A new resource browser in the hopper ?

I just read Jason’s post about the FCK security breach. Since I get a lot of questions on the french forums about the resource browser being secure, I thought I’d ask about this :

Quote from: OpenGeek at Nov 04, 2006, 11:26 AM

Finally, after initial reviews of all the various security exploits involving FredCKEditor, I’m simply uncertain whether additional unidentified vulnerabilities exist in the mcpuk resource browser code currently integrated into MODx, and considering the nature of the exploit, I wouldn’t take any chances until we announce an official new release of the/a resource browser, especially if you are unsure whether your server is properly secured against these types of attacks.

Does it mean there are short terms plans to find and implement an alternative to MCPUK ?
Or that MCPUK will be audited and have its code secured ?

Second question : will the MODx config check perform a register_globals check and display a warning to users who have it set to ON ?

Quote from: davidm at Nov 04, 2006, 12:29 PM

Does it mean there are short terms plans to find and implement an alternative to MCPUK ?
Or that MCPUK will be audited and have its code secured ?

Whichever solution materializes more quickly in my mind. But I believe all issues are isolated to the implementation of the MCPUK PHP connector, so it absolutely needs to be audited and refactored a bit so exploitation of register_globals vulnerabilities is not possible through any part of the connector. Various CMS’s have experienced a very large number of similar exploits, all due to poor integration decisions in the connector. There are a number of things we can do to resolve this without having to revert to an alternative resource browser, including removing any dependency on global variables and implementing an appropriate authentication stub for the connector that at least validates session variables. That’s why the connector allows you to define your own authentication stub; not sure why this wasn’t done originally...

Also, the current patch is a stop gap measure and renders the thumbnail capabilities useless in places where MODx sites use a rich text editor via a front-end editing interface, like NewsPublisher, and expects to be able to use the resource browser (i.e. to allow Web Users to publish blog posts with images). So, this really needs to be solved, if possible, before 0.9.5 final is distributed.

Quote from: davidm at Nov 04, 2006, 12:29 PM

Second question : will the MODx config check perform a register_globals check and display a warning to users who have it set to ON ?

I think it should yes...can you submit an request for this feature in FlySpray if there isn’t one already?

Ok Jason I’ll check for this in FlySpray and add it if not present.
Edit: Checked and done : http://modxcms.com/bugs/task/654

Thanks for the quick and crystal clear answer