MODX auto-update and recent critical security issues

I'm an avid fan of MODX, and use it personally as well as commercially with many of my clients. My hats tips and salutes to the MODX development team, who to me, are technical magicians for putting together such a robust CMS. That said, I find it very frustrating when I have 10+ clients who have MODX 2.X.X installed each with their respective hosting environments--and suddenly there is a critical/extremely critical security risk that requires MODX to be upgraded to the latest version.

I can't speak for everyone, but for me, it's a logistical nightmare. I get nostalgic and start thinking of good'ol wordpress that has an auto-update/upgrade button that updates the core files in an instant--as simple as telling my clients to click update and that's that.

Looking through the forum, I see that it has been mentioned quite a few times before, so I realize others share my concern.

It doesn't appear, on the 2.3 or 2.4 roadmap, as much as I wish it would--is it still in the pipeline?

I am also curious to know how others handle situations similar to mine.

Cheers
Traz

Lately I've used the install.php script here https://github.com/evolution-cms/installer

Just put the install.php in your site root, run it from your browser, and choose the version to upgrade to. It automatically downloads and extracts the zip file, then starts the setup script for you.

I use it for all of my new installations as well.

Just further to Susan's work, she's also been keeping a fork of that original one there too, which I just used and it worked great.



If you look here you'll see it's a long way ahead of the original: https://github.com/evolution-cms/installer/network

I just wanted to say that this script is extremely helpful for me right now, because I'm in a country where the internet is limited, and to download 7MB, extract it and then reupload it, is not an option. Having the server download, extract and then do the upgrade is a marvelous thing.

Thank you!

Does the installer work with a renamed core above the site root and a renamed manager and other folders? The reason I ask is that we strongly advise hardening the site that way. Many MODX sites have been hacked due to vulnerabilities in the core and vulnerabilities in extras (including one of mine). To my knowledge, no MODX site has been hacked with a renamed Manager above the web root and all the attack vectors I'm aware of wouldn't have worked with that configuration.

I've used the installer and I like it a lot, but it's no substitute for an "Update MODX" button in the Manager, imo.

No. At this time it just unzips everything in the usual places. You would have to go in via FTP or control panel and move the core directory into place before running the update. Just like installing the advanced version to begin with.

However, there really isn't any reason it can't read the config.core.php file and find out where the core is supposed to be and move it if the advanced version is selected. Or even have a field pop up to ask where the core should be put if an advanced version is selected.

Does the installer file go in the MODX root? If so these two lines would give you all the MODX path constants to use in the rest of the script:


[ed. note: BobRay last edited this post 11 years, 1 month ago.]

I had my install in a sub folder on root, and just dropped it in, and it seemed to work. Eg:

Http://server.com/modx/install.php

Latest version does read the config.core.php file and puts the core in that location. https://github.com/sottwell/installer/tree/advanced-upgrade

The "advanced" download only contains the core and setup directories. The setup builds and places the other directories according to the options in the setup process.

TBH, I've never completely understood the relationship between the advanced and traditional distros or the process of switching from one to the other.

I've also thought for a long time that the two should be unified with some JavaScript to reveal the advanced options.