Protecting Pages On Your MODX Site — The Easy Way

Last Updated on Saturday, 18 May 2013 10:44 Written by Bob Ray Monday, 20 May 2013 12:00

Suppose you want to make a section of your site private so that only logged-in users can see the Resources. As with most things in MODX, there are several ways to protect Resources.

Contexts

One method is to put all the private Resources in a separate context and protect it by creating a Context Access ACL entry that links the private Context to one or more User Groups. Once you do that, the Resources in the Context will be hidden from everyone who is not a member of the specified group or groups. I try to keep from using Contexts if I can, because they are difficult to set up correctly and they introduce complexities that I’d rather avoid. Links to Resources in other Contexts, for example, can be tricky to implement and users often get sent to the error (page-not-found) page rather than the unauthorized page when trying to access a forbidden resource.

Warning to All Users: Upgrade your Elgg Network to the Latest Version Now

Last Updated on Thursday, 31 January 2013 07:38 Written by Rodolfo Hernandez Tuesday, 29 January 2013 02:52

If you are using elgg 1.7.x or elgg 1.8.x you must upgrade now to the latest elgg version immediately. A new security threat has been discovered and fixed, and I will explain the details about this threat in this article and the solution for it

Elgg: Protecting Upgrade.php

Last Updated on Friday, 8 July 2011 10:46 Written by Rodolfo Hernandez Sunday, 12 December 2010 07:54

What is upgrade.php?  Upgrade.php is a file that flushes the cache that elgg uses. It runs code and database upgrades. By default, in any regular Elgg install, anyone can run this file.  This is not good. We don’t want anyone running this file.

Protecting Your Elgg Site

Last Updated on Friday, 8 July 2011 10:06 Written by Rodolfo Hernandez Wednesday, 24 November 2010 08:24

Some people are telling Elgg users to disable a plugin called “HTMLAWED plugin” ( a plugin that comes as default in every Elgg install) so that they can embed content. This is not recommended.

The plugin mentioned above stops users from adding arbitrary HTML/PHP code onto your site that could break your site design and might even allow phishers to embed code in order to steal their passwords.