I found that modx is strong enough to deal with some bad boys that trying to hack modx sites.
But
some of threads remind us, that ’enough’ is not enough.
Be honest, you may say that "all developers should responsible to their own add-ons’ security", but any hole that left opened can break the whole site, which is a MODx site.
I think that MODx needs a specialized group that hammer up this security area, as part of the core dev.
Lead by one of the core devs, this group can do many things:
- create and update the MODx’s Security Standards, for core codes and 3PC developers
- responsible to audit the extra’s submission by testing it with some tools or common codes.
- provide a core class that sanitize any input, with any kind of tools, that smart enough to distinct ’bad chars’ and ’language chars’.
Talking about the language chars, this team should contain several members that understand about non-ASCII languages.
- always prepare for updates of the PHP’s/MySQL’s security bugs
Please take this seriously.
If you do this, MODx will become the safest framework you can find out there.
☆ A M B ☆
MODX Staff
