2 major security bugs found in ModX

Also, are these two patches found here the only things that need to be added to 0.9.1 urgently, or are there any other security enhancements I should add before posting 0.9.1b -- there were some major problems with 0.9.1a and I want to make sure these two distinct issues are the only things that need to be addressed before making people get another patch or new download package.

The BINARY is used to make it case sensitive, but I can’t imagine any reason why REGEXP was used

Quote from: OpenGeek at Apr 22, 2006, 04:16 PM

Also, are these two patches[...]

As far as I remember there were some issues with the Weblogin-Snippet, because it used the same code from login processor. The other vulnerabilities require a registered manager user to be logged in, so they are most probably not exploitable by strangers.

It’s lines 185, 186 in weblogin.processor.inc.php where escaping (as above) should be done and the regexp-thing in line 197 which should be instead:


Fix for websignup.inc.php in line 26:


Another thing to note is that in 0.9.1 the manager user access permissions don’t work, because the procedure that should return data from user_settings table fails silently. So users shouldn’t use MODx’s builtin IP-based access control to gain security. (Afaik it’s already fixed in head of trunk, if not, I have a fix for it in my branch.)

I would suggest to also take the updated ContactForm snippet (see FS#266) into bugfix-release.

Yep, agreed, netnoise; in fact, I think I’m gonna pull a switch-a-roo on everyone and release all the latest security fixes, 404 fixes, and other new features/fixes I’m confident with in the current trunk, merged with the 0.9.1 release branch, as MODx 0.9.1.1 or 0.9.2 (any thoughts on this folks?). I’ll leave out all the major manager changes with regards to styling and some other work in progress stuff that I’m not confident with at all, new default templates, etc., which we can then move forward with and release shortly thereafter as 0.9.5. That’ll help us stop pushing the next release, which never seems to be finished. (more on this in another rant/post to the core team to follow this one).

Sounds good. Just discovered, there’s another critical XSS vulnerability I missed until now, hope to have a fix within the next days...

Let’s release a bug/security fix as 0.9.2. 0.9.5 hopefully within 10 days of that, although I want it much sooner.

There are now security fixes for FS#366 and FS#369. I’m currently working on a better version of that secure variables from outside hack... Would be nice if we could get that into 0.9.5.

Is there a way to close Security-Tasks in Flyspray? (The Close-Button doesn’t work for me.) Just ignore me, I got Javascript deactivated testwise. Most of the security related issues have been fixed in current release... (Well, there are new ones ;-)