Any way to use modx without CURL?

I don't know for sure that TinyMCE requires cURL. I just saw some possible references to it in the TinyMCE source. It might work fine, or it might work with some missing capabilities that you don't need. Also, if TinyMCE has problems, it might have the same problems in Evo.

I would be inclined to see about getting Revo installed and tested on the server. You should know within an hour if you can use it or not.

Quote from: sottwell at Jan 17, 2013, 12:13 AM

I would be inclined to see about getting Revo installed and tested on the server. You should know within an hour if you can use it or not.

Sure, but this won't work this way. If I win the project I will have access to the host, never before.
I have to build up my proposal, once it's done, no turning back. (more over it's some kinfd of ".gov" client with specific administrative task).

That's an ugly situation. You might end up not being able to use either Evolution or Revolution.

Evo should work, I've used it on hosts without curl.

I wonder if this would work? http://code.blitzaffe.com/pages/phpclasses/files/libcurl_emulator_52-7

I haven't looked up cURL security for a while but I know it's been in active maintenance for years with aggressive attention to security. That said I know it relies on other open packages for security. So I'm wondering what is that some agency has against cURL outside of being afraid of FOSS ... if that's the concern they have some serious thinking to do.

Jus' sayin'...

I'm not a php specialist, but not far to think like you, however, this are rules French "education nationale" administration has decided. Do with this, is not a matter of discussion.

They simply say there's no pb with other cms "... (spip, joomla, wordpress, guppy, etc.) "...

I made another highschool site 2 y ago with Evo but now I won't like to go back to Evo

This is all commentary, nothing really concrete except for Point3 below. Skip if you don't have time.

I have no intention to speak in favor of any specific software, or against. I'm just expressing some concern for the decision process of people who make decisions like this.

WordPress has a "proprietary" HTTP API which plugin developers are encouraged to use. This is a basic wrapper for communications. If cURL is available it simply uses that for transport, but if not it uses other PHP functions. WordPress developers are encouraged to use this API and to avoid coding directly to cURL. But that's a matter of portability, not security.

I believe Joomla does something similar. They use url_fopen or something for package updates but cURL is used if it's available.

cURL isn't much more than just an HTTP transport. It's not inherently any more insecure than any other browser request. If you want security, you need to use HTTPS/SSL just as you would with your browser.

Point 1: These sites that say they don't want cURL may still be using it.

Point 2: cURL manages security very well. For the last 12 years there has only been about one security issue per year, each addressed immediately. I don't know what people do about WP HTTP API security but I know there are security updates all the time - sometimes way too late. I'm sure a lot of people watch the HTTP API for vulnerabilities but somehow it seems a lot of damage gets done in the field before a patch can be put into the field. That's not a criticism. I've been using WP for years. I'm just saying a site can't legitimately say "WP is OK but cURL isn't" - these statements don't make any sense.

Point 3: I'm wondering if MODx has something like the WordPress HTTP API or if it's something to be considered, with full respect for those who have discussed this for WP. In fact, what's wrong with adopting the WP HTTP API and discouraging MODx developers from using cURL directly? And I wonder if that's been discussed in TinyMCE circles which was brought up earlier.

I understand that it's authorities in the French government who are making decisions, and you can't argue with them. I'm just suggesting that if they hear the same thing from multiple developers (that +WP or +Joomla, and -cURL makes no sense) that perhaps they will reconsider the folly, and you might get more support for your projects.

Well, you have a clear view for that "issue", and you re well advised to ask the question to make modx works like other majors cms for this potential curl pb.

However I won t be able to discuss with anyone.
I have a contact at the area technical office that provides hosting for their schools, but they are not in a position to decide or make the things to change. May be in half a century those stupids rules will be reviewed....or not

@Starbuck: Thanks for the interesting and informative points. I think there is a case for at least thinking about making Revolution work without cURL. I've seen a number of issues here caused by people installing MODX on hosts where cURL is not enabled.

I have a couple of Extras that use cURL and it would be nice to have them use a MODX HTTP API instead.

That said, one of MODX's strengths is that it is "lean and mean." Including a cURL emulator in the core would be going the other way. [ed. note: BobRay last edited this post 13 years, 8 months ago.]