Timeline for security risk of require_once 'app/Mage.php'; in Magento root
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 19, 2014 at 11:43 | comment | added | Fabian Schmengler | This needs some clarification, could easily be misunderstood: 1) "user" in this context means a user on the server, i.e. somebody who already has access to the server. 2) this is not related at all to the fact that the file includes Mage.php. If somebody has access to your server and can write files, he could add the code in any file (or create a new one for example in /media, which is often set to 777) | |
| Nov 17, 2014 at 20:00 | comment | added | sparecycle | I hate when they don't explain the down vote. | |
| S Nov 17, 2014 at 13:29 | history | suggested | Hashid | CC BY-SA 3.0 |
fixed grammar
|
| Nov 17, 2014 at 13:28 | review | Suggested edits | |||
| S Nov 17, 2014 at 13:29 | |||||
| Nov 17, 2014 at 12:46 | comment | added | Amit Bera♦ | Why .. i got down vote.. Can explaing | |
| Nov 17, 2014 at 12:44 | comment | added | Amit Bera♦ | Thank @JonathanHussey... for your advice | |
| Nov 17, 2014 at 12:43 | comment | added | Jonathan Hussey | Standard file permissions of 644 for this file should be fine. Remember also that PHP files only need read permission for the webserver user so if you did want to take advantage of this to restrict editing of the file for whatever reason then you could. | |
| Nov 17, 2014 at 12:34 | history | answered | Amit Bera♦ | CC BY-SA 3.0 |