I’m not sure what that means - ACLs - can you spell it out? I guess Access Control List, but does that mean it will be possible to secure individual pages using a shared SSL certificate? If not, can I get some direction as to how the core could be modified to support it? Then I can see if I have time...
Andy
-
MODX Staff
- 12,272 Posts
I wouldn’t suggest working on it in 095, as the entire core will change for subsequent major/point releases. (Yes, Access Control Lists, although the implementation may not be quite that complex, the end result will be the same.)
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
OK, thanks for the info. I have a form that requires the user to enter sensitive medical info. The page the form is on is also in the menu. I can have the form store the info in the database for retrieval, rather than emailing it. What is the simplist solution right now? To create a dummy page that is on the menu and uses a redirect snippet to redirect to a https page? Will MODx be able to render the page using a shared SSL certificate?
Andy
MODx will be able to render a page using shared-SSL. That’s no different than any other page, except that you need to make sure that all of your image and other links are relative (unless you want the other links to be to the non-secure pages, in which case those should be explicit). The only major issue that people tend to have with shared-SSL is that session variables often don’t work when switching to the secure pages, so don’t rely on those.
You can use a variation of the plugin found here to automatically forward anyone who happens to use the non-secure link to load your sensitive page:
http://modxcms.com/forums/index.php?topic=1445.new;topicseen
Or if you’re using Apache you can force https and rewrite to the proper URL for your shared-SSL server in your .htaccess file.
-
MODX Staff
- 12,272 Posts
I think that with friendly alias paths, the base href (make sure it’s before any other include like CSS or JS files) is required actually. I don’t know why it would otherwise create a problem.
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
If my site is at www.foo.com and I access it via www.hostingco.com/~foo then what will site_url be?
Andy
I wouldn’t try to use the site_url placeholder for those pages. Just code in the correct URLs (either directly or using a base-href in your template). It might work, but I haven’t tried it and I wouldn’t expect it to work in this case (especially when submiting a form).
