2nd day with modx - IS IT SECURE?

This is now my second day getting familiar with modx, which I am evaluating for a project.

I like a lot of what I see so far, but I have come across various posts online that point out various security vulnerabilities, which give me cause for concern. these posts mainly site XSS & CSRF issues.

I’m not too concerned with specifics at the moment, but I would like to get peoples thoughts on how secure modx is generally, and if there is a security issue found, how long does it take before a patch is made available?

ALSO, if I want to include a form on a page, is there a form api that can help with validation or can I write my own validation as I see fit?

Hi Ascension,
I’m no security expert, but in the past the security advisories that I’ve seen about MODx have to do with older versions. No system is entirely secure, but I would bet that the MODx coders are quietly reading these advisories and fixing them. Maybe one of them will chime in here. A few months ago, a snippet vulnerability came up, and they posted a fix quickly. In general, I would guess that MODx is as secure or better than many other CMS’s, but again, security experts would have better info.

As to form validation, yes, there is a form snippet called Eform. It’s got a lot of good features, and it does offer field validation and many other things. But it’s not as easy to use as form apps on other systems. It’s not a form generator at all, you’ll need to read the doc or manual and get your hands a little dirty to get the validation code working and so on. The stock system comes with a form that you can look at to see how it works. It’s not too bad, just tricky the first time you use it. When I get asked to do a MODx form, which is pretty often, I know that it will take more time than I’d like, but it always gets done.

It’s even set up to do regex if you have more complex needs... I used that once to set up credit card number validation.

When I want something quick and dirty, at times I will use Javascript validation that will easily drop into any system. I work on a variety of CMS’s, and some have such goofy form scenarios that it’s easier to do that.

good luck, Dave

Hey,

I’m no security expert either, but in my use of MODx and watching the security notices it appears the server is typically the cause of problems or issues with some of the third party snippets. The biggest issue I recall lately was the reflect bug, but removing a text file from the folder resolved that issue.

The fact MODx isn’t noted in the website unless you add a note likely helps with the security issues. Other systems such as wordpress tend to be noted on the website making them easier to target in my book...