Answered Security of Evo

Hi!

I wonder about the security of Evo. The abandonment of its development is a real problem?

My client asked me if there is a risk. There is always a risk but what guarantee can I give him? Especially if I told him he is no more developed (this is scary).

I remember the spam attacks on Evo (just before 1.0.15). I don't want to deal with this anymore.

What should I do to make Evo the most secure possible? [ed. note: neoziox last edited this post 11 years, 2 months ago.]

Remove all snippets, plugins, modules and chunks that are not required by deleting them from the server and database

Thanks!

Question: if I change the name of the Manager folder, but I write it clearly in a file, which CHMOD can I use to protect this file?

I just changed the permissions of the "siteManager.php" to CHMOD 400 - read only, works perfectly

But there is an .htaccess file in the cache folder which denies access anyway - try reaching the file directly and you will get a 403

At the end of the day, renaming the Manager folder is relative - if your site has an error of some kind, it's possible that the path to the renamed manager folder will be displayed in the error as the document-parser.php (in the includes folder in the manager) is referenced many time

Quote from: iusemodx at Jul 29, 2015, 02:16 AM

At the end of the day, renaming the Manager folder is relative - if your site has an error of some kind, it's possible that the path to the renamed manager folder will be displayed in the error as the document-parser.php (in the includes folder in the manager) is referenced many time

Do you mean that this feature doesn't work properly?

Quote from: iusemodx at Jul 29, 2015, 02:16 AM

At the end of the day, renaming the Manager folder is relative - if your site has an error of some kind, it's possible that the path to the renamed manager folder will be displayed in the error as the document-parser.php (in the includes folder in the manager) is referenced many time

Nope, default error handler hides descriptive messages from anonymous visitors.

Quote from: danilocuculic at Jul 29, 2015, 04:16 AM

Nope, default error handler hides descriptive messages from anonymous visitors.

I stand corrected, I just forced an error without being logged in and as you say, it simply shows "Error" - when did this change ?

I have to date always hacked the core and removed the error reporting code because of this problem

Quote from: iusemodx at Jul 29, 2015, 06:55 AM

I stand corrected, I just forced an error without being logged in and as you say, it simply shows "Error" - when did this change ?
I have to date always hacked the core and removed the error reporting code because of this problem

A couple of years, maybe more.