It's release time again! Last night the MODX team officially released 2.3.6, and also 2.4.0! 

The 2.3.6 release is a patch release, fixing a number of bugs and also a reflected XSS vulnerability found in the manager. For those that don't want to update to 2.4 yet, you should definitely upgrade to 2.3.6

MODX 2.4 ships with numerous improvements and cool new features. Compared to 2.3 there is no overarching theme like the new design, but that doesn't mean there aren't a lot of great new goodies! We'll go over a number of highlights to show you what's new. 

Minimum PHP version increased to 5.3

Occasionally a hot topic, but in 2.4.0 the minimum required PHP version has been increased. Previously this was 5.1.2 (which, by the way, has been EOL since 2006), however with 2.4 the minimum is increased to 5.3.3. This is still a pretty old version that has also reached its end of life a year ago, so you shouldn't depend on that version, but it's a good new baseline requirement. 

If you are still on an older version of PHP, you will see a warning on the dashboard widget, but most of MODX 2.4 will continue to work as expected. Currently you'll mostly experience issues with package management on unsupported versions of PHP, because that was refactored, causing the jump in versions. 

Dashboard Improvements

The dashboard received various improvements in 2.4, including a restyled configuration widget with several new checks. These new checks include making sure if your core directory is properly locked down, and check if you're running at least PHP 5.3 or up. 

Oops, this does not appear to be a very secure version of MODX. 
Oops, this does not appear to be a very secure version of MODX. 

Another improvement to the dashboard, is that the site name and MODX version are now back in the header after being missing in 2.3. The uberbar is still a single click away as it now expands that below the search icon (and automatically puts the focus on the search field). This change will be very welcome to those that manage more than one MODX site. 

MODX 2.3

MODX 2.4

Namespaces, Settings & Lexicons

New in 2.4 is also the ability to assign permissions to namespaces. This is very useful when you're looking to provide a client access to lexicon management or system settings, but you don't want to give them access to all namespaces. 

Another new feature related to settings is that you will now get autocomplete suggestions when adding a new user or context setting. That way you're less likely to introduce typos into the setting keys. 

Package Dependencies

Developers can now embed dependency information in their packages. This means you wont be able of installing that package on MODX 2.4, unless the dependency is fulfilled. These dependencies relate to other packages (e.g. SimpleCart requires FormIt to be installed), but also to a minimum MODX or PHP version. Read more about package dependencies in the documentation.

Related to packages, it's also worth noting that the package provider now gets additional information from each MODX install, including the installed PHP version and the selected manager language. Package providers can use that to provide localised responses, but also simply for analytics and prioritisation of translations or minimum supported PHP versions.  

Multiple constraints in Form Customization

Previously, if you wanted to have a form customisation set apply to multiple templates, you would need multiple sets because the constraints could only be applied to a single value. Not anymore, you can now separate values with a comma to make your rules more powerful. 

Setup related improvements

The setup will now check the Accept-Language header your browser sends to automatically select the right language where possible. It's also possible to disable the JS/CSS compression on traditional installs now. Database passwords that contain a quote will no longer ruin your config file (also in 2.3.6). 

Friendly URL improvements

When you enable the friendly_alias_realtime system setting, the alias for new resources (or those that haven't gotten an alias set yet) will automatically be populated as you type. This even takes into account transliteration if you have that set up. 

There is also a new setting use_frozen_parent_uris that we've already been using at With the use_alias_path system setting, your friendly urls follow the structure in the tree, and you can freeze the URI of a resource on its settings tab to override it. This works great, however when that resource has child resources, they will not by default adhere to the frozen URI of the parent. 

So given this simplified tree structure:

  • Home
  • Extras (alias: extras)
    • Redactor
    • SimpleCart (alias: simplecart, frozen uri: /simplecart/)
      • FAQs
      • Documentation (alias: documentation)
      • Pricing

With use_frozen_parent_uris disabled (the default), the URI for the SimpleCart documentation would be /extras/simplecart/documentation/. With the setting enabled, it will instead see the frozen URI and stop there, making it: /simplecart/documentation/. Nice and clean!

And much, much more... 

These are some highlights, but there's a lot of other useful improvements and new features in 2.4. The changelog on GitHub contains a full list. The official MODX announcement hasn't been published for 2.4 yet, but you can already download 2.4 to get started. 

Thanks to everyone that submitted a pull request for 2.4, you made a pretty sweet release together.