MODX Bugs & Security - How Much Will Upgrading Help?

I'm a non-technical member of a team using MODX to update a small web site (with minimal e-commerce). We've been seeing bits of code inexplicably pop up in our pages and I'm guessing that this might be due to bugs or security vulnerabilities in MODX.

We're using MODX version 0.9.6.1

I'm guessing that we haven't upgraded to a newer version because:

1) Older versions of MODX are more stable
2) Upgrading / installing can be time-intensive
3) Site editors will have something new to learn

I'd like to know more about:

- The benefits of staying with MODX 0.9.6.1
- The benefits of upgrading to a more current version of MODX

I've been reading about the importance of staying up-to-date with current versions of WordPress for security reasons.

Would upgrading to a newer version of MODX help with bugs (seems obvious) and possibly with web site security as an added benefit?

Sorry if this is a stupid question -- I realize that it might be.

I'll share replies with my team.

Thanks!

That version of MODX is *very* old. A number of serious security bugs have been fixed since then and newer versions are not necessarily less stable than older ones. It varies from version to version, but in general, MODX has gotten more stable along the way.

The down side of upgrading is not less stability, it's that some of your older add-on components may not work with newer versions (especially if you have created them yourself). This is more likely since you'd be jumping over so many versions. Newer versions of the add-on components are probably available.

The best practice is to upgrade as new versions come out and deal with any problems at the same time everyone else is.

FYI, upgrading will close some serious security holes, but if someone has already burrowed in through one of those holes, upgrading may not solve all your problems. If one or more hackers has penetrated your system, they may know your passwords or they may have planted back doors or malicious files that would still be operating after the upgrade.

All that said, I would definitely upgrade in your situation, but back up the site first so you can go back. As soon as the upgrade is working, change all usernames and passwords (including those for cPanel, database, and FTP). If you still see what looks like hacking, you'll have to figure out where it's coming from.

When upgrading from such an old version, I find it helpful to avoid overwriting the snippets (assets/snippets/) and to make sure the snippets are not checked in the options page of the upgrade installer. Once the site is updated, you can then update the snippets one by one, adjusting them as you go. The main problem is that some of them have had the properties changed, so when you upgrade them to the latest version the snippet calls in your site won't work. One glaring example of this is AjaxSearch. At least it is well-crafted enough to give helpful error messages in its place. Ditto also has changes, but it is written to maintain backwards compatibility.

Another helpful suggestion for the sake of security is do not leave any of the old code laying around on your site. Once the snippets and plugins are upgraded, delete the old ones. If you can, set your index.php files and the /manager/includes/config.inc.php file to read-only. Once it's upgraded, nothing needs to write to these files.