Site Base URL changed by Hacker

Once I cleared my cache all was back to normal. How can I prevent this from happening again? This is a site we are about to launch for a client and I have at least 10 other clients site built in Modx.

Quote from: shellylynn at Jul 09, 2010, 01:07 PM

Once I cleared my cache all was back to normal. How can I prevent this from happening again? This is a site we are about to launch for a client and I have at least 10 other clients site built in Modx.

Do not cache the site_url in your templates using [(site_url)]. You can use an uncached Snippet to set this instead and then only the "hacker" will see the HTTP_HOST value they are spoofing (if that was indeed the case here).

OpenGeek : I guess I’m being a bit slow here, but could provide a small example of what you mean? I know what an uncached snippet is, but are you suggesting setting it in a snippet rather than letting it’s default value be used? If so, where would a snippet like this get called?

Sorry if I’m overlooking the obvious!
Matt

See http://modxcms.com/forums/index.php/topic,31825.msg193283.html#msg193283

@mrhaw : ah, yes. of course. thanks - much obliged.
Matt