Jot parse error

Jot is still causing parse errors; is the suggestion here valid? http://modxcms.com/forums/index.php/topic,31628.msg191895.html#msg191895

I presume these are caused by hacking attempts using the Jot form; would there be a better way of just dropping such form submissions, rather than having Jot fail with a parse error?

I use that patch and it works for Jot AFAIK!

Should the same be done to weblogin urlencode()?
http://modxcms.com/forums/index.php?topic=33981.0

Alik have a patch for old weblogin ---> http://setpro.net.pl/software/modx-stuff
but from 963 there is urlencode() added to it... as mentioned above.

Yes, my page comprised patch for old version of Weblogin, but please notice that Weblogin has no version control in headers of its php files. This is one thing. Another thing -- Weblogin is not in the sphere of my interest as far as Ditto and Jot are. However, after reading your posts I looked into the code of Weblogin embedded into MODx 0.9.6.3 version and applied patches for both email issue and hacking attempts via urlencode(). You can find newer version patched at http://setpro.net.pl/software/modx-stuff#attachments -- it needs to be tested in some project that is not in live/production mode (currently I have no such project).

Thank you!!

I have this original line: // http://svn.modxcms.com/svn/tattoo/tattoo/releases/0.9.6.3/assets/snippets/weblogin/

Your original line was: // http://svn.modxcms.com/svn/tattoo/tattoo/releases/0.9.6.3-rc2/assets/snippets/weblogin/


So I’m using some older version code //it’s all cut n’ paste
That means this maybe was fixed already!!

You are right, I missed that it was ...urlencode($name)..., but it makes no significant difference. Crash is caused by the fact that var $value contains -- smuggled via $_GET[] -- illegal value: array instead of an expected string (array is flattened by the patched code).

Thanks again!!

So if it’s an array, that definitely means a malicious submission? Couldn’t the submission processing just be aborted if it’s an array?

Aborting the submission you mentioned can quickly be done in two ways. The first consist in that Jot is used with captcha or in trusted mode (only registered users are able to post). The second, the best IMHO, requires intercepting malicious request by the server and redirecting to the error page -- I indirectly described it in my article at http://modxcms.com/forums/index.php/topic,33783.0.html (duplicated at http://setpro.net.pl/software/lowering-artificial-traffic). The fact that Jot/Weblogin creashes while processing unexpected array is caused by a query string like:

Array constructor "[]" is crucial here. Corresponding rewrite rule for .htaccess file should be something of this kind:

Well, I had more in mind of the snippet handling the abort. Instead of implode()-ing the bogus array, why not just return() or redirect to the error page or something?

I have not a good answer for your question. My motive that led me to patching it this way was probably the intention not to break ongoing process of parsing/rendering page.