We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 33563
    • 17 Posts
    1. If send array GET to page with Ditto, modx view error, bcause htmlspecialchars not processed arrays.
    Examples:
    http://modx.ru/sites/?a[]=1
    http://sweetmenu.ru/articles/news.html?a[]=1
    http://rpkkub.ru/?a[]=1
    

    Details (Russian): http://modxcms.com/forums/index.php/topic,53232.0.html

    2. If send POST with tplID to /assets/modules/docmanager/tv.ajax.php, we seen all TVs on site.
    Exapmpe (html page for test):
    <form action="http://modx.ru/assets/modules/docmanager/tv.ajax.php" method="POST">
    <input type="text" name="tplID">
    </form>

    URL: http://dl.dropbox.com/u/10401656/test.html
    Details (Russian): http://modxcms.com/forums/index.php/topic,53351.0.html

    Sory for my ugly English tongue
      • 18913
      • 654 Posts
      A possible solution for #2 :

      In the Docmanager module code, change this line
      $dm->ph['ajax.endpoint'] = MODX_SITE_URL.'assets/modules/docmanager/tv.ajax.php';

      to something like this :
      $dm->ph['ajax.endpoint'] = MODX_SITE_URL.'assets/modules/docmanager/tv.ajax.php?myparameter=avalue';


      Then in tv.ajax.php put something like this at the top of the file :
      $my_parameter = $_SERVER['argv'][0];
      $my_value = whatever_myparameter=avalue_was_above;
      if ($my_parameter != $my_value) die('<b>INCLUDE_ORDERING_ERROR</b><br /><br />Please use the MODx Content Manager instead of accessing this file directly.');
      


      Would appreciate comments on this. For whatever reason, the idea of using IN_MANAGER_MODE doesn’t seem to work.

      And thanks to mrhaw for starting my thinking along these lines!
      MattC
        • 20413
        • 2,877 Posts
        And for #1 I’m playing with: http://modxcms.com/forums/index.php/topic,16456.msg123881.html#msg123881
        That took care of Ditto! smiley
            function applyHsc($var){
              $var = htmlspecialchars($var, ENT_QUOTES);
            }
        	
        	function buildURL($args,$id=false,$dittoIdentifier=false) {
        		global $modx, $dittoID;
        			$dittoID = ($dittoIdentifier !== false) ? $dittoIdentifier : $dittoID;
        			$query = array();
        	//mrhaw http://modxcms.com/forums/index.php/topic,16456.msg123881.html#msg123881
                foreach ($_GET as $param=>$value) {
                    if ($param != 'id' && $param != 'q') {
                       $keyparam =htmlspecialchars($param, ENT_QUOTES);
                       $keyvalue = (is_array($value)) ? array_walk($value,"ditto::applyHsc") : htmlspecialchars($value, ENT_QUOTES);
                       $query[$keyparam] = $keyvalue;               
                    }
                 }
        
        #			if ($param != 'id' && $param != 'q') {
        #				$query[htmlspecialchars($param, ENT_QUOTES)] = htmlspecialchars($value, ENT_QUOTES);
        #			}


        http://github.com/mrhaw/EVO-Addons-FIX

        But now anyRating gives me the error tongue

        @mconsidine Thanks for sharing that approach! smiley
          @hawproductions | http://mrhaw.com/

          Infograph: MODX Advanced Install in 7 steps:
          http://forums.modx.com/thread/96954/infograph-modx-advanced-install-in-7-steps

          Recap: Portland, OR (PDX) MODX CMS Meetup, Oct 6, 2015. US Bancorp Tower
          http://mrhaw.com/modx_portland_oregon_pdx_modx_cms_meetup_oct_2015_us_bancorp_tower