Nuke MODX_MEDIA_PATH, webelm.js and Proto/Script?

Is it really necessary any more? It’s definitely a marker for MODx installs yielding a potential vector for Google search for exploitable sites in the future. Locations:

Line 112 of the module.docmanager.tpl (in assets/modules/docmanager and in the install folder)

Line 18 of manager/frames/menu.php

Line 11 and 18 of manager/includes/header.inc.php

Line 13 of manager/includes/tmplvars.format.inc.php <-- likely cause of front end insertions

Line 7 of manager/media/script/modx.js <-- another potential cause of front end insertions

Sounds good to me. If we’re in the process of nuking potential vectors for exploits then we should also remove the ’<!-- MODx Registered -->’ comments that get inserted when using the regClient functions.

YES! The MODX_MEDIA_PATH has been a pet peeve of mine since the first time I saw it. That and the way that keywords and other meta tags are added...

Are there any TV formats still dependent on WebElm stuff? Or anything in general that is? If not we can remove that stuff as well as Prototype and Scriptaculous, too. (topic title updated)

Further exorcism candidates:
manager/media/script/bin (some parts may need to remain ... but dynelement.js, webelm.js and ext/ should go)
manager/media/script/forIE
manager/media/script/scriptaculous
manager/media/ImageEditor (is it used anywhere?)
manager/media/calendar (replace with mootools version from CNET libraries: http://clientside.cnet.com/wiki/cnet-libraries/03-jswidgets 1/3 of the way down)
manager/includes/sniff (seriously ... browser sniffing ... bloated implementation )

Quote from: rthrash at Feb 01, 2007, 11:04 AM

Are there any TV formats still dependent on WebElm stuff?

I think that the ticker output format is webelm dependent (although it’s just a matter of adding that to the document head on legacy installations, which is hardly a complicated patch).

Note: possibly outside of Script/Proto, this stuff should be done post our next release.

Scratch that ... scriptaculous is still all over the place. We’ll start purging after our next release.

If we’re really in the process of nuking potential modx identifiers from sites, the /manager hardcoded URL is a great place to start