MODX catalogue

MODX Revolution 2.0.0-beta-1

Released 17 years ago on May 28, 2009.

  • MODX Revolution 2.x improper input validation

    CRITICAL
    Type
    Improper Input Validation
    Fixed in
    MODX 2.8.9-pl
    Since
    Exact version not known
    Disclosed
    July 21, 2026

    MODX Revolution 2.x (core) has insufficient input validation that can allow injection of arbitrary content into site templates. Depending on site configuration, impact may escalate to remote code execution. The issue has been present for an extended period and was identified during an internal security review. CVE and CVSS are pending. Technical detail (attack vector, affected configuration criteria, and proof-of-concept) is withheld until patch adoption is broad enough for responsible full disclosure. All 2.8.x installations should upgrade; exposure cannot be reliably self-assessed from this preliminary advisory alone.

    Remediation: Upgrade MODX Revolution 2.x to 2.8.9-pl or newer as soon as possible. MODX Cloud customers: infrastructure-level mitigations reduce risk during upgrade but do not replace patching your site. SiteDash Client v1.9 also includes an additional mitigation.

  • A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure...

    CRITICAL
    Type
    XXE
    Fixed in
    MODX 2.8.0-pl
    Since
    Exact version not known
    Disclosed
    October 31, 2021

    A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an information disclosure or denial of service (DOS).

    Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.

  • MODX Revolution exposure of sensitive user fields to authorized managers (#15678)

    HIGH
    Type
    Security
    Fixed in
    MODX 2.8.2-pl
    Since
    Exact version not known
    Disclosed
    April 28, 2021

    MODX Revolution before 2.8.2-pl could return hashed passwords, cachepwd, salt, or session IDs to manager users with permission to manage users (#15678), including via security/group/user/getList and similar processor responses (SEC-3837). Requires an already-privileged manager account.

    Remediation: Upgrade MODX Revolution to 2.8.2-pl or newer.

  • Active exploit via exposed MODX Revolution setup/ directory

    CRITICAL
    Type
    Site Exploit
    Fixed in
    MODX 2.7.1-pl
    Since
    Exact version not known
    Disclosed
    April 1, 2019

    There is an active exploit of sites that leave the MODX Revolution setup/ directory in place after installation. Anyone on the internet can use the installation utility to re-install MODX against an attacker-controlled database, gain Manager access, and use the file manager to upload back doors—potentially leading to full server compromise (rootkits, spam relays, crypto miners). Affected installations are those with setup/ still web-accessible (commonly reported for sites on MODX Revolution 2.7.0 and earlier, but any version with an intact setup/ directory is at risk). Check by visiting https://yoursite.example/setup/; if the MODX installer appears, remove the directory immediately via FTP or SSH.

    Remediation: Remove the setup/ directory from the web root immediately if it is still present. Upgrading alone does not remove this exposure. After removal, verify https://yoursite.example/setup/ no longer serves the installer.

  • setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to t...

    CRITICAL
    Type
    Security
    Fixed in
    MODX 2.5.5-pl
    Since
    Exact version not known
    Disclosed
    March 30, 2017

    setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the config_key parameter to the setup/index.php?action=welcome URI.

    Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.

  • setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.

    CRITICAL
    Type
    Security
    Fixed in
    MODX 2.5.5-pl
    Since
    Exact version not known
    Disclosed
    March 30, 2017

    setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the core_path parameter.

    Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.

  • MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable...

    HIGH
    Type
    Security
    Fixed in
    MODX 2.8.4-pl
    Since
    Exact version not known
    Disclosed
    February 26, 2022

    MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

    Remediation: Upgrade MODX Revolution to 2.8.4-pl or newer.

  • MODX Revolution file management not restricted to allowed file types (#15643)

    HIGH
    Type
    Access Control
    Fixed in
    MODX 2.8.2-pl
    Since
    Exact version not known
    Disclosed
    April 28, 2021

    MODX Revolution before 2.8.2-pl limits create and upload actions to allowed file types but did not consistently enforce those limits on other file manager actions, notably editing existing files. A manager user could edit disallowed types such as PHP, reported as a potential remote code execution vector (SEC-3837).

    Remediation: Upgrade MODX Revolution to 2.8.2-pl or newer.

  • MODX Revolution path traversal when sending registry message (#15134)

    MEDIUM
    Type
    Directory Traversal
    Fixed in
    MODX 2.8.0-pl
    Since
    Exact version not known
    Disclosed
    October 6, 2020

    MODX Revolution before 2.8.0-pl allowed path traversal in the code path that sends registry messages (#15134). Unlikely exploit target beyond annoyance, requiring manager permissions.

    Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.

  • MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files....

    HIGH
    Type
    Directory Traversal
    Fixed in
    MODX 2.6.5-pl
    Since
    Exact version not known
    Disclosed
    July 13, 2018

    MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class.php that can result in remove files. This attack appear to be exploitable via web request via security/login processor. This vulnerability appears to have been fixed in pull 13980.

    Remediation: Upgrade MODX Revolution to 2.6.5-pl or newer.

  • MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that c...

    HIGH
    Type
    Access Control
    Fixed in
    MODX 2.6.5-pl
    Since
    Exact version not known
    Disclosed
    July 13, 2018

    MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.

    Remediation: Upgrade MODX Revolution to 2.6.5-pl or newer.

  • MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user...

    HIGH
    Type
    SQL Injection
    Fixed in
    MODX 2.5.7-pl
    Since
    Exact version not known
    Disclosed
    July 17, 2017

    MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges.

    Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.

  • In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.

    HIGH
    Type
    Security
    Fixed in
    MODX 2.5.7-pl
    Since
    Exact version not known
    Disclosed
    May 18, 2017

    In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.

    Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.

  • In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient val...

    HIGH
    Type
    Directory Traversal
    Fixed in
    MODX 2.5.7-pl
    Since
    Exact version not known
    Disclosed
    May 18, 2017

    In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.

    Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.

  • MODX Revolution LFI protections on Windows (#13428)

    HIGH
    Type
    Directory Traversal
    Fixed in
    MODX 2.5.7-pl
    Since
    Exact version not known
    Disclosed
    April 20, 2017

    MODX Revolution 2.5.7-pl fixes local file inclusion preventions to Windows hosts (#13428).

    Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.

  • The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows ...

    HIGH
    Type
    Security
    Fixed in
    MODX 2.5.5-pl
    Since
    Exact version not known
    Disclosed
    March 30, 2017

    The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate.

    Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.

  • The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-mid...

    HIGH
    Type
    Security
    Fixed in
    MODX 2.5.5-pl
    Since
    Exact version not known
    Disclosed
    March 30, 2017

    The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code by leveraging the lack of the HTTPS protection mechanism.

    Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.

  • MODX Revolution missing processor permission checks (#13174)

    MEDIUM
    Type
    Access Control
    Fixed in
    MODX 2.5.3-pl
    Since
    Exact version not known
    Disclosed
    January 3, 2017

    MODX Revolution before 2.5.3-pl various missing permission checks to processors (#13174), allowing users to access elements or perform actions they shouldn't have access to while still requiring admin access. By itself, fairly harmless, but could compound with other vulnerabilities.

    Remediation: Upgrade MODX Revolution to 2.5.3-pl or newer.

  • Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulatio...

    HIGH
    Type
    Directory Traversal
    Fixed in
    MODX 2.5.2-pl
    Since
    Exact version not known
    Disclosed
    December 24, 2016

    Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles.

    Remediation: Upgrade MODX Revolution to 2.5.2-pl or newer.

  • MODX Revolution path traversal in modConnectorResponse action param (#13173)

    MEDIUM
    Type
    Directory Traversal
    Fixed in
    MODX 2.5.2-pl
    Since
    Exact version not known
    Disclosed
    November 14, 2016

    MODX Revolution before 2.5.2-pl allowed path traversal via the action parameter in modConnectorResponse (#13173), which could let users reach processors outside the intended location.

    Remediation: Upgrade MODX Revolution to 2.5.2-pl or newer.

  • MODX Revolution SQL injection fix (changelog #13052)

    MEDIUM
    Type
    SQL Injection
    Fixed in
    MODX 2.5.1-pl
    Since
    Exact version not known
    Disclosed
    July 21, 2016

    MODX Revolution 2.5.1-pl fixed an SQL injection issue in the resource/getNodes processor, requiring admin access to exploit. [#13052]

    Remediation: Upgrade MODX Revolution to 2.5.1-pl or newer.

  • Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPS...

    HIGH
    Type
    SQL Injection
    Fixed in
    MODX 2.3.1-pl
    Since
    Exact version not known
    Disclosed
    April 24, 2014

    Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) session ID (PHPSESSID) to index.php or remote authenticated users to execute arbitrary SQL commands via the (2) user parameter to connectors/security/message.php or (3) id parameter to manager/index.php.

    Remediation: Upgrade MODX Revolution to 2.3.1-pl or newer.

  • SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecifie...

    HIGH
    Type
    SQL Injection
    Fixed in
    MODX 2.3.0-pl
    Since
    Exact version not known
    Disclosed
    March 11, 2014

    SQL injection vulnerability in modx.class.php in MODX Revolution 2.0.0 before 2.2.13 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.

  • MODX Revolution class-loading LFI in registerLogging (changelog #10043)

    HIGH
    Type
    Directory Traversal
    Fixed in
    MODX 2.2.9-pl
    Since
    Exact version not known
    Disclosed
    August 28, 2013

    MODX Revolution 2.2.9-pl fixed class-loading local file inclusion in registerLogging (#10043).

    Remediation: Upgrade MODX Revolution to 2.2.9-pl or newer.

  • MODX Revolution SQL injection in modImport (changelog #10070)

    HIGH
    Type
    SQL Injection
    Fixed in
    MODX 2.2.9-pl
    Since
    Exact version not known
    Disclosed
    August 28, 2013

    MODX Revolution 2.2.9-pl addressed a potential SQL injection vulnerability in modImport (#10070).

    Remediation: Upgrade MODX Revolution to 2.2.9-pl or newer.

  • MODX Revolution MODx.config XSSI hardening (#15644)

    MEDIUM
    Type
    Security
    Fixed in
    MODX 2.8.2-pl
    Since
    Exact version not known
    Disclosed
    October 27, 2021

    MODX Revolution 2.8.2 requires an auth token to access MODx.config to prevent cross-site script inclusion (XSSI) (#15644). This flaw allowed attackers to load the MODx.config data if users were logged in to the manager, without requiring access to the session token, potentially leaking configuration paths or information. MODx.config was already filtering passwords and known-sensitive information.

    Remediation: Upgrade MODX Revolution to 2.8.2 or newer.

  • MODX Revolution reflected XSS vulnerabilities (#15720)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.8.3-pl
    Since
    Exact version not known
    Disclosed
    May 28, 2021

    MODX Revolution 2.8.3-pl fixes a number of reported reflected XSS vulnerabilities in the manager, requiring manager permissions.

    Remediation: Upgrade MODX Revolution to 2.8.3-pl or newer.

  • MODX Revolution XSS in resource list template variable (changelog #15280)

    LOW
    Type
    XSS
    Fixed in
    MODX 2.8.1-pl
    Since
    Exact version not known
    Disclosed
    October 22, 2020

    MODX Revolution before 2.8.1-pl had cross-site scripting issues in the resource list template variable UI, requiring permission to edit resource groups to exploit.

    Remediation: Upgrade MODX Revolution to 2.8.1-pl or newer.

  • MODX Revolution stored XSS in the manager (changelog #15273)

    LOW
    Type
    XSS
    Fixed in
    MODX 2.8.0-pl
    Since
    Exact version not known
    Disclosed
    October 6, 2020

    MODX Revolution before 2.8.0-pl had multiple stored cross-site scripting (XSS) issues in the manager interface. Low level risk due to requiring manager access with permission to edit resources or upload files. Resource group name, media browser file names, resource pagetitle, resource oveview.

    Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.

  • MODX Revolution XSS in file upload and file tree (#15262)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.8.0-pl
    Since
    Exact version not known
    Disclosed
    October 6, 2020

    MODX Revolution before 2.8.0-pl was vulnerable to cross-site scripting (XSS) via the file upload flow (reflected self-xss) and file tree in the manager (stored XSS) requiring manager access.

    Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.

  • MODX Revolution XSS in TV template access grid (changelog #15142)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.8.0-pl
    Since
    Exact version not known
    Disclosed
    October 6, 2020

    MODX Revolution before 2.8.0-pl had an XSS issue involving template names shown in the template variable template access grid.

    Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.

  • MODX Revolution XSS via template name (changelog #15137)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.8.0-pl
    Since
    Exact version not known
    Disclosed
    October 6, 2020

    MODX Revolution before 2.8.0-pl did not properly neutralize template names in the manager, allowing stored or reflected XSS in some views.

    Remediation: Upgrade MODX Revolution to 2.8.0-pl or newer.

  • MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, o...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.7.1-pl
    Since
    Exact version not known
    Disclosed
    February 6, 2019

    MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle), which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs.

    Remediation: Upgrade MODX Revolution to 2.7.1-pl or newer.

  • MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.7.1-pl
    Since
    Exact version not known
    Disclosed
    February 6, 2019

    MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.

    Remediation: Upgrade MODX Revolution to 2.7.1-pl or newer.

  • MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.7.1-pl
    Since
    Exact version not known
    Disclosed
    February 6, 2019

    MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.

    Remediation: Upgrade MODX Revolution to 2.7.1-pl or newer.

  • MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.7.1-pl
    Since
    Exact version not known
    Disclosed
    February 6, 2019

    MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.

    Remediation: Upgrade MODX Revolution to 2.7.1-pl or newer.

  • MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.7.0-pl
    Since
    Exact version not known
    Disclosed
    September 26, 2018

    MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.

    Remediation: Upgrade MODX Revolution to 2.7.0-pl or newer.

  • MODX Revolution 2.6.3 has XSS.

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.6.4-pl
    Since
    Exact version not known
    Disclosed
    June 1, 2018

    MODX Revolution 2.6.3 has XSS.

    Remediation: Upgrade MODX Revolution to 2.6.4-pl or newer.

  • A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permiss...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.5.7-pl
    Since
    Exact version not known
    Disclosed
    November 17, 2017

    A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated user with permissions to edit users can save malicious JavaScript as a User Group name and potentially take control over victims' accounts. This can lead to an escalation of privileges providing complete administrative control over the CMS.

    Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.

  • In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.p...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.6.0-pl
    Since
    Exact version not known
    Disclosed
    July 30, 2017

    In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module.

    Remediation: Upgrade MODX Revolution to 2.6.0-pl or newer.

  • In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to co...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.5.7-pl
    Since
    Exact version not known
    Disclosed
    May 18, 2017

    In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.

    Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.

  • In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.5.7-pl
    Since
    Exact version not known
    Disclosed
    May 18, 2017

    In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.

    Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.

  • In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable ...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.5.7-pl
    Since
    Exact version not known
    Disclosed
    May 18, 2017

    In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.

    Remediation: Upgrade MODX Revolution to 2.5.7-pl or newer.

  • Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to ...

    MEDIUM
    Type
    Directory Traversal
    Fixed in
    MODX 2.6.0-pl
    Since
    Exact version not known
    Disclosed
    April 25, 2017

    Directory traversal in setup/processors/url_search.php (aka the search page of an unused processor) in MODX Revolution 2.5.7 might allow remote attackers to obtain system directory information.

    Remediation: Upgrade MODX Revolution to 2.6.0-pl or newer.

  • setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to c...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.5.5-pl
    Since
    Exact version not known
    Disclosed
    March 30, 2017

    setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service (cookie quota exhaustion), or conduct HTTP Response Splitting attacks with resultant XSS, via an invalid parameter value.

    Remediation: Upgrade MODX Revolution to 2.5.5-pl or newer.

  • MODX Revolution XSS in template description (#13290)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.5.6-pl
    Since
    Exact version not known
    Disclosed
    March 28, 2017

    MODX Revolution 2.5.6-pl fixes missing HTML encoding in template descriptions to prevent potential XSS (#13290). XSS affecting users with the ability to edit templates in the manager.

    Remediation: Upgrade MODX Revolution to 2.5.6-pl or newer.

  • MODX Revolution reflected XSS in connector JSONP (changelog #13051)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.5.1-pl
    Since
    Exact version not known
    Disclosed
    July 21, 2016

    MODX Revolution before 2.5.1-pl allowed reflected cross-site scripting via the connector JSONP support.

    Remediation: Upgrade MODX Revolution to 2.5.1-pl or newer.

  • MODX Revolution XSS in file create/update processors (changelog #12513)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.4.0-pl
    Since
    Exact version not known
    Disclosed
    August 18, 2015

    XSS in file create/update processors.

    Remediation: Upgrade MODX Revolution to 2.4.0-pl or newer.

  • Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbi...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.3.3-pl
    Since
    Exact version not known
    Disclosed
    December 22, 2014

    Cross-site scripting (XSS) vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter.

    Remediation: Upgrade MODX Revolution to 2.3.3-pl or newer.

  • MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attacker...

    MEDIUM
    Type
    Security
    Fixed in
    MODX 2.3.0-pl
    Since
    Exact version not known
    Disclosed
    December 3, 2014

    MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

    Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.

  • Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or ...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.3.0-pl
    Since
    Exact version not known
    Disclosed
    December 3, 2014

    Cross-site scripting (XSS) vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the context_key parameter.

    Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.

  • MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token...

    MEDIUM
    Type
    CSRF
    Fixed in
    MODX 2.3.0-pl
    Since
    Exact version not known
    Disclosed
    December 3, 2014

    MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism by (1) omitting the CSRF token or via a (2) long string in the CSRF token parameter.

    Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.

  • Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject ar...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.3.2-pl
    Since
    Exact version not known
    Disclosed
    November 6, 2014

    Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression.

    Remediation: Upgrade MODX Revolution to 2.3.2-pl or newer.

  • Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary...

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.3.0-pl
    Since
    Exact version not known
    Disclosed
    March 1, 2014

    Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter.

    Remediation: Upgrade MODX Revolution to 2.3.0-pl or newer.

  • MODX Revolution XSS in user messaging (changelog #6937)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.2.9-pl
    Since
    Exact version not known
    Disclosed
    August 28, 2013

    MODX Revolution 2.2.9-pl fixed persistent and reflected cross-site scripting in user messaging (#6937).

    Remediation: Upgrade MODX Revolution to 2.2.9-pl or newer.

  • MODX Revolution modX::stripTags script execution (changelog #9080)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.2.6-pl
    Since
    Exact version not known
    Disclosed
    December 3, 2012

    MODX Revolution 2.2.6-pl fixed a modX::stripTags() bug that could allow script execution (#9080). Output filtering bypass / inadequate sanitization.

    Remediation: Upgrade MODX Revolution to 2.2.6-pl or newer.

  • Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is...

    MEDIUM
    Type
    Directory Traversal
    Fixed in
    MODX 2.0.3-pl
    Since
    Exact version not known
    Disclosed
    October 7, 2012

    Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter. NOTE: some of these details are obtained from third party information.

    Remediation: Upgrade MODX Revolution to 2.0.3-pl or newer.

  • MODX Revolution manager login XSS (changelog #2918)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.0.5-pl
    Since
    Exact version not known
    Disclosed
    December 8, 2010

    MODX Revolution before 2.0.5-pl fixed an XSS vulnerability in the manager login that allowed JavaScript injection ([#2918] per 2.0.5-pl changelog). Compare with CVE-2014-2311 and other early login XSS disclosures.

    Remediation: Upgrade MODX Revolution to 2.0.5-pl or newer.

  • MODX Revolution manager XSS stripping (MODX-2210)

    MEDIUM
    Type
    XSS
    Fixed in
    MODX 2.0.1-pl
    Since
    Exact version not known
    Disclosed
    September 16, 2010

    MODX Revolution 2.0.1-pl added XSS stripping for a manager variable ([#MODX-2210] per 2.0.1-pl changelog).

    Remediation: Upgrade MODX Revolution to 2.0.1-pl or newer.

  • Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via ...

    LOW
    Type
    XSS
    Fixed in
    MODX 2.0.3-pl
    Since
    Exact version not known
    Disclosed
    October 7, 2011

    Cross-site scripting (XSS) vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter.

    Remediation: Upgrade MODX Revolution to 2.0.3-pl or newer.

Changelog

  • Fixed issue with cacheable toggle on derivative Resource pages
  • Fix error message when reading expired messages in modDBRegister.
  • Fixed issue with login page JS
  • Fixed issue with derivative Resource classes JS not loading Page Settings data into submit
  • Fixed issue with utilities JS not loading at right time
  • Updated build.xml to produce beta releases.
  • Quick fix to prevent blank attribute referencing
  • Fixed issue with package attributes and skipping blank options
  • [#MODX-723] Fixed issue where preview pane was picking up CSS from preview
  • Updated xPDO to revision 333.
  • Fix issues with Page settings defaulting to 1 on resource creation
  • Adjusted order of JS utils loading to make for easier min-concat loading
  • Cleanups to JS to prepare for beta-1
  • Lexicon updates
  • Updating outdated copyright notices in source code headers.
  • Fixed hardcoded version number in setup.
  • Added request_controller system setting to indicate the front-controller file (default=index.php).
  • Fixed array_merge warnings in modLexicon.
  • Added back support for anonymous user access control.
  • Added support for returnUrl parameter to be sent to login processor to allow unauthorized responses to return to the original requested page directly (NOTE: this overrides manager_login_startup and login_startup parameters, but does not work with POST requests: these will simply return to the URL with only GET parameters).
  • Export lexicon now prompts for download of exported file
  • Enhanced User Group update/create screen to now have grids that allow you to assign Resource Group / Context permissions to that user group. This will help clear up confusion with the access relationships.
  • Fixed scope issue in accordion.css that was causing odd behaviours with panels in the main content
  • Adjusted setup procedures to allow for more lexicon support for pre-load checks
  • Adjusted setup lexicon to allow for multiple topics; conformed upgrade scripts and other references to match
  • Consolidated similar code in setup, esp. with regards to fatal errors
  • Added smarter checks for xPDO failures in connectors
  • [#MODX-744] Fixed issue with invalid display of num cleared on cache claering
  • Fixed bugs with updating packages from a remote provider
  • Made sure package attr returns '' if false
  • Fixed manager log to show username, not user ID
  • Standardized derivative resource form panels to move page settings to left
  • Tweaked tree menu headers
  • Minor IE overrides for top navigation and accordion panel.
  • Added support for modLinkTag properties as url parameters, with context reserved to indicate a context to send to makeUrl().
  • Fixed error in modLinkTag when passed invalid data.
  • Added '@RESOURCE' binding alias so as to deprecate @DOCUMENT binding
  • Fixed default language setting for modLexicon
  • Fixed a couple issues with the page settings checkboxes for resources
  • Removed deprecated _tx_.gif
  • Removed home icon and replaced with tab
  • Adjusted CSS to align main content page vertically
  • Trees now have fun new icons representing their types (this includes the resource, element and file trees)
  • Cleaned up the default.inc.php lexicon topic to remove any no-longer-used entries
  • Fixing typo in subtract output modifier
  • Fixed improper reference in TV property renders for mgr context
  • Updated xPDO to revision 329.
  • Improvements to sendError() behavior.
  • Added lock stealing processor and updated remove_locks processor.
  • Added steal_lock:true policy attribute to default Resource policy to allow lock stealing permissions by ResourceGroup.
  • modTemplateVar: Fix getValue() on `value` field by storing and verifying the value requested is cached by the same resource.
  • modResource: Add resourceId value to getMany() on modTemplateVar to identify the resource caching a value on the modTemplateVar instance.
  • modX: Set logTarget based on XPDO_CLI_MODE; ECHO for CLI and HTML for non-CLI requests.
  • modX: Add sendError() function to provide customizable, named error pages on FATAL or other critical error situations.
  • modX: Refactored sendForward(), sendErrorPage(), sendUnauthorizedPage() functions to allow an array of options and better handle FATAL errors.
  • modCacheManager now Caches related modContentType data to prevent unnecessary database connection/query on fully cached pages.
  • Fixed problem with modStaticResource truncating the content to the size of the static file by setting the content length header on non-binary content types.
  • Fixed problem with modStaticResource non-binary content types rendering the path to the static file rather than the actual content of the file.
  • Calling modX->log(MODX_LOG_LEVEL_FATAL) or modX->messageQuit() now logs the error to file and then renders {MODX_CORE_PATH}errors/fatal.include.php.
  • Updated to r325 in xPDO: xPDO method changes to getOption() and _log().
  • Update 'setup-options' ability in transport packages to allow for script-based setup options that will properly handle upgrades to setup options default values
  • Updated to r323 in xPDO: Revise xPDOTransport::writeManifest to make 'setup-options' be able to be an executable script to allow for dynamic form ability
  • Updated snoopy class to version 1.2.4 (used by magpierss).
  • [#MODX-535] Removed automatic setting of isfolder based on presence or absence of children.
  • [#MODX-499] Site start Resources now return base_url from modContext->makeUrl() if no scheme is specified (i.e. when expecting relative links).
  • Improved error reporting on modX->makeUrl() to show original $id value being passed in on failures.
  • modLinkTag no longer returns empty values on first pass of parser, allowing delays until the value returns a valid value.
  • Implemented modResource editor locking (added modResource methods: getLock(), addLock($user), removeLock($user)).
  • Implemented modResource locking features in all appropriate processors.
  • modResource->checkChildren() now uses modX->getCount() to determine if children exist.
  • Added steal_locks attribute to Context access policy.
  • [#MODX-728] Made sure config check dialog is hidden if no warnings are present
  • Package Installations will now skip license agreements / readme panels if none are specified
  • Made sure More Info in download panel can scroll
  • Fixed issue with spacing in setup options panel of package install
  • modCacheManager->generateScript(): Fixed PHP notice in log message on error.
  • modInstall: Modify _modx() function to call setDebug with E_ALL & ~E_NOTICE instead of E_ALL & ~E_STRICT.
  • Optimized queries in element tree to eliminate subqueries or queries in loop, reducing to O(n) instead of O(n^2n)
  • Made clear cache results a bit smaller
  • Refresh trees after clear cache
  • [#MODX-609] Clear cache menu item now loads results in an alert dialog. No longer loads a separate page.
  • Fixed to template getlist processor
  • [#MODX-671] Fixed bug with resource group access permissions being checked when not assigned
  • [#MODX-699] Fixed to allow usage of login processor without lexicons
  • Added Import/Export to element properties grids, which allows for file-based transporting of properties.
  • Fixed issues with comboboxes dropping down a blue screen
  • [#XPDO-28] Fixed problem with multiple file resolvers on vehicles with similar basenames cause directory contents to merge unexpectedly.
  • fixed PHP notice for missing elementType variable
  • fixed subcategory elements missing from display (was counting elements in parent category rather then subcategory to determine if the subcategory should be displayed)
  • Fixed issue with default properties in TVs being locked
  • Fixed no onTVFormPrerender
  • Made sure clearDirty is fired on TV panels
  • Tweaked the css and updated copyright year.
  • Refactored all index.php gateways to support constructor options set as $options in the various config.core.php files.
  • modCacheManager/modCache: Introduced cache partitioning allowing various cache provider implementations to target specific MODx cache partitions and provide custom (system/context/user) settings for configuration options to each: cache_system_settings, cache_context_settings, cache_resource, cache_scripts, cache_lexicon_topics, cache_action_map
  • modAccessibleObject: Refactored object and collection loader logic to improve cache hit rates.
  • modRequest: Fixed warning for undefined variable $fromCache.
  • modSessionHandler: Refactored write() method to only update access time when the session data has changed or at specified intervals before the data is made available for GC.
  • modSessionHandler: Added support for cache_db_session, a new configuration setting to allow session data to be cached when cache_db is enabled.
  • modTemplateVar: Allow getValue() to use a `value` field for data if already populated for a specific resource.
  • Commented out missing image in welcome.tpl (temporary)
  • Added couple of bugfixes to modDBRegister to prevent duplicate payloads and update existing messages.
  • Fixed bug where QuickUpdateChunk was persisting values
  • Added fix to prevent DOM id problems
  • Added clearCache checkbox to chunk editing to allow toggleable cache clearing
  • Optimized chunk processors
  • Added 'Quick Update Chunk' and 'Quick Create Chunk' options to Elements tree, which allows you to quickly edit or create chunks via a window straight from the Element tree on any page
  • [#MODX-718] Fixed bug where elements without a category wouldn't show
  • [#MODX-697] Fixed problem with deprecated role topic still in action build scripts
  • [#MODX-705] Removed random numbers causing Radio TVs to render improperly
  • Fixed bug that caused policy data to be erased when creating/saving/removing policy data
  • [#MODX-711] Fixed Update Context screen to properly pass correct PK
  • modDbRegister: fixed bug with expired messages not being removed if remove_read => false
  • modDbRegister: allowed messages to be updated/overwritten
  • Fixed modCacheManager::prepare() - was returning false on already-prepared contexts
  • Added support for nested categories for elements; categories can now have subcategories
  • Fixed to treestate to properly set treestate ID so restore can work properly
  • Fixed call to onDocFormRender to make sure ID is passed on Resource update
  • Fixed to getFiles processor for MODx.Browser to properly store URL parameter with the base_url prefixed
  • [#MODX-712] Fixed errors creating context settings
  • modX: Fixed potential error when invokeEvent() is called and executes a plugin with property sets and pluginCache does not contain the object
  • modCacheManager: Fixed error when building the pluginCache with property sets
  • modCacheManager: Fixed typo in parentSql that was breaking use alias paths option.
  • modCacheManager->generateContext(): Added support for Resources to be generated in multiple contexts via modContextResource.
  • modParser: Removed errant log() statement in parseProperties().
  • modParser: Fixed problem in parsePropertyString() when passing `escaped` property values containing semi-colons (;).
  • Added in necessary reloading functions to ColumnTree
  • Fixed issue with column tree's context menu overriding the ID
  • modManagerResponse: Detect if controller responses are error arrays and render using error.tpl appropriately.
  • [#MODX-693] redirect bug - modResponse logic error
  • Moved core/config/version.inc.php to core/docs/version.inc.php
  • layout/tree/resource/getnodes.php: Additional optimization to reduce memory usage and improve performance when opening Resources containing a large number of children.
  • modConnectorResponse->toJSON() optimized to greatly reduce memory usage and improve performance with large result sets.
  • [#MODX-691] allow User Settings to be saved from prop. grid
  • Fixed bug with documentMap
  • Fixed issue with default tv render panel for resource page
  • [#MODX-690] Fixed a few events names registered in the system_eventsnames table during build/install
  • Added id's to element and category nodes for informational purposes (missed one spot).
  • Added id's to element and category nodes for informational purposes.
  • Updated drag and drop behavior to update context_key of all child Resources when dropping a container on a different context node.
  • Modified modTransportPackage.manifest field from MEDIUMTEXT to TEXT in order to handle large manifests.
  • Fixed aliasMap broken in recent cacheManager refactoring.
  • Added helper functions to MODx.tree.ColumnTree
  • Added DD events to ColumnTree
  • Added missing column tree CSS
  • Added UI for adding property sets to PluginEvents
  • Added cacheManager object checks to verify for PHP4 installs
  • modCacheManager->generateResource(): added validation of the modResource primary key before attempting to cache a record.
  • modUser: modified storage of session data to use the modUser primary key value to isolate values associated with a specific user; this will allow users to login as multiple users on the back-end and/or front-end without affecting the session data associated with a specific user.
  • modX->_initSession(): Enable session_gc_lifetime configuration setting to set session.gc_liftime ini setting regardless of what session handler is configured.
  • modPluginEvent: Added the ability of plugins to utilize Property Sets by allowing a plugin registered to a particular event to attach a Property Set and make it available during processing.
  • Fixed warning with loading of RTEs in resource page
  • [#MODX-674] Fixed content-dispo combobox bug
  • Removed allowBlank: false check on menuindex to allow for dynamic creation
  • Added in missing lexicon entries for prior menuindex commit
  • [#MODX-678] Added back in 'menuindex' field to resource panels
  • Added missing modX::__construct() options parameter.
  • Allow for extending of MODx.panel.ResourceTV by making reference to modx-resource-template field dynamic
  • Fixes for RTE loading
  • Fixed issue where smarty template path was not being reset if 3PC set path to something else
  • modX constructor now accepts a second parameter containing an array of options to be set in the config
  • Major refactoring of modCacheManager to provide more granular caching options
  • modCacheManager now accepts options, based on changes to xPDOCacheManager, and provides access via getOption()
  • generate*() methods now all return data as well as cache it to a specified cache_handler unless otherwise configured
  • modX->getCacheManager() no longer supports MODX_CACHE_DISABLED or config['cache_disabled']; the cacheManager is required, though you will still be able to effectively turn off all caching in the future via this setting (this will be worked back in)
  • manager/controllers/system/refresh_site.php changes to better target things to remove from the cache
  • Introducing modDbRegister and the modx.registry.db package, providing a database modRegister implementation.
  • Added new system settings for individual cache areas, i.e. cache_system_settings, cache_context_settings, cache_lexicon_topics, cache_scripts, etc.
  • modCacheManager: Various fixes and adjustments to latest refactoring, including clearCache improvements.
  • manager/controllers/system/refresh_site.php: Improvements to default clearCache call.
  • modCacheManager: converted generateActionMap() to support configurable cache implementations
  • Updated modAction->rebuildCache() and modManagerRequest->loadActionMap()
  • Additional tweaks to manager/controllers/system/refresh_site.php
  • Updated xPDO externals to revision 308
  • Removed unnecessary comments from the reg* functions
  • Moved all manager pages JS/CSS to inside HEAD tag using the reg* functions; this improves speed and validation of the manager
  • Fixed the way 3PCs handle their controller files. NOTE!!! This means that you no longer need a "core/controllers" file in your 3PC; just set the namespace path correctly, then set the controller in your modAction.
  • Added an ability for mgr pages to utilize regClientStartupScript and other reg* functions to make pages load faster and move JS/CSS to HEAD tag
  • modX->getEventMap() - Made sure prepare() creates a valid statement before calling execute()
  • Updated modStaticResource to set headers in getFileContent() for now, though this needs to be refactored for flexibility.
  • Fixed issue with saving TVs from create resource processor
  • [#MODX-637] Fixed issue with TVs not reloading on changing template in new resources
  • [#MODX-663] Fixed various issues with modAction creation
  • Fixed issue with MODx.Browser uploads not refreshing the main view
  • Fixed publishedon default date setting
  • Fixed date TV default value
  • Fixed default setting for symlinks
  • Fixed issue with Symlink/WebLink class_key storing
  • Fixed issue with textfield editing in Safari on Property Set grid
  • [#MODX-662] Fixed duplicate issue with elements
  • Fixed issue with property sets page and property lock
  • Fixed name issue on duplicating elements
  • Fixed symlink page setTimeout issue
  • Fixed missing file inclusions
  • Fixed element tree where categorized templates weren't showing
  • Added editing ability to resource's publishedon date
  • Fixes to package downloader panel due to ID conflicts
  • Adjusted modTransportPackage::transferPackage to rename incoming file to [signature].transport.zip rather than basename($source)
  • Fixed xml/json response classes to properly work
  • Added permission "unlock_element_properties", which gives ability to unlock editing of default element properties.
  • Added implementation of above permission into element properties grid
  • Fixed some logic issues with the lockMask
  • [#MODX-561] Added "Locked" ability to default properties for elements
  • [#MODX-633] Fixed issue with add another not respecting parent
  • Fixed TV access panel not working on new TVs
  • Fixed state management with tree nodes
  • [#MODX-661] Fixed URL TV input, where it was not setting prefix value
  • [#MODX-659] Fixed bug where root-level docs couldnt be updated b/c of parent issue
  • Fixed bug with parent being assigned to 0 always in derivative Resource classes
  • Made sure bad resources (where parent = id) are ignored when building the context cache files.
  • Fixed parent bug in controllers
  • Fixed transport.data.php with 'namespace' key on modActions
  • [#MODX-622] Updated top menu structure to be more consistent.
  • Fixed error if properties are null
  • [#MODX-651] Fixed bug when deleting a propset, would not empty grid
  • Fixed to resource page combos not setting display value correctly
  • [#MODX-658] Fixed issue where in TV -> Create, templates were not showing
  • Fixed template nodes to properly sort by templatename
  • Adjusted resource menus and such to refer to a 'Resource' without a specific class_key as 'Document' when applicable, with the exception of talking about Resources in the generic sense
  • Added Duplicate option to Property Sets
  • Fixed bug where template inheritance for resources wasn't happening
  • Fixed symlink page
  • [#MODX-632] Updating xmlrpc to 2.2.1
  • Corrected logic in setup to allow forced PDO emulation mode (XPDO_MODE == 2).
  • Added `category` field to modPropertySets; they can now be categorized
  • Enhanced UI to support new modPropertySet category ability
  • Modified MODx.Window so that the ENTER key submits the form
  • Added more IDs to element forms
  • Added ability to "remove" overridden properties, but only ones that are not in the default propset (ones that are should "revert")
  • Fixed OnWebPagePrerender event not firing as expected.
  • modOutputFilter: Refactored date modifier to return '' if the timestamp encountered == 0 or -1.
  • modOutputFilter: Added strtotime modifier.- Refactored connectors to execute in the context from which they are called, rather than their own context.
  • Updated xPDO to revision 304 for new xPDOFileVehicle feature to respect XPDO_TRANSPORT_RESOLVE_FILES options.
  • [#MODX-562], [#XPDO-24], [#XPDO-25], and [#XPDO-26] Updated xPDO to revision 302 to resolve various issues regarding transport packages and model generation.
  • [#XPDO-23] and [#MODX-604] Updated xPDO to revision 298 to resolve nesting error when logging messages during installation with improper cache directory permissions.
  • Added modPropertySet->getElements() method as shortcut to get all proper modElement instances available to the set.
  • Added overridden modElementPropertySet->getOne() to get related Element using the proper element_class value.
  • [#XPDO-21] Updated xPDO to revision 290 for updates to xPDOObject::addOne() and addMany().
  • [#MODX-553] Unpublished and deleted Resources now ignored properly in modRequest::getResource().
  • [#MODX-553] Core setup now automatically adds an ACL to the web context for members of the Administrator group.
  • Core setup now updates the Administrator group ACLs for accessing the mgr and connector contexts with an Authority of 0 (highest authority).
  • Modified OnUserNotFound event handling not to rely on references which no longer work properly with recent changes to property handling.
  • Added overridden modElement->get() to handle converting legacy property strings stored in the database.
  • Added modPropertySet class to represent persistent sets of properties that can be applied to modElement instances.
  • Added support for modElements to relate modPropertySet objects via modElementPropertySet (many-to-many).

At a glance

  • Released May 28, 2009 (17 years ago)
  • Major track MODX 2.x
  • % of sites 0% (0 sites)
  • Previous release MODX 2.0.0-alpha-6 (17 years ago)
  • Newer release MODX 2.0.0-beta-2 (17 years ago)