Repository navigation
docs(building-sites/client-proofing): fact-check pass, en/ru sync - #672
Open
Ibochkarev wants to merge 4 commits into
Open
Ibochkarev wants to merge 4 commits into
Ibochkarev wants to merge 4 commits into
Conversation
Mark-H
reviewed
Oct 20, 2026
| As a site administrator you should not encourage your users to choose insecure passwords. Passwordless login moves the risk of a weak password away from your MODX installation, but of course needs a secure e-mail account for your users. The traditional username and password login has the same requirement, because it also offers self-service password resets by e-mail. | ||
|
|
||
| Additionally, if passwordless login is enabled, no passwords are stored any more in the MODX database. Then there is no more theoretical risk of passwords being stolen by a database breach (regardless of any encryption). | ||
| The password of the user stays in the database all the same. Every login by a link writes the hash of a temporary password into the field `password` of the user. The gain is that the user has no password to choose, to remember or to reuse, not that the password is gone. |
Mark-H
reviewed
Oct 20, 2026
| ## Still can't get it to work? | ||
|
|
||
| Make sure you followed everything step by step and that you flushed permissions properly. If everything seems to be alright, check again and then go to the Forums to ask for help. If you think the tutorial is misleading or inaccurate, please visit the forum topic (linked below) and post about what is incorrect so it can be fixed. | ||
| Make sure you followed everything step by step and that you flushed permissions properly. If everything seems to be alright, check again and then go to the Forums to ask for help. If you think the tutorial is misleading or inaccurate, please visit the [forum topic discussing this tutorial](https://forums.modx.com/index.php/topic,51259.0.html) and post about what is incorrect so it can be fixed. |
Collaborator
There was a problem hiding this comment.
broken link, might as well take it out
Mark-H
reviewed
Oct 20, 2026
| It is not uncommon for a User account to become inaccessible because of a lost or forgotten password. In many cases, this can easily be resolved by having the user use the Forgot Password link on the login form. In some cases you need to reset the password directly. | ||
|
|
||
| ### Resetting Password in MODX 2.1+ | ||
| **The password cannot be written into the database by hand** |
Collaborator
There was a problem hiding this comment.
Kinda incorrect, it's not possible with modNative, but can be done with the modMD5 approach and the UPDATE line you've removed.
Collaborator
|
It's taken me an hour to just read through half of this PR.. will follow up on the other half later. |
Ibochkarev
added a commit
to Ibochkarev/Docs-MODX
that referenced
this pull request
Oct 21, 2026
Three remarks. **The passwordless login page was confusing about the password.** It said that the password of the user "stays in the database all the same" and that every login by a link writes the hash of a temporary password into the field `password` — two statements that read as a contradiction. What the code does (`manager/controllers/default/security/login.class.php`, `handleMagicLoginLink()`): the handler writes a generated password into the field `password`, where `modUser::set()` stores only its hash, and logs the user in with it. The password the user chose is replaced and stops working. The page now says that, in its own section **The Password Is Replaced**; the sentence about the gain moved to the section above it. **The link to the forum topic was dead.** The topic of the old forum is gone. The sentence now points at the MODX Community, which is where the forum lives. The Russian page had a dangling reference to a link below that was not there any more; it points at the same place. **The page about resetting a password by hand had lost the statement.** The note that the password cannot be calculated in the database was right, but the way out was described in prose only. The `UPDATE` statement is back, with the `hash_class` of the user set to `MODX\Revolution\Hashing\modMD5` and the password written as an MD5 hash — the database has an `MD5()` function for that. Both locales follow.
Fact-checked the whole section against MODX Revolution 3.x code and closed 122 audit findings: 13 PHANTOM, 27 STALE, 6 ORPHAN, 56 UNDOCUMENTED, 18 UNVERIFIABLE. The Russian locale mirrors the English one page by page. Themes of the manager: - `manager_theme` holds the name of a directory inside `manager/templates/`, the combo box cannot be typed by hand, and the upgrade script resets the value to `default`. A theme has to carry `images/modx-icon-color.svg`, `images/modx-logo-color.svg`, `images/login/default-background.jpg` and `email/default.tpl` — they are read from the theme with no fallback. The stylesheet of the login page is not themed: `login.tpl` links the one of the `default` theme by a fixed path. Dashboards: - a widget comes in seven sizes and four types, the Inline PHP one included; the paths of the menu, the labels of the buttons and the key of the lexicon in the example are the ones of MODX 3; - added the fields `permission` and `properties`, the setting `hide_trees`, the permission `dashboards`, the personal resize, the seven widgets of the core, the creation and the deletion of a dashboard, the filter by a user group, the events and the permissions. Form Customization: - the eleven pages of `rules/` described the grid of rules of MODX 2.x, which does not exist in 3.x: the rules are derived from the three grids of a set and are rebuilt on every save. All eleven pages were rewritten for 3.x; - added the list of the ten kinds of rules, the order they are applied in, the list of the fields and of the regions, the three actions of a set, the groups of the policy templates and the API of the section; - the name and the value of the rule "Move TV to Tab" were swapped in the documentation, and the two region ids that do not exist were fixed. Security: - the model is list-based, not attribute-based, and the wording now matches the code; - the table of the permissions of the Administrator policy was rebuilt from the core: 183 rows, the four permissions that never existed are gone; - the paths of the menu of MODX 2.x were replaced with the ones of 3.x; - added the twelve policies of the core, the seventh policy template, the seven groups of the templates, the five kinds of ACL, the fifth access area of a group, the permissions needed to manage groups, roles and policies, the flag `sudo` with its permission `set_sudo`, the eight missing fields of a user, the events of the section, the settings of the accounts and what a fresh installation creates; - the passwordless login and the manual reset of a password were corrected for 3.x. Every page of the section carries a `description` in the frontmatter, as the passes over resources, sending-mail and tag-syntax did. The frames of the Russian pages were missing: eighteen images that live only in the English locale were added to `ru/`, the way the other locales of the set keep their images.
Technical-editing pass over the whole client-proofing section in English: - cut filler and answer-first openings, moved details into the body; - turned prose into tables and lists where the content is reference data (widget fields, set fields, permissions); - unified terminology (User, User Group, Resource Group, Access Policy, TV, System setting, the manager) and the menu paths (the lock icon in the user menu, Admin for the gear); - unified the See Also list across the security section and the dashboards / form-customization subsections; - split sentences over 25 words and replaced the 2.x-era menu labels; - aligned the two reference tables (Administrator Policy, Resource Policy) and the field tables without touching their content.
…tion The editorial pass rewrote the English pages; the Russian ones were left behind. The RU pages now match the English ones: - the lists of "See Also" are the same in both locales: 19 items for the security section, 9 for the dashboards, 4 for the widget types, 6 for the form customization and 3 for its rules; - the English page of the resource groups got the unified list of the section — it was the only page that still carried the old one; - the prose that the English pages moved into the body is back in the body of the Russian ones: the link to the tutorial about a manager access and the video on the security model, the paragraph about the policy templates, and the two further readings about the rights; - the menu paths are the ones of MODX 3: the lock icon in the user menu → **Access Control Lists** → the tab **Roles**, the tab **Context Access**, and (**Admin → Actions → Create Menu**); - the rules of a form customization set call a template variable a TV, as the English pages do, and the name of the tab **Template Variables** is left as it is in the interface; - two headings follow the English ones: "Модель безопасности" and "Что такое панель управления".
Three remarks. **The passwordless login page was confusing about the password.** It said that the password of the user "stays in the database all the same" and that every login by a link writes the hash of a temporary password into the field `password` — two statements that read as a contradiction. What the code does (`manager/controllers/default/security/login.class.php`, `handleMagicLoginLink()`): the handler writes a generated password into the field `password`, where `modUser::set()` stores only its hash, and logs the user in with it. The password the user chose is replaced and stops working. The page now says that, in its own section **The Password Is Replaced**; the sentence about the gain moved to the section above it. **The link to the forum topic was dead.** The topic of the old forum is gone. The sentence now points at the MODX Community, which is where the forum lives. The Russian page had a dangling reference to a link below that was not there any more; it points at the same place. **The page about resetting a password by hand had lost the statement.** The note that the password cannot be calculated in the database was right, but the way out was described in prose only. The `UPDATE` statement is back, with the `hash_class` of the user set to `MODX\Revolution\Hashing\modMD5` and the password written as an MD5 hash — the database has an `MD5()` function for that. Both locales follow.
Ibochkarev
force-pushed
the
docs/client-proofing
branch
from
October 23, 2026 07:00
2f739a4 to
31da295
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fact-check pass over
en/building-sites/client-proofingagainst MODX Revolution3.x, with the Russian section synced page by page. The section is split in four parts: the root, the dashboards, the form customization and the security.manager_themeholds the name of a directory insidemanager/templates/, the combo box cannot be typed by hand, and the upgrade script resets the value todefault. A theme has to carryimages/modx-icon-color.svg,images/modx-logo-color.svg,images/login/default-background.jpgandemail/default.tpl— they are read from the theme with no fallback. The stylesheet of the login page is not themed:login.tpllinks the one of thedefaulttheme by a fixed path.permissionandproperties, the settinghide_trees, the permissiondashboards, the personal resize, the seven widgets of the core, the creation and the deletion of a dashboard, the filter by a user group and the events were added.rules/described the grid of rules of MODX 2.x, which does not exist in 3.x: the rules are derived from the three grids of a set and are rebuilt on every save. All eleven pages were rewritten for 3.x, the list of the ten kinds of rules, the order they are applied in, the list of the fields and of the regions, the three actions of a set, the groups of the policy templates and the API of the section were added. The name and the value of the rule "Move TV to Tab" were swapped in the documentation, and the two region ids that do not exist were fixed.sudowith its permissionset_sudo, the eight missing fields of a user, the events of the section, the settings of the accounts and what a fresh installation creates were added. The paths of the menu of MODX 2.x, the passwordless login and the manual reset of a password were corrected for 3.x.descriptionin the frontmatter, as the passes over resources, sending-mail and tag-syntax did.The callouts of the section were written in the VitePress form
::: warning, which the site does not render:DocsAppsupports only the GitHub alert form> [!WARNING]. The section was changed to the form that works.Checks
markdownlint-cli@0.18(the version used by CI): 0 issuesredirects.jsonunchanged and validNotes
ru/, the way the other locales of the set keep their images.Four defects found in the code of MODX 3.x are reported separately: modxcms/revolution#17089, modxcms/revolution#17090, modxcms/revolution#17091 and modxcms/revolution#17092.