Answered Modx Exploit

@Himurovich How does that affect snippets and plugins that have to read from and write to those directories?

Quote from: BobRay at Aug 10, 2018, 02:22 AM

@Himurovich How does that affect snippets and plugins that have to read from and write to those directories?

Hi Bob,
I'm afraid that I misunderstood your question .. if so please specify. But answering this - well, nohow as this is only protection from "outside"
Of course not a silver bullet as Mark said above, just additional complexity for bad guys/bots I believe.

Pardon my imperfect lingo.
The snippets and plugins would have the same rights as MODX PHP, and all run as normally once web access session has begun by successful logging in.

Now, if you are not there, that is, not logged in, all scripts would fail - and that's what we want, because it is either a hacker or a badly written frontend Extra overreaching and poke-nosing in the mgr sections.

This is my own experience in a fully working site.

I was thinking about the current version of UpgradeMODX, which writes a script to the root, then launches it. The script runs outside of MODX.

I remember making a promise to test that ... will get to it ASAP.
It would be a bummer if there were any hiccups.

But I imagined since the user would be running it from within MODX (that is, after having logged in), a session would be supplied to the browser to allow access to those protected folders.
I am assuming that the session being browser-wide would accommodate any script working within or without MODX.

Unless "The script runs outside of MODX." completely eludes me.

It's a new request and everyone is logged out, so if the session is tied to a user, it's probably gone, but if it's still alive in the browser, things should be good. There's also a separate launch of setup using JS replace().

FYI, you can set back the settings_version System Setting to an earlier version (doesn't have to exist) and "Upgrade" to your current version.

Just wondering if anyone had the chance to test this yet? Just not been able to find the time myself but would be interested to know.