-
☆ A M B ☆
- 91 Posts
Quote from: opengeek at Sep 16, 2013, 07:37 AMBy doing this, you are basically disabling all security checks on your site. If the validation that is supposed to be checked to ensure you have a valid request is bypassed by setting it server side on every request, you are circumventing MODX security.
If someone cares to explore why the value being sent in the REQUEST is getting set to 0 in these environments, we can start to address the actual problem being experienced here.
What kind of security? Where $_SERVER['HTTP_MODAUTH'] is denined in CORE? Nowhere.
And i do not need code-access to create it. I can do this via AJAX. For example:
var url = foo_connector_url;
$.ajax({
'url': url
// set modAuth header
,beforeSend: function(xhr){xhr.setRequestHeader('modAuth', 'test-value');}
});
And i got $_SERVER['HTTP_MODAUTH'] == 'test-value';
Where security???
-
MODX Staff
- 10,725 Posts
The value coming from the request has to match the user calculated site_id on the server. That's where the security is...
-
☆ A M B ☆
- 91 Posts
Quote from: opengeek at Sep 16, 2013, 07:54 AMThe value coming from the request has to match the user calculated site_id on the server. That's where the security is...
So why we need compare it with site_id, if we can overwrite this? It`s unlogical. And it`s not securable. Why we compare both of $_SERVER['HTTP_MODAUTH'] and $_REQUEST['HTTP_MODAUTH'] with site_id (both overwritable) instead just compare $_REQUEST['HTTP_MODAUTH'] with site_id?
Opengeek, certainly not accusing you or anyone of ignoring the problem. Just wanting to get the issue resolved. I know there has been a lot of constructive feedback. As you said though, it seems like it is more an issue of the MODx team not being able to reproduce the problem.
What if I can provide access to a cPanel/MODx install or something like that so you can login and debug it. If I can set up a demo that is having the problem it would hopefully allow a little easier debugging for you?
For our company it has been inconsistent also, does seem to happen more when 2 people have full admin access, but I did a new 2.2.9 install and got the problem when I logged in the 2nd day of using that site and went to save resource and 'access denied'. I have also had it do the same in the gallery component when uploading files, doesn't say access denied but cant upload - then flush permissions and all good. I haven't had it happen twice on the same day on the same site, seems when you flush permissions it will work fine until you login again the next day or so.
-
☆ A M B ☆
- 318 Posts
It is entirely possible that the fact that two users are logged in is a red herring - I'm almost always logged in, and it's usually other users who get the error when they try to save a resource. It seems like it happens less frequently if I log out, but that might just be my perception.
