Hello
Thankyou for the reply that is an interesting snippet and can be very usefull however the problem I see is that with an ajax call you no longer have access to $modx. However what you do still have access to is good ol session.
so I created the following bit of code to add to index-ajax.php again this would be a hack and only usefull if your entire site is members only since it would break any ajax app that was on a public page where the user was not logged in.
/**
* ********************************************************************************
* Added security to ajax calls only logged in users can access the ajax now
*/
startCMSSession();
if($_SESSION['webInternalKey']&&isset($_SESSION['webValidated'])){
// initiate a new document parser
include_once($base_path."manager/includes/document.parser.class.inc.php");
$modx = new DocumentParser;
$etomite = &$modx; // for backward compatibility
// set some parser options
$modx->minParserPasses = 1; // min number of parser recursive loops or passes
$modx->maxParserPasses = 10; // max number of parser recursive loops or passes
$modx->dumpSQL = false;
$modx->dumpSnippets = false; // feed the parser the execution start time
$modx->tstart = $tstart;
// Debugging mode:
$modx->stopOnNotice = false;
// Don't show PHP errors to the public
if(!isset($_SESSION['mgrValidated']) || !$_SESSION['mgrValidated']) @ini_set("display_errors","0");
if(isset($_REQUEST['q'])) {
$axhandler = preg_replace("/[^A-Za-z0-9_\-\.\/]/", "", $_REQUEST['q']);
$axhandler = str_replace(array('..','assets','manager','cache','files','export','media','templates'),'',$axhandler);
if (!@include_once('./assets' . $axhandler)) {
exit('Could not load requested ajax handler: ' . $_REQUEST['q']);
}
}
} else {
header( 'Location: index.php' ) ;
}
/**
* ********************************************************************************
*/
I picked webInternalKey && webValid as that seems to return you userID and if you are allowed access to the front end or not when you are logged in a lot more is returned as well but those seemed most appropriate
I figured that from this
http://wiki.modxcms.com/index.php/API:getLoginUserID
What is good about this is that it also gives your ajax app access to modx (the only thing is that the ajax app doesnt have a documentID to go by well I guess you could do it through a document or you could pass the documentID of the page you are on through your parameters and call it that way.
All comments are welcome
P.S. Any security holes anyone can think of please let me know.
