-
☆ A M B ☆
- 24,524 Posts
Trying out those URLs on my dev site doesn’t work, I get a "This function has not been implemented yet." message in the Manager, and a 404 page for the front-end. No javascript popup, either.
-
☆ A M B ☆
- 24,524 Posts
I’m not sure; these people are very prolific with these reports. They have not contacted the MODx developers at any time with any of this as far as I know. I’m sure as soon as the time zones roll around this will be looked at by those who are in a better position to determine what’s going on here and respond appropriately.
-
MODX Staff
- 12,272 Posts
Try out the exploits and see if you can reproduce them ... I can’t seem to do so at least not with any of the ones that require a logged in manager (I’m not running the search highlighting plugin). It would certainly seem to me that having a logged in manager user comes with the potential for more damage but what do I know? They did contact us once regarding these two of the issues reported and had and we requested follow-up information but we received no response.
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
-
☆ A M B ☆
- 24,524 Posts
I’m wondering if they don’t just blast off with theoretical stuff like this trolling for business.
-
MODX Staff
- 12,272 Posts
The fact that you have to have a logged in manager session to perform all but the search highlighting one seems to me that there’s much larger issues at stake.
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
-
☆ A M B ☆
- 24,524 Posts
I see that the stuff is injected (not a whole lot can be done to stop it altogether, after all) but its quote marks are all escaped, and the worst it does is insert broken tags in the content. No javascript is executed. In some cases it appears to break the functionality of the page in questions, such as in the Manager causing pages to be opened full-page instead of in the right frame, and in the case of the manager user search injection, causing the page to report "no users found". So at worst it seems to just clutters up the page with junk that might break the page.
This is with Firefox and Safari. IE may behave differently?
-
☆ A M B ☆
- 24,524 Posts
I was working with the Search Highlighting plugin, and added a couple of strip_tags that should completely eliminate any chance of trouble with it.
Lines 49 and 50:
$searched = strip_tags(urldecode($_GET['searched']));
$highlight = strip_tags(urldecode($_GET['highlight']));
Seems to work fine, and will remove any html tags that are in these values, such as <script, <img, or anything else. I can’t see that it should impact the function of the search any, visitors shouldn’t be searching for anything like that anyway.
