Upgrading to 2.7

MODX Revolution 2.7.0 (November 2018) adds Trash Manager, native password hashing, static-element automation, and Media Browser security fixes. Full changelog: core/docs/changelog.txt.

Release overview: Revolution 2.7: An Impressive and Feature-Packed Release.

Before you upgrade¶

• Merge all core files from the release package. Incomplete uploads (especially under core/docs/ and setup templates) have produced broken config.inc.php writes when obsolete keys like cache_disabled disappeared from the templates.
• Keep a copy of core/config/config.inc.php before setup. If setup writes unresolved {placeholders} into that file, restore the backup and run setup again with a complete file tree.
• Update Extras, clear core/cache, flush sessions.

Breaking changes¶

Removed settings¶

2.7 removes the non-functional cache_disabled system setting and drops cache_system_settings from system settings. Do not reintroduce those keys by hand. If an old deploy script or Extra still writes them, clean that up after upgrade.

Password hashing¶

User passwords use native PHP password hashing (#13926). Existing hashes keep working through the normal login upgrade path. Custom user-import or password-reset scripts that assume plain MD5 need to follow the current hash class / hash_class behaviour instead of writing raw MD5 into modUser.

Deprecated 0.9.x parser utilities¶

Migration helpers aimed at the old 0.9.x parser are deprecated and logged for removal in 3.0 (#14131). Finish any leftover migration work before you jump to MODX 3.

Media Browser and paths¶

• Invalid relative media source paths no longer expose filesystem roots (#14038).
• Clearing modFileRegister no longer deletes arbitrary paths (#13980).
• phpThumb receives filtered user parameters (#13979).

Re-test custom media sources that rely on unusual relative bases.

Features to configure after upgrade¶

• Trash Manager for restore / purge of deleted resources (#14058).
• Automatic static elements workflow (#14135) if you keep elements on disk.
• automatic_template_assignment (#13700).
• Resource option Use current alias in alias path to omit a resource segment from the URI (#11153).
• set_sudo permission (#13807) for controlled sudo elevation.
• Purge Old Versions in Package Management (#12818).
• Composer-oriented project install plus CLI setup script (#13790).
• Customisable error.log location (#13768) and configurable custom error handler class path (#14119).
• Output filter filterPathSegment (#13699).
• Form Customization wildcards on actions (#13775).

After setup¶

Confirm manager login (password hash path), Trash Manager, Media Browser sources, and Package Manager purge. If config.inc.php looks wrong, restore the pre-upgrade file and re-run setup with a complete 2.7 tree.

If you later move to MODX 3, finish anything that still depends on the deprecated 0.9.x utilities first. See the MODX 3 upgrade guide.