I think I’m following all this, but is there any reason why 0.9.5 couldn’t have the create session and base-path stuff *referenced* by the config.inc.php, so in the event that it needed to be different it could be configured to use another function instead?
Like I said a chain is only strongest at it’s weakest link. No amount of encapsulation will protect the system if a hacker gets on the inside of the system. It makes no difference to the hacker whether a function is called by:
startSession();
or
$modx->startSession();
@PaulGregory,
Yes it can be made to do just that
