We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

[Revo, solved] Connector problem (HTTP_MODAUTH)

    • 13735
    • 62 Posts
    jbjoe Reply #1, 16 years, 2 months ago
    Hello!

    two days ago I upgraded to the RC3, then my manager page stopped working! It doesn’t get its data anymore. I get
    [tt]{"success":false,"message":"Access denied.","total":0,"data":[],"object":[]}[/tt]
    all the time.

    I use jquery for everything, not modext. Just now I figured out that the other ajax requests send this HTTP_MODAUTH thing. It must be a new thing in RC3 cause in RC2 it worked fine.

    How can I fix this in my script?

    I appreciate your help! Thanks JB
      • 28215
      • 4,149 Posts
      splittingred Reply #2, 16 years, 2 months ago
      It was added to prevent middleman attacks on connectors.

      It’s a pretty easy fix; just ensure that every request to the connectors passes this PHP variable:
      $modx->site_id


      in either:

      a) An HTTP header of ’modAuth’
      b) or, A REQUEST variable of ’HTTP_MODAUTH’

      And that’ll do it.
        shaun mccormick | bigcommerce mgr of software engineering, former modx co-architect | github | splittingred.com
        • 13735
        • 62 Posts
        jbjoe Reply #3, 16 years, 2 months ago
        Thanks a lot! This is new isn’t it? It would be great if you add this to the manual. Before I’ve compared it to the other ajax requests, I serached quite a while in the source for bugs...

        Update: I think it’s mentioned in the manual. This must be the "Secured AJAX requests in manager+connectors" feature. Is there more information about this and how it improves security? I’m just curious.
          • 28215
          • 4,149 Posts
          splittingred Reply #4, 16 years, 2 months ago
          It mainly shuts down the obscure, but often reported in security sites case where if a user logs into the manager, and then visits a malicious site, the malicious site would use their browser session to run an AJAX request via either JS or a hidden iframe. That request would be targeted at the connectors, which would then allow the malicious site to run any connector in the mgr - including ones that delete resources, files, etc.

          The RC-3 fix adds the custom var that is known only by your MODx install, so that a session can’t be ’hijacked’ like above, since no requests without the auth var can go through.
            shaun mccormick | bigcommerce mgr of software engineering, former modx co-architect | github | splittingred.com
            • 28042 ☆ A M B ☆
            • 24,524 Posts
            sottwell Reply #5, 16 years, 2 months ago
            Can you post some links to more information on this? I’m beginning to use a lot of jQuery and AJAX in my sites, including in modules. Could this become a problem? Or does this only effect Revo with its connectors model?
              Studying MODX in the desert - http://sottwell.com
              Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
              Join the Slack Community - http://modx.org
              • 28215
              • 4,149 Posts
              splittingred Reply #6, 16 years, 2 months ago
              It only occurs when you try to access the core connectors. If you’re building your own connectors, or sending AJAX requests to MODx Resources, you wont have this issue.
                shaun mccormick | bigcommerce mgr of software engineering, former modx co-architect | github | splittingred.com
                • 13735
                • 62 Posts
                jbjoe Reply #7, 16 years, 2 months ago
                Quote from: splittingred at Jul 13, 2010, 08:16 AM

                It only occurs when you try to access the core connectors.
                I wasn’t accessing a core connector. It’s a custom connector for my component.

                Standard connector code:
                <?php
$basePath = dirname(dirname(dirname(dirname(dirname(dirname(dirname( __FILE__ )))))));

require_once $basePath . '/config.core.php';
require_once MODX_CORE_PATH . 'config/' . MODX_CONFIG_KEY . '.inc.php';
require_once MODX_CONNECTORS_PATH . 'index.php';

$modx->request->handleRequest( array(
    'processors_path'   => $modx->getOption( 'core_path' ) . 'components/gallerygear/processors/',
    'location'          => 'photo/browser'
) );


                BTW: It works now!
                  • 28215
                  • 4,149 Posts
                  splittingred Reply #8, 16 years, 2 months ago
                  Right; it also applies when you use the core connectors ’index.php’ file, as you are doing there.

                  Glad to see it working.
                    shaun mccormick | bigcommerce mgr of software engineering, former modx co-architect | github | splittingred.com
                    • 13735
                    • 62 Posts
                    jbjoe Reply #9, 16 years, 2 months ago
                    Yah it took quite some time. But hey: security first laugh

                    Again, thanks a lot!
                      • 23491 ☆ A M B ☆
                      • 1,056 Posts
                      pixelchutes Reply #10, 16 years, 2 months ago
                      Quote from: splittingred at Jul 12, 2010, 01:38 PM

                      It was added to prevent middleman attacks on connectors.

                      It’s a pretty easy fix; just ensure that every request to the connectors passes this PHP variable:
                      $modx->site_id


                      in either:

                      a) An HTTP header of ’modAuth’
                      b) or, A REQUEST variable of ’HTTP_MODAUTH’

                      And that’ll do it.

                      Awesome news, guys! This is a great addition to Revo!
                        Mike Reid - www.pixelchutes.com
                        MODx Ambassador / Contributor
                        [Module] MultiMedia Manager / [Module] SiteSearch / [Snippet] DocPassword / [Plugin] EditArea / We support FoxyCart
                        ________________________________
                        Where every pixel matters.