Security Issue?? modx.it , tattoocms.it HACKED!

• • MODX Staff
  • 12,272 Posts
  Ryan Thrash Reply #21, 19 years, 10 months ago

  We need the RC out and the language packs translated/updated in order to do a release with anything but english
  
  Ryan Thrash, MODX Co-Founder
  Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
• • 
  • 1,198 Posts
  Nicola (Banzai) Reply #22, 19 years, 10 months ago

  I agree with you, but can you add to the thread of the fix, an attached file with a fixed thumbnail.php possibly inside a folder path (manager/media..)?
  
  an ’upload your files to the root’ patch seems more friendly for newbies users
  Free MODx Graphic resources and Templates www.tattoocms.it
  -----------------------------------------------------
  
  MODx IT  www.modx.it
  -----------------------------------------------------
  
  bubuna.com - Web & Multimedia Design
• • MODX Staff
  • 12,272 Posts
  Ryan Thrash Reply #23, 19 years, 10 months ago

  I can’t automate the patching process, but I can upload a directory-nested "fixed" file. BTW, I’m adding this to the release readme:
  

  
  --------------------------------
  MODx SUGGESTED REQUIREMENTS :
  --------------------------------
  <soapbox>
  
  MODx is a PHP application. With that in mind, please be sensible about how you run it and please make sure that your php.ini file is configured for security. If you don’t know what that means simple ask your host at a minimum to make sure the following setting is properly handled:
  
  register_globals OFF
  
  If you DO know what that means, you might be shocked to learn that some of the largest (and cheapest) shared hosting providers out there--including the ones that advertise two-page spreads in glossy magazines--don’t either take the time or have the competence to make sure they’ve properly secured their OS stack and PHP configuration. It’s a pity, an inevitable and preventable security compromise waiting for the right exploit to give you a hacked site.
  
  (Anecdotally, the creators of PHP (Zend) consider register_globals being on such a bad idea it’s being removed from PHP 6.)
  
  </soapbox>
  
  
  Ryan Thrash, MODX Co-Founder
  Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me

This discussion is closed to further replies. Keep calm and carry on.