Question

What’s the proper way for implementing front-end Ajax functionality in ModX Revolution? I like the idea of connectors and processors, but for some reason they are for back-end use only – modConnectorResponse checks if user is logged in and returns ‘access denied’, if he is not.

Inserting a snippet into resource and calling it by resource URL seems a one-time solution, but that doesn’t look right to me.

So how do I get safe Connector-like functionality for front-end?

Answer 1

So, as boundaryfunctions said, it’s not possible and ModX developers recommend using a resource with a single snippet included. But for those who despite the will of developers look for Connector-like functionality, there may be a solution made by guess who– ModX core developer splittingred in Gallery extra. In connector.php, before handleRequest() call, there’s a code that fakes authorisation:

if ($_REQUEST['action'] == 'web/phpthumb') {
    $version = $modx->getVersionData();
    if (version_compare($version['full_version'],'2.1.1-pl') >= 0) {
        if ($modx->user->hasSessionContext($modx->context->get('key'))) {
            $_SERVER['HTTP_MODAUTH'] = $_SESSION["modx.{$modx->context->get('key')}.user.token"];
        } else {
            $_SESSION["modx.{$modx->context->get('key')}.user.token"] = 0;
            $_SERVER['HTTP_MODAUTH'] = 0;
        }
    } else {
        $_SERVER['HTTP_MODAUTH'] = $modx->site_id;
    }
    $_REQUEST['HTTP_MODAUTH'] = $_SERVER['HTTP_MODAUTH'];
}

Works for me. Just need to replace first if condition with my own actions.

UPDATE: I forgot to mention that you need to pass &ctx=web parameter with your AJAX request, because default context for connectors is “mgr” and anonymous users will not pass policy check (unless you set access to the “mgr” context for anonymous users).

And also the code from Gallery extra I posted here seems to check some session stuff that for me doesn’t work with anonymous front-end users (and works only when I’m logged in to back-end), so I replaced it with the next:

if (in_array($_REQUEST['action'], array('loadMap', 'loadMarkers'))){
    $_SESSION["modx.{$modx->context->get('key')}.user.token"] = 1;
    $_SERVER['HTTP_MODAUTH'] = $_REQUEST['HTTP_MODAUTH'] = 1;
}

I don’t know if this code is 100% safe, but when anonymous user calls it, he doesn’t appear to be logged in to Manager, and when admin is logged in and calls the action from back-end, he is not logged off by force. And that looks like enough security for me.

This solution is still portable (i.e. can be embedded into distributable Extra), but security should be researched more seriously for serious projects.