Questions tagged [security]
Denotes security questions on Magento.
606
questions
1
vote
0answers
83 views
+100
Magento 1.9 - Security Issue - Bug Shooting return Data has been tampered error in Success page?
Using Bug Shooting if i try to place an order i am getting response regard Data has been tampered. How to solve this issue?
0
votes
0answers
52 views
Is SUPEE-11295 missing fixes?
Adobe's Security Bulletin APSB20-02 mentions 6 security issues. I've read through the changes in SUPEE-11295 and I don't think that all of these issues are getting addressed.
To my understanding, the ...
0
votes
0answers
44 views
magento 2 how to secure Cookie mage-cache-sessid and enable Secured Flag
Here Am trying to enable HttpOnly and Secured Flag for Cookies mage-cache-sessid or my domain. I did configuration in admin Panel >> store >> configuration >> general >> web
but still flags not ...
0
votes
0answers
11 views
Magento EE 1.14 security patch Hunk #1 FAILED at 68
I am trying to apply patches to Magento EE 1.14 version but i am facing following issue
checking file app/design/frontend/rwd/default/template/customer/form/changepassword.phtml
Hunk #1 FAILED at 43....
2
votes
0answers
140 views
How upcoming SameSite cookie changes could affect Magento or 3rd modules, possible issues?
On February, 4, Google is set to roll out a new Chrome update that promises a bunch of new features designed to make the browser faster and more secure — including a new approach to cookies.
The ...
0
votes
0answers
28 views
Magento 2 How to secure my checkout success page?
So I have create completely custom checkout page and after successfull order Im receiving via my ajax call a "Increment Id" from backend.
With this increment Id I'm redirecting user to /checkout/...
-1
votes
2answers
31 views
Need magento 1.9.3.3 to apply patch
I want to know list of patches for my website which is in 1.9.3.3 version of magento please suggest.
1
vote
0answers
18 views
Unknown index “UsernamePasswordFormAuthenticve_index” in cron logfile - security issue?
Today i noticed a really strange index and code dump in cron.log: UsernamePasswordFormAuthenticve_index is successfully finished
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@...
0
votes
0answers
27 views
Which files under Magento webroot should be executable?
Security best practices suggest that you should never have an executable in a public web directory. However, in a typical Magento install (in my very limited experience), this is not true.
Even in ...
0
votes
1answer
44 views
Need help to stop malicious code in index.php file
Need help to stop malicious code in index.php file
Please help me if anyone have faced this same issue. I am using Magento ver. 1.9.4.3
index.php :
* @category Mage
*/
$swvJgN7="xQC+...
0
votes
0answers
36 views
Transparent Data Encryption in Magento 2.3 Database
I need to encrypt customer data (company name, contact person, emai, address, etc.) within the magento mysql database.
I'd like to realize this without introducing encryption/decryption in every ...
0
votes
0answers
25 views
Authentication type for API to be used by third party partners | Magento 2
We are creating an API in M2 enterprise edition to sell our giftcodes to a partner. The partner will have functionalities like:
To have Store Credit
Can buy giftcodes
View buy history
We cannot ...
0
votes
1answer
162 views
failed applying security patch SUPEE-11155 - Hunk #1 FAILED
patching file app/Mage.php
Hunk #1 FAILED at 813.
1 out of 1 hunk FAILED -- saving rejects to file app/Mage.php.rej
Can anyone point me in the right direction as to why I've a bunch of messages that ...
0
votes
0answers
57 views
Security patch 11219 risk error for Magento 1.9.2.4
Security patch 11219 risk Error for Magento 1.9.2.4
I'm using Magento 1.9.2.4 version
in the Security patch error(magereport.com)
But in the Magento Security patch not have this version (https://...
3
votes
1answer
57 views
Shell script dumps Model source code
Weird things happening. I've written a customized product import script which is executed as a shell script. In this script, I gather some XML input, parse it into an array and then try to import the ...
9
votes
11answers
6k views
SUPEE-11219 Potential issues?
Magento just sent out an email about a new security patch (SUPEE-11219).
https://magento.com/security/patches/supee-11219
Affected versions:
Magento Commerce 1.9.0.0-1.14.4.1
Magento Open Source 1....
0
votes
1answer
62 views
Magento 2: Spam Customer Accounts Created Automatically
I am using Magento 2.2.4 for my e-commerce website. From last few days, customer accounts creating automatically on my website without the proper information. I already installed Mageplaza Security ...
0
votes
1answer
45 views
Any other way to increase the customer logged in time in Magento-1.9 without increasing server session time session.gc_maxlifetime?
Any other way to increase the customer logged in time without increasing server session time?
If we give a value as 78,00,000 seconds (3 months) for session.gc_maxlifetime in the php.ini file, then ...
1
vote
1answer
17 views
No (full) administrator access on backend Magento 2
After couple of weeks holiday i came back and stared in to an problem. I don't have access to the backend of Magento 2. My colleges have access and can do their work (product, inventory and ...
1
vote
0answers
50 views
Blank admin login page with Security titled empty field set
We have a working Magento 2.2.9 installation in production. Everything was fine and working and no one touched the code or the settings for weeks now. Today we suddenly could not log in to admin panel ...
0
votes
0answers
67 views
Magento security report We were unable to check for API ACL
I scanned my site from the Magento Security . The report showed
We were unable to check for API ACL (APPSEC-1679)
Magento version 2.3.2
How to solve this?
1
vote
1answer
86 views
/shell/log.php?region=%31… getting called
Cannot find anything in the internet about that.
Here is whats comming in:
'REQUEST_METHOD' => 'POST',
'REQUEST_URI' => '/shell/log.php?region=%31&kunyuk=%31&MageShell=%31&xcv=%31&...
0
votes
1answer
48 views
How to secure our Magento store from hackers?
I have read somewhere that hackers are making target to e-commerce sites to hack. As we know Magento provides some inbuilt security features but still wants to know more regarding security. Also, ...
0
votes
0answers
108 views
Magento 2.2.2 Security Patch Issue
I have download PRODSECBUG-2233 from magento official site
patch -p1 < PRODSECBUG-2233-2.2.x-2019-07-26-08-35-48.patch
When i try to use this command, it's not working and show me this errors.
...
0
votes
1answer
24 views
*Why save magento visitor happen only when POST/PUT request?
I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed ...
0
votes
1answer
30 views
How I can add security patch for magento 2.2.6 without updating magento
I have Magento 2.2.6
I want to update security patch
I have lost my server databases (maybe SQL injection)
my questions
1)How to update security patches?
2)Is it will helpful?
3)Is ...
0
votes
1answer
39 views
Magento 2 : How can I stop SQL attack through search bar
It's a bot that is continuously attacking, I try to hide these special characters suggestion form dashboard also try to delete them but all in vain, it comes again the next day(Magneto 2.3.1).
0
votes
3answers
276 views
Magento 2, Magento Unprotected XML
I have a Magneto 2.2.3 instance and when we check for security scan it is showing below error:
We have determined that your Magento installation's configuration
file(s) are publicly accessible ...
0
votes
2answers
273 views
Magento 2, XSS Patch not detected (APPSEC-2143)
In Magento security scan I got the below message for my Magento instance:
XS Vulnerability - Failed.
XSS Patch not detected (APPSEC-2143)
I am using Magento 2.2.3
How could I resolve this?
Is ...
0
votes
0answers
32 views
Magento 2 factor authentication
Can any one help in making magento 2 2fa (two factor authentication) extension which was released with magento 2.3 and make it compatible with magento 2.2.8 or 2.2.9.
This is the extension release ...
2
votes
1answer
41 views
How to secure Magento 2.x guest API
I realized that it is possible to register customers through API without authentication.
https://devdocs.magento.com/guides/v2.2/rest/anonymous-api-security.html
Just make a POST call to https://...
1
vote
0answers
42 views
How secure is the Magento 2 File Uploader
I recently added my own form to the Magento frontend. The form contains a file type input, an used the file uploader class to save the file. But I was wondering how save this class is?
I already ...
0
votes
0answers
20 views
Hideit input on other forms
I stumbled across hideit input on contact us form
https://magento.stackexchange.com/a/107656/70343
Makes sense to catch bots filling out the form. Just wondering whether it's worth adding to other ...
2
votes
2answers
51 views
How to securely run PHP scripts in Magento 2
I know that we can run php scripts by placing our script in root of magento 2 folder and we can load products, orders etc via object manager and perform our desired functionality. although this method ...
2
votes
2answers
78 views
Magento cloud hosted M2 EE site compromised and got malware attack
Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url:
<script src="http://write-cdn.com/...
0
votes
2answers
188 views
Magento 2 remove version number impact
I noticed if we type /magento_version along with site url then it displays our magento version. So anyone with bad intention can check my version and exploit it.
to prevent this I can disable the ...
3
votes
0answers
19 views
Magento2 Security: How to best filter GET parameters before they reach Magento?
I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
1
vote
0answers
33 views
Magento 2: Is there any site which is showing missing security patch?
Is there any website which is provide a report about missing security patch or which need to install ?
I just need to install patch in magento 2.1.9.
0
votes
2answers
105 views
Magento 2 security scan failed AngularJS and XS Vulnerability
Our Magento 2 site failed the AngularJS and XS Vulnerability checks. Does anyone know how this can be fixed.
2
votes
0answers
24 views
Magento 1.9 - 503 Error timing out - Notice: iconv_strlen(): Detected an illegal character in input string
PHP 5.5.38
Magento 1.9.3.2
I've had a site running perfectly fine for over a year, and suddenly today its been timing out most of the time trying to load a page, with the 503 error page coming up ...
3
votes
1answer
39 views
Magento 2: Load patches or update
I'm aware that this probably isn't the first time this question has been answered, but I'm wondering what is the best approach to keeping my magento 2.3.1 install secure: Should I update to 2.3.2 or ...
28
votes
21answers
10k views
Security Patch SUPEE-11155 - Possible issues?
Magento has released a new security patch for M1, and updates for M1 and M2.
What common issues do you have to watch out for when applying this patch/upgrade?
Magento 1
https://magento.com/security/...
2
votes
4answers
182 views
Magento 2.3 secure your site back and front
Got a very security conscious client.
I've searched stack exchange and only found partial solutions to certain security issues.
I've also searched dev docs and again found one or two suggestions in ...
0
votes
1answer
157 views
Is it better to use Vue.js storefront as a frontend for magento 2?
We have to lunch a new store and planning to use Vue.js storefront on frontend.
-> Will it be feasible easily - data will be interchanged using APIs
-> Would there be any security issues ?
-> Any ...
3
votes
1answer
198 views
Magento 2 Set Previous Password History
I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last ...
0
votes
0answers
22 views
Issues on blocking magento website
Is there any way where a magento website is enabled and opens even if teh internal IT firewall blocks it.
Also no one blocked my website in the office. Still i am not able to open it in the office ...
2
votes
3answers
163 views
magento 1 malicious code attack in app/Mage.php
I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again ...
2
votes
2answers
259 views
Document root change help
I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache.
I did the ...
3
votes
0answers
51 views
Magento 2 admin backend security
In addition to the extension settings, extension installation loads a lot of unnecessary content.
if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
1
vote
1answer
28 views
Magento 2 recommended approach to applying patches
So far had to apply patches through command line. Bugs me there is not version control for this as in some cases changing vendor folder contents which is ignored. More for accountability with time and ...
