Denotes security questions on Magento.
1
vote
1answer
16 views
Magento2 Two factor authentication for Frontend
Do you guys know where to purchase or download M2 2FA ext for FRONTEND (or both frontend and admin)
0
votes
0answers
29 views
How to secure my website magento 2
I want to secure my website from script injection and other Security failures so is there patch or somthing that i have to do or upload to do so.
Also i want advice from you concerning sécurity ...
2
votes
1answer
20 views
How to create a nonce / secure hash in Magento 2?
I want a simple link to activate a customer out of an email that gets sent to the admin on registration.
I am using this module: https://github.com/enrico69/magento2-customer-activation for the ...
3
votes
2answers
29 views
Can anyone have any idea of security patch file of SUPEE-9652 V2?
As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
1
vote
0answers
20 views
Access orders page with wget [duplicate]
people. My question may be simple but I can't find an answer. I want to be able to get the page source of my orders with a command. I plan something like
wget -user myUserName -password myPassword ...
2
votes
0answers
33 views
Magento Security Scan reports Malicious Javascript without files
I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan.
For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
0
votes
0answers
170 views
Magento known issue while upgrade from 1.9.3.9 to 1.9.3.10? [duplicate]
I just got notification that 1.9.3.10 is released with SUPEE-10888 curious to know if someone has already update it and faced any issue?
16
votes
13answers
3k views
Security Patch SUPEE-10888 - Possible issues?
SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues.
https://magento.com/security/patches/supee-10888
SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3....
1
vote
0answers
27 views
Magento 2 CE + CyberSource Checkout [closed]
I'm trying to set up a 2.2.5 store with CyberSource v3, however, I keep receiving below error.
You are not authorized to view this page. The transaction has not been
processed. If the problem ...
1
vote
1answer
27 views
Magento 1.9 with no security patches got hacked. How to install the security patches without Magento Connect?
Magento 1.9.1
Porto theme
Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his ...
0
votes
0answers
27 views
How to delegate Magento 1=>2 migration to a 3rd party, without leaking PII?
My company manages many Magento stores for our clients. Most things we do in-house, but migrating 100+ stores to 2.x on our own would take a lot of manhours, so we'd like to test some 3rd party ...
0
votes
1answer
55 views
The site ahead contains malware Attackers currently on magento
My Website is not working from 3 days boheco.org(magento version- 1.9.3.4)
3
votes
2answers
85 views
Malware Attack On Magento 1.9.2
My website www.antiqworld.com whenever i am trying to open my website automatically redirect on (https://20.unverf.com/?h=230916016_ee5d07ec7ec_98__def_sub__sub_id_2&cnv=1) this url
please help ...
1
vote
1answer
112 views
Using SVG logo in Magento 2.2.4
I am trying to upload an SVG logo for my Magento website, but it is not allowing me to upload an SVG file. It says that it is an unsupported file. Any idea how to resolve this?
Based on internet ...
0
votes
0answers
50 views
Magento 2 - Security : HTTP Only cookie
Our Security team raised security issue cookie setting and asked to set HTTP only and Secure cookie. Looks like Magento functionality overrides HTTP only parameter. To fix this issue we have set ...
0
votes
0answers
16 views
Magento attack redirection to admin login page
Analyzing my website logs I saw a lot of POST requests to:
{domain}/index.php/installtemplate/adminhtml_installtemplate/index
and
{domain}/index.php/installtemplate/adminhtml_installtemplate/...
0
votes
1answer
72 views
Data Security has been compromised
In my Magento 1.9 store, some of the Customer's Default Billing name and Address
has been amended. I first got to know this when one of my customer complained to me about their name that has been ...
1
vote
0answers
44 views
I have Chinese chars in the contents of my session files. Have I been hacked?
I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
2
votes
0answers
47 views
Is Magento 2 REST API CSRF-proof?
As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
1
vote
1answer
39 views
Magento 2 : What's the best practice when it comes to escaping in templates?
This is a question about best practices when it comes to writing templates / block classes and security.
When it comes to writing templates I know you need to escape everything that comes into the ...
0
votes
1answer
58 views
What is the data encryption / hashing key management method used in Magento 2
Like in the title.
What is the data encryption / hashing key management method used in Magento 2?
I found this question Encryption Method Used by Magento Enterprise, however, is the same method used ...
0
votes
0answers
24 views
Magento 1.9.1 error while security patches SUPEE-3941
When I am trying to install any patches it will give me error like below,
ERROR: Patch can't be applied/reverted successfully.
patching file downloader/Maged/Model/Connect.php
Hunk #1 FAILED at 486.
...
0
votes
0answers
10 views
How to restrict magento rest API,it is only accessible by https?
I want to access API with HTTPS only.If anyone access my API with HTTP,it does not work.How can achieve it?
1
vote
2answers
325 views
Hunk error applying PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to Magento 1.9.2
Getting some errors applying the PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to my Magento 1.9.2
Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted ...
0
votes
0answers
15 views
Mganto1.9 : Item (Mage_Sales_Model_Order) with same id already exist
After I migrate my Magento shop from one hosting provider to another one I have a big problem. When I want to go in back to administration into sales->order I get an error
There has been an ...
1
vote
2answers
76 views
Magento 1.9.2.1 how to prevent core_config_data from getting malicious scripts
I have been scanning the website at Magento Scan and getting the following error:
Magento Compromise Injection
Your site is compromised with injected JavaScript. (131)
The malicious code ...
14
votes
14answers
5k views
Security Patch SUPEE-10752 - Possible issues?
A new security patch is out for Magento 1, addressing 25 APPSEC issues
https://magento.com/security/patches/supee-10752
What common issues do you have to watch out for when applying this patch?
...
0
votes
0answers
24 views
Why is customer/section/* accessible publicly? Can we hide this?
I am relatively new to Magento 2. I have created a store and ran security scan and noticed I have the following:
URL: https://www.mystore.com/customer/section/load/install/ or https://www.mystore.com/...
2
votes
1answer
505 views
Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:
I don't know what it's means and how to remove this error.
it's showing in my chrome console . but not in firefox console..
(index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
1
vote
1answer
24 views
How do I enable https for my site in Magento 1.9.3.7?
Where would I go in the Admin Panel of Magento 1.9.3.7 to change my site to be https and secure?
Thank you.
0
votes
3answers
284 views
Magento 2 Newsletter fake subscriptions
Easily with any email you can subscribe to Magento 2 newsletter.
The only available control is to send confirmation email to provided address.
If provided email address is not valid Magento ...
0
votes
1answer
64 views
Hide Magento Admin Url from outside world
We have a magento server up and running. The server had the default 'admin' url which was then changed to some random string for security purpose, which only our team knows. Now we also have an admin ...
1
vote
1answer
65 views
Magento 1.3 .ru bots attack! [duplicate]
I'm being attacked by .ru bots on my Magento 1.3.
Is there any plugin that works for this old version? Or a way to block them?
0
votes
1answer
34 views
Magento 1.7: PCI scan Can't Pass category URL with 'mode' param
Don't know why but the PCI scan do not pass Category URL of Magento and provide a SQL injection with 'mode' param in the below format.
/main-category/sub-category/l/price:10-20/category-name.html?dir=...
0
votes
1answer
693 views
Magento 1 end of life on Nov. 2018 or not?
Please see this answer by an internal staff of Magento who states that:
Magento 1.x end of life is November 2018.
However on their official blog, this post states:
Magento 1 has been and will ...
0
votes
0answers
298 views
Customers facing issue in login - You did not sign in correctly or your account is temporarily disabled
We are using Magento 2.2 as headless commerce (exposed as rest APIs), My SQL on AWS. I am facing issue in our application.
When customers exceeds Max password limits, even customer resets password ...
0
votes
0answers
55 views
Magento 2 - Protect pub/media images from direct access by URL?
I don't want a user to view images directly from pub/media/documents. I have one custom module which contains a simple form with image upload functionality. It is uploading image in pub/media/...
1
vote
0answers
163 views
Having issue with Magento 2 security scan. Magento Compromise Injection
I have checked with my all the sites with the bundle and merge js I am getting the same issue for all the sites i.e. Magento Compromise Injection.
When I remove bundle and merge js then security scan ...
3
votes
1answer
87 views
Admin Security, Lockout Attempts, PW Resets
A recent article went out about improving admin security. In it they suggest setting the maximum PW resets and Lockout Time, and for Magento 1.x, this is supposed to live under System > Configuration ...
3
votes
0answers
100 views
Magento 1.9 A strange record found in customer table
I have noticed that there is a weird customer created in my admin,
I'm sure this customer wans't created on the frontend because this is a B2B site, and I have removed the front-end registration for ...
1
vote
1answer
76 views
Contact form hack
I recently faced a problem where, I am receiving emails from an unknown source. Somehow they bypass the validation for email and sending me SQL statement in
email fields for example:
(SELECT CHAR(113)...
0
votes
0answers
19 views
Magento Security Scanner not running weekly
I've added quite a few Magento 1s to the new Magento Security Scanner tool. They have all validated and I've scanned them all once manually. I've set the scanner to run weekly on Sunday but they haven'...
1
vote
0answers
100 views
magento 1.7.0.0 security patch SUPEE-10415 installation issue - Hunk #1 FAILED
Please help me to get rid of this problem and help me to install this SUPEE-10415 security patch on Magento 1.7.0.0.
0
votes
2answers
161 views
Get md5 from salted md5 and salt in Magento1 and CS-cart
I am migrating customers from CS-Cart to Magento 1. But I am not getting how can I migrate customers password.
As Magento1 uses md5 and also cs-cart uses md5, but cs cart uses it with salt.
I know ...
0
votes
0answers
9 views
Why granting API access to an unknown company (like compass.co) is a bad idea?
Magento 1.9.x
Paypal suggested my customer to use services from www.compass.co to get "free business insights". They ask for store base, API user and API key! I can't find much information about this ...
0
votes
1answer
91 views
Unableto verify site on Magento Security Scan
I am trying to verify my site on the Magento new security scanner https://account.magento.com/scanner/index/form/ but every time I try to verify I get an error Unable to verify this site. Please ...
0
votes
0answers
59 views
Someone is accessing my downloader..What's in /downloader/index.php ? How can I disable it since I never plan to use Magento Connect? [duplicate]
I have a few Magento 1.9 sites running on the same VPS server. I noticed today that the load on the server was unusually high. When I went to investigate, I found out someone was accessing my ...
43
votes
15answers
9k views
Security Patch SUPEE-10570 - Possible issues?
Magento has released a new security patch for M1, and updates for M1 and M2.
What issues should I look out for when upgrading or applying this patch?
SUPEE-10570
SUPEE-10570, Magento Commerce 1....
0
votes
1answer
303 views
Javascript Malware attacks
Our shop get repeatedly infected with a "crypto-miner" malware. Its a javascript code that mines cryptocurrency on the client's CPU.
Everytime this happens I can find and remove the code in the ...
1
vote
2answers
247 views
Magento 1.9 Fake customer with address
I have encountered an interesting problem.
One of the magento shops I support has a spam problem.
A lot of fake customer accounts are created, which I could probably solve easily by adding a honeypot ...
