This release brings stability improvements and refinements that enhance your content management workflow. From mobile-friendly manager updates to enhanced Template Variable rendering, improved security features to PHP 8.5 compatibility, version 3.2 represents our ongoing commitment to refining and polishing the MODX platform.

Important: This release requires PHP 8.1 or higher. Please verify your server meets this requirement before upgrading.

• Read the Complete Release Announcement
• Download Revolution 3.2.0
• Create a Revo 3.2.0 Cloud

2 posts - 1 participant

Read full topic

Revo 3.1.1 brings a fresh collection of improvements to enhance system stability and user experience, and represents our ongoing commitment to refining and polishing the MODX platform.

• Read the Complete Release Announcement
• Download Revolution 3.1.1
• Create a Revo 3.1.1 Cloud

modAi also debuted this week, representing MODX’s foray into the brave new world of generative AI. What began as a simple proof of concept rapidly went through a “bit” of feature creep and turned into something truly powerful, useful, and—in the long history of all things MODX—highly configurable: modAI 0.9.0-beta | MODX

TL;DR: modAI supports mixing and matching models (Claude, ChatGPT, Gemini, and custom AI gateways like Open WebUI), attaches to any text/textarea/image field in the Manager, and can have canned or freeform prompts to help you generate text, images, and alt tags faster than ever before. It also works with Image+ and SEO Suite, so you can finally nail crucial SEO content faster than ever before. All you need is an API key and a few good prompts.

If you have yet to explore MODX Revolution 3.x, then these two releases are an awesome place to start.

2 posts - 1 participant

Read full topic

It brings a fresh collection of improvements to enhance system stability and user experience. From resolving the upgrade version display in the Manager to fixing thumbnail challenges with complex filenames, PHP 8.4 compatibility to updated Lexicons, version 3.0.6 represents our ongoing commitment to refining and polishing the MODX platform.

• Read the Complete Release Announcement
• Download Revolution 3.0.6
• Create a Revo 3.0.6 Cloud

2 posts - 1 participant

Read full topic

• Project: Login Extra
• CVE ID: CVE-2024-55039 (pending)
• Affected Versions: 1.5.2 through 1.9.13
• Fixed Version: 1.9.14
• Release Date: 2024-11-22
• Severity: Critical
• CVSS v4.0 Score: 9.4
• CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Details

Type

Remote Code Execution (RCE) via PHP Object Injection

Description

A critical vulnerability has been identified in the MODX Login Extra that allows arbitrary PHP code execution through PHP Object Injection. The vulnerability stems from unsafe deserialization of user-supplied data using PHP’s unserialize() function without proper sanitization.

Attack Vector

An authenticated user, regardless of their permission level, can exploit this vulnerability by submitting specially crafted data through the Login form. The vulnerability can be triggered when:

1. The system processes user input through the Login form
2. The malicious payload is passed to the unsafe unserialize() function
3. The resulting PHP object injection leads to arbitrary code execution

Affected Systems

The vulnerability affects MODX Revolution installations that meet ALL of the following criteria:

1. Have the Login Extra installed (versions 1.5.2 to 1.9.13)
2. Have a web-accessible login form using the Login Extra
3. Allow user authentication

Note: Systems with Registration forms using the Login Extra may be particularly vulnerable if user validation is not required.

Mitigation

Immediate Update Required: Upgrade Login Extra to version 1.9.14 or later using the MODX Extras Installer in your MODX Revolution Projects.

Technical Details

The vulnerability exists due to:

• Unsafe usage of PHP’s unserialize() function
• Lack of input validation before deserialization
• Insufficient permission checking in the login process

Credits

• Discovery: Drew Webber
• Resolution: Thomas Jakobi and John Peca
• Coordination: MODX Security Team

Timeline

• Discovery Date: 2024-11-22
• Fix Development: 2024-11-22
• Public Disclosure: 2024-11-22

References

• MODX Security Team Contact: Security Team
• Fixed Version Download: Login 1.9.14

Revision History

• 2024-11-22: Initial advisory publication

2 posts - 1 participant

Read full topic

If your site is running the 2.x version of of MODX Revolution, this should be considered a must-upgrade release—especially to ensure your site remains compatible with recent PHP releases.

• Read the Complete Release Announcement
• Download Revolution 2.8.8
• Create a Revo 2.8.8 Cloud

2 posts - 1 participant

Read full topic

This release includes some quality of life and user interface improvements for site managers and developers including a fix for the datepicker on Resources created in Revo 2.x, the addition of the displaying the username on the confirmation screen of a password change, as well as many more under-the-hood performance and operational improvements and fixes.

• Read the Complete Release Announcement
• Download Revolution 3.0.5
• Create a Revo 3.0.5 Cloud

1 post - 1 participant

Read full topic

If your site is running the 2.x version of of MODX Revolution, this should be considered a must-upgrade release—especially to ensure your site remains compatible with recent PHP releases.

• Read the Complete Release Announcement
• Download Revolution 2.8.7
• Create a Revo 2.8.7 Cloud

2 posts - 1 participant

Read full topic

This release improves user and developer experience, augments security, cleans up many legacy code issues, updates key dependencies used in MODX Revolution, and resolves numerous minor bugs.

• Read the Release Announcement
• Download MODX Revolution 3.0.4
• Create a Revo 3.0.4 Website in MODX Cloud

2 posts - 1 participant

Read full topic

If you’re a fan of safer websites, and fewer PHP errors and warnings with modern PHP, then this is a great release for you. It improves security, improves PHP 8.x compatibility, updates phpThumb and Smarty (key libraries used in MODX Revolution), and addresses various minor bug fixes.

• Read the Complete Release Announcement
• Download Revolution 2.8.6
• Create a Revo 2.8.6 Cloud

2 posts - 1 participant

Read full topic

• logins to the forum
• new user registrations
• submitting or editing Extras listings,
• changes to user profiles and passwords, and
• submitting Contributor License Agreements (CLA).

We’re taking these steps to modernize the back-end systems, to improve performance and functionality, and to allow adding new features to Extras and the broader community user management infrastructure.

This maintenance operation will not impact MODX Cloud or searching and downloading Extras in MODX installations.

The maintenance window is estimated to be no longer than 6 hours. If you’d like to follow the progress of and be notified of the completion, you may wish to subscribe to the scheduled maintenance notice on our Status Page.

6 posts - 2 participants

Read full topic

• new user registrations
• submitting or editing Extras listings,
• changes to user profiles and passwords, and
• submitting Contributor License Agreements (CLA).

We’re taking these steps to modernize the back-end systems, to improve performance and functionality, and to allow adding new features to Extras and the broader community user management infrastructure.

This maintenance operation will not impact MODX Cloud or searching and downloading Extras in MODX installations.

The maintenance window is estimated to be no longer than 6 hours. If you’d like to follow the progress of and be notified of the completion, you may wish to subscribe to the scheduled maintenance notice on our Status Page.

2 posts - 1 participant

Read full topic

• Read the Complete Release Announcement
• Download Revolution 2.8.5
• Create a Revo 2.8.5 Cloud

2 posts - 1 participant

Read full topic

An important reminder about upgrading to Revo 3: we strongly urge you to carefully read the upgrade guide before making the leap—there are many significant changes under the hood and a few of your favorite Extras may not yet be fully compatible. You should test upgrades on a clone of your site, first, when upgrading from our older 2.x branch.

Before upgrading from Revo 2.x to 3.0.3, please review the upgrade guide.

• Read the Complete Revo 3.0.3 Release Announcement
• Download Revo 3.0.3
• Create a new Revo 3.0.3 Cloud

2 posts - 1 participant

Read full topic

An important reminder about upgrading to Revo 3: we strongly urge you to carefully read the upgrade guide before making the leap—there are many significant changes under the hood and a few of your favorite Extras may not yet be fully compatible. You should test upgrades on a clone of your site, first, when upgrading from our older 2.x branch.

Before upgrading from Revo 2.x to 3.0.2, please review the upgrade guide.

• Read the Complete Revo 3.0.2 Release Announcement
• Download Revo 3.0.2
• Create a new Revo 3.0.2 Cloud

2 posts - 1 participant

Read full topic

https://tickets.modmore.com/video-tickets/

As an added bonus, we’re giving all in-person or online ticket purchasers 50% off a new MODX Cloud Base plan for a year, or for existing users, a free year of CDN/WAF for any site that doesn’t already have one … a savings of $180-240—so hurry and get your tickets while you can!

1 post - 1 participant

Read full topic

Revo 3.0.1

While our initial release of MODX Revolution 3.0 has proven to be one of our best releases ever, there were some areas that needed attention. With that in mind, our first patch release is here, just under a month after its initial debut.

Before upgrading from Revo 2.x to 3.0.1, please review the upgrade guide.

• Read the Complete Revo 3.0.1 Release Announcement
• Download Revo 3.0.1
• Create a new Revo 3.0.1 Cloud

Revo 2.8.4

This 2.8.4 release focuses on a few bugs, updates dependencies, and improves compatibility with newer versions of PHP. All users of the 2.8.3 and earlier should upgrade to this release if you are not ready to upgrade to MODX Revolution 3.0.1, just yet.

• Read the Complete Revo 2.8.4 Release Announcement
• Download Revo 2.8.4
• Create a new Revo 2.8.4 Cloud

Need Help Upgrading?

If you’re not sure how to upgrade but would like to get your site onto the latest version of MODX Revolution, check out the MODX Garage and Speed Shop to contact the MODX team for expert assistance. We can advise you of your options.

2 posts - 1 participant

Read full topic

MODX Revolution is a major update that delivers a new Manager with big UX improvements, modernizes the codebase by adopting modern coding practices including leveraging Composer and provides the foundation for the next innovations in the CMS space.

If you are a growing organization that wants the fastest, most secure, and most flexible platform for your online presence, then you need to look no further than MODX Revolution 3.0.

• Read the full release blog
• Learn about upgrading to MODX Revolution 3.0
• Download MODX Revolution 3.0

2 posts - 1 participant

Read full topic

Note: Sites that use rich text editors such as TinyMCE RTE, TinyMCE Wrapper, and similar will have issues with 2.8.2 related to the media browser. 2.8.3 provides resolution for these issues.

Highlights

You can get a full list of changes by reviewing the changelog, but below are some of the significant revisions in this release.

Security

• XSS issues reported by Solar Security (#15720)
• Adjust filtering of placeholders and accessible options for @SELECT (#15714)
• Pass auth token to Browser controller config (#15692)
• Update to PHPMailer 6.4.1 (#15693)

Other Changes

• Patch MagpieRSS for basic use in PHP 8 (#15721)
• Avoid setting headers for modStaticResource when returning content (#15715)
• Fix incorrect id format (#15709)
• Fix filesize() calculation for static resources (#15697)
• Return content from non-binary static resources (#15702)
• Fix PHP 8 compatibility with phpThumb (#15706)
• Fix PHP 8 warnings in modPhpThumb (#15705)
• Fix PHPMailer version display (#15704)
• PHP 8 compatibility (#15699)

Security is a Habit

Staying up-to-date with new releases is a good habit to keep your MODX-powered websites secure. The security issues addressed in this release are limited to users that have a valid login to access the MODX Manager. A couple of the issues allowed changes or access beyond limited Manager users’ permissions. As such we recommend you upgrade as soon as possible.

Special Notes on Upgrading to 2.8.3

Some of the security improvements in 2.8.3 will affect certain site configurations. Read about these changes and how to make any appropriate adjustments when upgrading to 2.8.3.

It Takes a Village…

The release would not be possible without the attention and effort of our community contributors including wfoojjaec, Jason Coward, Mark Hamstra, MODX Bot, Murray Wood, Ivan Bochkarev Ivan and many more.

Download MODX Revolution 2.8.3
Try it in MODX Cloud

2 posts - 1 participant

Read full topic

Note: Sites that use rich text editors such as TinyMCE RTE, TinyMCE Wrapper and similar will have issues with 2.8.2 related to the media browser. We’re integrating a fix and 2.8.3 will be available in the next week.

Highlights

You can get a full list of changes by reviewing the changelog, but below are some of the significant revisions in this release.

Security

• Prevent access to sensitive user data [#15678]
• Add permissions to enforce access to specific resource types [#15655]
• Flatten nested lexicon parameters by dot notation [#15490]
• Restrict static resources to predefined path [#15656]
• Prevent XSSI access to MODx.config by requiring auth token [#15644]

Other Changes

• PHP 8 Compatibility [#15335]
• Fix Plugin and Template name validation [#15349]
• Support SameSite attribute in session cookies [#15666]
• Fix bug with special chars in directory or file names [#15505]
• Update PHPMailer to 6.4.0 [#15618]
• Update xPDO to version 2.8.3-pl
• Update Smarty to 3.1.39 [#15566]

Security is a Habit

Staying up-to-date with new releases is a good habit to keep your MODX-powered websites secure. The security issues addressed in this release are limited to users that have a valid login to access the MODX Manager. A couple of the issues allowed changes or access beyond limited Manager users’ permissions. As such we recommend you upgrade as soon as possible.

Special Notes on Upgrading to 2.8.2

Some of the security improvements in 2.8.2 will affect certain site configurations. Read about these changes and how to make any appropriate adjustments when upgrading to 2.8.2.

It Takes a Village…

The release would not be possible without the attention and effort of our community contributors including Mark Hamstra, Jason Coward, Thomas Jakobi, Bochkarev Ivan, Ivan Klimchuk, Ruslan Aleev, Sergey Shlokov, Raffy, Bruno17, wfoojjaec, and many more.

Download MODX Revolution 2.8.2
Try it in MODX Cloud

2 posts - 1 participant

Read full topic

We’re pleased to announce the first virtual MODX Meetup on a subject that’s near and dear to MODX developers and Extra authors: creating packages to install via the MODX Extras Installer and to publish in the MODX Extras Repo.

Brought to you by awesome MODXers at Springbok Agency, this live session is set for 7th May at 19:00 (CEST) . Joshua Lückers, MODX Core Integrator and Senior Developer at Springbok Agency, will demo a Step-by-Step Process on How to Create and Package an Extra (amongst other things). Read more information on the sign-up page.

Registration is required and attendance is limited to the first 100 to sign up. We look forward to seeing old friends and hope to see new faces as well .

Access the sign-up page at the following URL: https://modx.amsterdam .

Keep safe and see you soon!

2 posts - 1 participant

Read full topic

We hope the survey will accomplish three key things:

• Help us better describe the benefits of MODX to newcomers or people evaluating it in plain, non-expert language,
• Get feedback on key features that are missing or need improvement, and
• Understand the types of organizations that currently using MODX and how they do so.

We’ll use your responses as we make updates to modx.com and spread the word about the creative freedom MODX brings. We’ll also take your product feedback into account for future releases.

Your feedback is really important in helping shape the future of MODX. Thanks in advance for taking a few minutes to share your thoughts.

Complete the Survey Now!

2 posts - 1 participant

Read full topic

We look forward to seeing even more community participation as we progress to a final MODX 3 release.

Highlights

There are many great bug fixes and enhancements we incorporated since the previous alpha release. More notably, there are a few major changes that we made as a result of working to adapt extras to the new core.

Improved PSR-4 Support in xPDO

One significant change in xPDO 3 had to be incorporated to support custom namespaces in extras properly. Before alpha2, if you wanted to use PSR-4 namespaces MODX 3, you could not include the namespace prefix in the package name when using the setPackage or addPackage methods. If multiple packages in extras tried to follow similar conventions, they would end up with the same package name, effectively overwriting the existing package. By allowing the namespace prefix as a parameter to these methods, we can now calculate the path properly while allowing the entire namespace as the package name. Problem solved.

We’ll have updated documentation on this soon.

Bootstrapping Component Namespaces

Another problem extras were facing while trying to follow the conventions of the new core was adding custom autoloading logic when they don’t have an xPDO model. After some brainstorming, John Peca and Jason Coward came up with the idea of looking for a bootstrap file for each component namespace. In this way, we can register autoloading and handle other component-specific initialization needs when loading MODX. This approach will effectively replace the need for extension packages and could also reduce the need for service classes.

See the Bootstrapping Services section in the documentation covering Namespaces for more information.

Say Hello to Dependency Injection

Speaking of services, we also added a more capable dependency injection container for alpha2. For those that know what dependency injection is, we have included Pimple. This simple but effective DI container from Symfony does everything we need it to do while providing backward compatibility with accessing legacy MODX services as if they are just an array. Jason wrapped it with a simple PSR-11 implementation to meet our needs, and now we can utilize this container throughout the MODX core, as well as in custom xPDO models.

Learn more about using the Dependency Injection Container in the documentation.

Changes to the way legacy deprecated classes are loaded

The inclusion of the deprecated class aliases in the composer autoload caused several problems, so we refactored that slightly. Now it loads after the main modX class does, allowing us to make core initialization consistent across the board. Some additional legacy classes were added to the list of aliases, as well.

Removal of modAction and legacy controller support

Finally, we removed the long-deprecated modAction model along with legacy manager controller support. Dumping these paved the way to improve the loading of manager controllers overall. You can review the Custom Manager Pages documentation to learn more about these changes.

What’s Next for MODX 3.0.0

We are planning on just one additional alpha release cycle, and then the focus will be on locking down backward compatibility and features in preparation for a beta. As always, the more testing and other contributions we can get from the community during this process, the faster we can progress. MODX is a robust and flexible project, and, as they say, it takes a village.

2 posts - 1 participant

Read full topic

Highlights

You can get a full list of changes by reviewing the changelog, but below are some of the significant revisions in this release.

• Update PHPMailer to 5.2.27 to address a small but potential vulnerability
• Upon setup completion, the setup directory is locked
• Updated phpThumb to a version that fixes images getting a black background color when converting an image with transparency to a format without alpha support
• The default RSS feed URLs feed_modx_security and feed_modx_news now use HTTPS
• Fix for thumbnails not rendering for media sources with spaces in URL’s
• Restore PHP 5.3 compatibility

Security is a Habit

Staying up-to-date with new releases is a good habit to keep your MODX-powered website as secure as possible. While no critical security issues appear in version 2.7.0, we recommend you upgrade as soon as possible.

It Takes a Village…

The release would not be possible without the attention and effort of our community contributors, including Jason Coward, Joshua Lückers, Thomas Jakobi, Ruslan Aleev, Bochkarev Ivan, Ivan Klimchuk, Mark Hamstra, Mina Gerges, Jake Scaltreto, Greg Crown, ian-emsens-sb, Serge Kudashev, Joshua Lückers, GulomovCreative, Intersel, ЕвгенийWebinmd, gregcrown, John Penny, nizart91, tolanych, and Roel Zeilstra.

• Download MODX Revolution 2.7.2
• Try it in MODX Cloud

2 posts - 1 participant

Read full topic

8 posts - 1 participant

Read full topic

Issue
There is currently an active exploit of sites with an intact MODX Revolution setup/ directory. This can give anyone on the internet complete access to your site and possibly your server with trivial effort. This directory should never be left in place once a site is installed.

Check Your Site
You can check if your site is vulnerable by entering your site URL with a /setup/ added at the end, for example:
https://www.example.com/setup/

What to Do
If you see a MODX installation utility, you should log into your server via FTP or SSH immediately, and remove this directory. If your site is working as expected, your site may be safe, but please review the additional information below.

Why it Matters
Using the MODX installation script above, a malicious individual can re-install MODX and point to any database they wish including remote databases. Once a site is “re-installed” they can then use the Manager’s file manager to upload other back door files to your server. This can potentially lead to more severe issues such as having the entire server rootkitted, setting up spam mailers, or uploading crypto miners to take advantage of computing resources on your server.

If Your Site Has Been Compromised
If your site has been compromised or is not working correctly, and the setup folder per the above was in place, you must first re-connect your site to the correct database and server. Ask your web host or sysadmin to reset your database password and give you the new database credentials. Once you have those, update the MODX config file—by default located at core/config/config.inc.php—with the correct settings.

Keep Up with Updates
You should also upgrade your MODX version to the latest production release (currently 2.7.1) and upgrade all Extras if they are not current. Keeping up with updates is critical to maintaining a secure site, as it plays a key role in helping prevent sites from compromise.

Malware Scanning
Finally, you should run a malware scanner to make sure other exploits haven’t already been uploaded to your site as described above. We have a series of articles that walks you through recovering from a site compromise, which hopefully will help in this effort:

• Recovering from a Hacked Site: Part 1
• Recovering from a Hacked Site: Part 2
• Recovering from a Hacked Site: Part 3

Need Help?
If your web host, developer or sysadmin is not able to help, you can open a commercial support ticket directly with MODX by visiting https://support.modx.com and clicking the blue “Submit a request” link in the header (please mention this post and provide your site URL). In order to assist we will need access to your server, most likely via your cPanel login.

1 post - 1 participant

Read full topic