New 2.5.4 install: server error on changelog.txt when manager opened

I've just installed newest MODx from fresh on a new webserver. All looks good but I see a couple of these in the error log, they appear when I open the manager:

[Sun Jan 22 10:04:43.278243 2017] [access_compat:error] [pid 16061] [client 54.194.127.25:59913] AH01797: client denied by server configuration: MYPATH/modx-2.5.4-pl/core/docs/changelog.txt

This is an Apache server, and the MODX core is under the public root BUT with denial via .htaccess:

order deny,allow
deny from all

It is all readable by the httpd (otherwise nothing would work). So why is the changelog being accessed directly (apparently?) and thus denied? Bug?

Happening on my 2.5.7 install as well.

Are those errors just from setup, or do they always occur when launching the Manager?

Have you looked to see if there's anything different about the permissions or ownership of that file or in its path?

Hmm, good call Bob. The error isn't from setup but it does seem to happen every time I launch the Manager.

There also doesn't seem to be anything different with the permissions or ownership.

I think I've at least found the location of the problem:



MODX seems to use that file's existence as an indicator of whether the core has been moved. The cURL response is probably not the one MODX is expecting. I had a similar problem with SiteCheck.

I thought there was a way to turn off the config check in System Settings, but I couldn't find it.

If I'm right about what the problem is, there are several possible fixes.

1. Edit the default Dashboard (System -> Dashboards) and remove the Configuration Check widget.

2. Rename that readme.txt file. (I think this would work, but it would be undone by every MODX upgrade).

3. Move the core above the web root. This would be my choice. I feel safer with the whole core absolutely inaccessible from the web and in a location few hackers would look for it. It's not difficult to do. You only have to do it once. UpgradeMODX will still work. And you can create a Media Source that lets you still see and edit the core files on the Files tab in the Manager.

That's indeed the config check widget to see if your core folder is accessible or not. The error is being logged by apache in the apache log, not MODX, which is a bit annoying but actually a good sign that your MODX core folder is secured, and that attempts to access it are being logged.