Protecting ModX

58 Posts

gesman Reply #1, 17 years, 5 months ago

Is there a sequence of steps necessary to make sure ModX CMS does not leave any traces of "ModX" in HTML?
I dont want to advertise what kind of CMS I am using - and here’s one thing I noticed that get generated for every page:

<script type="text/javascript">var MODX_MEDIA_PATH = "media";</script>

Gleb

1,193 Posts

ScottyDelicious Reply #2, 17 years, 5 months ago

Does it do that on every page only when you are also logged in to the manager. That is usually part of the output when a snippet or plugin uses the RegClientScript API. Could be from QuickEdit, could be from another snippet you are using.

-sD-

Husband, Father, Brother, Son, Programmer, Atheist, Nurse, Friend, Lover, Fighter.
All of the above... in no specific order.

I send pointless little messages

58 Posts

gesman Reply #3, 17 years, 5 months ago

I am not logged on and I disabled QuickEdit as well.
I installed TinyMCE though, but I do not plan to give users editing capabilities.

Gleb

MODX Staff
10,725 Posts

opengeek Reply #4, 17 years, 5 months ago

Quote from: gesman at Nov 15, 2006, 11:26 PM

I am not logged on and I disabled QuickEdit as well.
I installed TinyMCE though, but I do not plan to give users editing capabilities.

Gleb

This is actually being done automatically if you have a TV being formatted for output on your page. This is a hastily designed dependency that is only needed for a very few select cases on the front-end. If you wouldn’t mind entering a bug indicating this should only be done as required for a widget that requires it, I bet we can get that fixed pretty quickly.

Jason Coward
Chief Architect @ MODX
http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek

45 Posts

ram Reply #5, 17 years, 5 months ago

I ran into the same issue as you - I don’t like the idea of having app-specific text in public viewable source if at all possible, and I am not using any front-end editors.

I created a quick fix plugin if you need it: Attach to OnWebPagePrerender in System events tab:

$output = $modx->documentOutput;
$kill = '<script type="text/javascript">var MODX_MEDIA_PATH = "media";</script>';
$replace = '';
$modx->documentOutput = str_replace($kill, $replace, $output);

58 Posts

gesman Reply #6, 17 years, 5 months ago

Ram,
great that you found a solution!
Could you please guide me where is this "System events" tab and how should I utilize this code ?

I couldn’t seems to find anything like that on Admin panel.

Gleb

45 Posts

ram Reply #7, 17 years, 5 months ago

Sorry - should have been more clear

MODx > Manager > Resources > Manage Resources > Plugins

Add the code to a new plugin and name whatever you want, then in the same area there will be a tab called ’System Events’

Go there, the first block of checkboxes ’Template Service Events’

Check the box - ’OnWebPagePrerender’

All done!

58 Posts

gesman Reply #8, 17 years, 5 months ago

Ram, thanks, you’re the man!
It works.
Are there any cases where this ’MODX_MEDIA_PATH’ thingy actually needed?

I don’t want to screw anything by blindly eliminating it.

45 Posts

ram Reply #9, 17 years, 5 months ago

I have had it going for about 3 or so months on 4 installations and I haven’t had a problem yet.

If you wanted to use QuickEdit or other front-end additions to MODx I suppose they will have a problem. In this case you could try adding the variable in an external .js (! don’t like inline .js unless absolutely necessary myself).

58 Posts

gesman Reply #10, 17 years, 5 months ago

Presence of QuickEdit adds so much stuff to every little poor HTML page - so it was prudent to disable it.
Sorry, I don’t want to offend it’s author - it’s a great pieace of work, I just want to please Google bot and save some bandwidth along the way too.
ModX probably has the skinniest HTML footprint produced compare to all other CMS, especially considering it’s flexibility and power - so it’s just amazing.

Gleb