Dynamic Media Sources

It is very easy to create dynamic Media Sources based on resource ID using Bruno's MIGx-provided 'migxResourceMediaPath' snippet. The base path and URL for your Media Source looks like this:

This will allow a path of 'assets/images/42/' where the images will be associated with resource #42. Originally, it was developed for use with creating MIGx-based galleries. But it can be used for all sorts of interesting things, like giving editors their own image directories.

You can add an optional &createFolder=`1` property to have the snippet create the resource's folder if it doesn't exist.

This has evolved over time to allowing quite a number of resource-oriented placeholders besides the {id}.

I've added a new variation to this theme, 'migxUsernameMediaPath'. You can use it to create a Media Source that will use a folder for each user.


The code modification is simple, but I created a duplicate snippet so that it won't get overwritten if you upgrade MIGx.

Around line 99, just add this:
[ed. note: Bruno17 last edited this post 12 years, 1 month ago.]

Nice idea, but at the current state this might open up a huge security hole (Directory traversal attack).

I installed the Login-Package and registered a user with the following name:


This lists my whole webroot in the modx directory tree. I can't see any files, but a more experienced attacker will for sure be able to exploit this to get security related information.

There are several ways to block that sort of thing. I can think of two immediately.

Validate user names that are submitted via the Register snippet using a custom validator. No non-alphanumeric characters allowed.

Have all Registered users inactive until approved by an admin.

Anyway, I can't see giving self-registered users anything like a resource or access to the file system.

In this case, this was used in conjunction with the MemberPages plugin that automatically creates groups, a resource, and a folder for users created in the Manager.

The snippet has several resource-oriented fields that can be used, such as {id}, {parent}, {pagetitle}, {alias}, {ultimateparent}, even a complex folder name built from {breadcrumb}.
[ed. note: sottwell last edited this post 12 years, 1 month ago.]

Of course there are ways to counter this.

I only thought it would be a good idea to warn other users about this issue before they get hacked

Yes, good point.