MODX Evolution 1.0.15: Security Fixes and Hardened Cookies

MODX Evolution 1.0.15 was a security-focused release, and that alone makes it historically important. Rather than shipping cosmetic changes, it concentrated on hardening the platform in the areas that most directly affect real sites.

The release notes highlighted several key fixes:

• secure cookie handling to reduce leakage over unencrypted requests;
• httponly cookie support in config.inc.php;
• SameOrigin protection headers;
• multiple XSS fixes, including stricter output handling and safer treatment of $_GET and $_POST values;
• a closed SQL injection vector.

For maintainers of older Evolution sites, this release marked the point where “we should update soon” became “we should not postpone this any longer”. Even if the site itself seemed stable, the security delta between older builds and 1.0.15 was too meaningful to ignore.

It also set the tone for later community builds: security fixes were not secondary maintenance work, but core release material worth surfacing clearly.

Source: Evolution CMS releases on GitHub.