revoSSL - pretty severe bug | MODX Community Forums

116 Posts

manu37 Reply #1, 13 years, 6 months ago

to everybody using revoSSL to set https for individual resources:
After install, any unpublished or deleted resource is shown when addressed directly. The bug was reported times ago but I'm not sure if it is exactly the same plugin. For revoSSL I don't find a link to register a bug so I do it here.
Putting this code right after line 51 "if (is_object($resource) ){"

if ($resource->get('published') == false || $resource->get('deleted')) {
    if (! $modx->hasPermission('view_unpublished')) {
        $modx->sendErrorPage();
    }
}

did the job.
I hope the fix is complete and saves the time for anyoneelse I used to find out.
regards
manu

☆ A M B ☆
181 Posts

jgulledge19 Reply #2, 13 years, 6 months ago

Thanks for reporting, I will review.

MODX ebook | My Site

☆ A M B ☆
181 Posts

jgulledge19 Reply #3, 13 years, 6 months ago

Updated: http://modx.com/extras/package/revossl

MODX ebook | My Site

116 Posts

manu37 Reply #4, 13 years, 6 months ago

Quote from: jgulledge19 at Apr 11, 2013, 04:19 PM

Updated: http://modx.com/extras/package/revossl

Hi Josh
~~I tried to install your latest package. I seems to me the modCategory source files are missing in the transport package.~~
Everything is installed correctly. Comments in the ssl plugins still shows Version:1.0.1pl, this was a bit confusing.
Since your plugin is the only one I have found with this ability, how about providing it on the
package manager of modx.com?

regards
manu [ed. note: manu37 last edited this post 13 years, 6 months ago.]

116 Posts

manu37 Reply #5, 13 years, 6 months ago

Hi Josh
With your new version 1.0.2pl I don't get back logged in into the (secured) manager. There's a infinite redirect.
Make these logfile entries senso to you?:

[2013-04-16 18:46:02] (ERROR @ /manager/index.php) [OnBeforeManagerPageInit]1
[2013-04-16 18:46:02] (ERROR @ /manager/index.php) [OnManagerLoginFormPrerender]1
[2013-04-16 18:46:03] (ERROR @ /manager/index.php) [OnManagerPageInit]1
[2013-04-16 18:46:03] (ERROR @ /manager/index.php) [OnBeforeManagerPageInit]1
[2013-04-16 18:46:03] (ERROR @ /manager/index.php) [OnManagerLoginFormPrerender]1
[2013-04-16 18:46:04] (ERROR @ /manager/index.php) [OnManagerPageInit]1
[2013-04-16 18:46:04] (ERROR @ /manager/index.php) [OnBeforeManagerPageInit]1
[2013-04-16 18:46:04] (ERROR @ /manager/index.php) [OnManagerLoginFormPrerender]1
[2013-04-16 18:46:04] (ERROR @ /manager/index.php) [OnManagerPageInit]1
[2013-04-16 18:46:04] (ERROR @ /manager/index.php) [OnBeforeManagerPageInit]1
[2013-04-16 18:46:04] (ERROR @ /manager/index.php) [OnManagerLoginFormPrerender]1
[2013-04-16 18:46:05] (ERROR @ /manager/index.php) [OnManagerPageInit]1
[2013-04-16 18:46:05] (ERROR @ /manager/index.php) [OnBeforeManagerPageInit]1
[2013-04-16 18:46:05] (ERROR @ /manager/index.php) [OnManagerLoginFormPrerender]1
[2013-04-16 18:47:59] (ERROR @ /index.php) [OnWebPageInit]1
[2013-04-16 18:56:00] (ERROR @ /index.php) [OnWebPageInit]1
[2013-04-16 18:56:07] (ERROR @ /index.php) [OnWebPageInit]1

I had to get back to my patched version.
Regards
manu

☆ A M B ☆
181 Posts

jgulledge19 Reply #6, 13 years, 6 months ago

@manu

It should be available to install in the Package Manager of MODX.

Those errors are just mean that it ran, I updated it to 1.0.3pl to remove those.

I added a new setting forceWWW, can you verify that is set to 0 or false? That could cause a loop if you have your server set to force no www.

MODX ebook | My Site

116 Posts

manu37 Reply #7, 13 years, 6 months ago

Hi Josh

On my system www ist forced/rewritten in .htaccess. I don't have a setting forceWWW, therefore it should be 0/false by default. I just wonder in the latest version case 'OnManagerLoginFormRender' is commented out, on this event $makeSSL remains false, but the final redirect is done nevertheless. Could this cause the endless redirect loop? The frontend SSL redirect runs correctly, only the backend SSL redirect causes problems.
I'm working on a life system. The manager users are not amused beeing locked out, therefore I just can test in low hours. If the plugin loops it's pretty hard to unlock the backend login (I had to modify the cached plugin). Do you know a faster fix to get back in?
regards
manu

73 Posts

jstump Reply #8, 13 years, 5 months ago

I'm having some issues that sound like the same as manu37. Site works, but unable to log into manager. It just loops me back to the login screen. If i use my .htaccess in /manager, as stated to use in http://rtfm.modx.com/display/revolution20/Hardening+MODX+Revolution#HardeningMODXRevolution-ForcingSSLconnectionstotheManager i get a infinate loop error.

in my .htaccess i use
# Rewrite www.domain.com -> domain.com -- used with SEO Strict URLs plugin
RewriteCond %{HTTP_HOST} .
RewriteCond %{HTTP_HOST} !^name\.com [NC]
RewriteRule (.*) http://name/$1 [R=301,L]

If i change, the above to
# or for the opposite domain.com -> www.domain.com use the following
# DO NOT USE BOTH
#
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^www\.STD-Verify\.com [NC]
#RewriteRule (.*) http://www.STD-Verify.com/$1 [R=301,L]

still same issue...

using friendly urls,
revo 2.2.7

this happens immediately upon install. i'm not able to get to the settings page before i'm kicked out to the login page.

I have been unable to find a way to get back into the manager, unless i do a site restore from backups. removing the RevoSSL plugin code with phpadmin doesn't work.

116 Posts

manu37 Reply #9, 13 years, 5 months ago

For a temporary deactivate the RevoSSL Plugin I went into core/cache/elements/modplugin/ and searched for the RevoSSL cached code. Just put a "return;" right after the global modx statement and save. This should let you log in to the manager (and deactivate the RevoSSL Module).
regards
manu

☆ A M B ☆
181 Posts

jgulledge19 Reply #10, 13 years, 5 months ago

@jstump Your rewrite rule is forcing http:// so if you are setting a page to SSL the plugin redirects all http to https, hence the loop. You need to rework your .htaccess statements, check out this page: http://www.askapache.com/htaccess/http-https-rewriterule-redirect.html for some ideas.

MODX ebook | My Site