RFI Scanning

Hey everyone,

Is there a way to choose to NOT show the MODX PHP error page and/or message? Someone was doing some snooping - possible RFI vulnerabilities using the following url:

/index.php?file_name[]=http://www.google.com/humans.txt?

Causing the site to show the PHP error page.

This is one way of doing it: https://forums.modx.com/thread/19997/securing-your-site-wiki-instructions?page=3#dis-post-111535

I have a 404 plugin that sends the full error+user info as an internal message to the MODX inbox. See below messages on my use of blackhole...

Hey MrHaw,

Got you . Will the error still be recorded in the System Events page in the backend?

Yes this way it will.

https://github.com/modxcms/evolution/blob/bugfix/manager/includes/document.parser.class.inc.php#L81
track_errors take care of that.
error_reporting records it

and to turn off the display one can set
ini_set(display_errors, '0');