[[+key]]" class="ajax-snippet"></div>';}
		$output = str_replace('[[+key]]', $key, $wrapper);
		break;

	case 'onclick':
		if (empty($wrapper)) {$wrapper = '<div id="[[+key]]" class="ajax-snippet">
			<a href="#" class="as_trigger">[[+trigger]]</a>
			<img src="'.$spinner.'" class="as_spinner" style="width:32px;margin:auto;display:none;">
		</div>';}
		if (empty($as_trigger)) {
			$as_trigger = $modx->lexicon('as_trigger');
		}

		$modx->regClientScript(preg_replace('/(\t|\n)/', '','
		<script type="text/javascript">
			$(document).on("click", ".as_trigger", function(e) {
				var spinner = $(this).parent().find(".as_spinner");
				spinner.css("display","block");
				$(this).remove();
				'.$script.'
				return false;
			});
		</script>'), true);
		$output = str_replace(array('[[+key]]','[[+trigger]]'), array($key, $as_trigger), $wrapper);
		break;

	case 'onload':
	default:
		if (empty($wrapper)) {$wrapper = '<div id="[[+key]]" class="ajax-snippet">
			<img src="'.$spinner.'" class="as_spinner" style="width:32px;margin:auto;display:block;">
		</div>';}

		$modx->regClientScript(preg_replace('/(\t|\n)/', '','
		<script type="text/javascript">
			$(document).ready(function() {
				var spinner = $(this).parent().find(".as_spinner");
				'.$script.'
			});
		</script>'), true);
		$output = str_replace('[[+key]]', $key, $wrapper);
}

return $output;