Hello,
MODx have been recently updated to version 0.9.2.1. and I was using 0.9.2.
So, I’ve patched my MODx installation by remplacing the 2 files found in the patch folder.
("document.parser.class.inc.php" and "version.inc.php" uploaded into the "manager/includes" folder)
On the downoad page of this website, where we can find the patch, we can read this :
modx-0.9.2.1-patch.zip 2006-04-26
MODx CMS Core version 0.9.2.1 (zip format patch for version 0.9.2; includes only changed files).
But, I’ve recently spent a few hours trying to understand why the "$_SERVER[’HTTP_REFERER’]" variable was
giving me a string without any special characters, only alphanumerical ones. In fact, I was testing an improvement
for the plugin allowing to hightlight search terms and I needed the referer variable.
In fact, and I read it a few minutes ago in the changelog file for this new version :
* Raymond’s Fix for undefined HTTP_REFERER on Windows servers in index.php for Raymond (791)
So the "index.php" file have been modified too. And no updated version of that file found in the patch folder.
For those who don’t wan’t to read a whole changelog every time they update their MODx installation, it’s a
great loose of time to understand why we encounters such problems (e.g. : referer variable).
This is the new code added in "index.php" in version 0.9.2.1 :
// secure variables from outside
// added 03-05-06
foreach(array('HTTP_REFERER','HTTP_USER_AGENT') as $outside) {
$_SERVER[$outside] = isset($_SERVER[$outside]) ? preg_replace("/[^A-Za-z0-9_\-\,\.\/\s]/", "", $_SERVER[$outside]): '';
if(strlen($_SERVER[$outside])>255) $_SERVER[$outside] = substr(0,255,$_SERVER[$outside]);
}
I’ve changed the "preg_replace" mask to this one : "/[^A-Za-z0-9_\-\,\.\/\s\?=%]/" to allow
querystrings to bypass the filter. Now it works for me but after hours and hours of tests.
I’m not there to criticize your team, you’re doing a great job, but I just ask you to be clearer in
the way you make the patch folders. We should find
every changed files in those folders.
Thank you very much for your work,
Benjamin
