Because of the MODX website that has been compromised, I have some thoughts regarding the security coverage from MODX.
I always check the MODX security feed to be sure I am not missing any critical updates. I'm not upgrading MODX websites for new functions I don't need, but of course I will update when there are critical security fixes. Now, I read that MODX 2.2.4 fixed a Local File Inclusion (LFI) vector bug. Apparently that's a pretty critical bug that needed a patch, but why am I not notified of the importance of the 2.2.4 update through the MODX security feed? And why didn't I see this critical fix mentioned explicitly in the 2.2.4 changelog?
So, my thoughts for a better MODX experience:
1) Announce critical MODX upgrades through the MODX securityfeed
2) Be more explicit in the changelog. Add a mark like [CRITICAL]. This also makes the changelog more readable for non-technical persons:
- [#7798] Avoid E_NOTICE in PHP 5.4 from array_diff_assoc in xPDO::loadClass()
Don't know what this update means to me
- [#7798] Avoid E_NOTICE in PHP 5.4 from array_diff_assoc in xPDO::loadClass() [CRITICAL SECURITY UPDATE]
Makes more sense to me
(Don't know if #7798 is a security fix, but you get the point..)
Regards,
Michelle
