Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
0 votes
2 answers
40 views

Magento 2 : Spam Order Getting Placed

I have a simple store running on Magento 2.4.6 p2, with guest checkout disabled. I have added Google captcha on registration as well as login form. Still, once in a while, I receive spam orders like ...
Aniruddha Ray's user avatar
0 votes
1 answer
83 views

How to install Install APSB24-18 Patch in Magento 2?

My hosting provider send me mail regarding patch installation on my store, but I want to know how I can install this patch on my store. Adobe does not provide any kind of documentation regarding this: ...
Mark Philips's user avatar
0 votes
1 answer
47 views

How I could install HtmlPurifier in my custom module?

I made my own form: <?xml version="1.0"?> <form xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Ui:...
Dimitrios Desyllas's user avatar
0 votes
1 answer
203 views

Does magento2.4 sanitizes form input in order to avoid XSS or I have to implement my own methods?

I made my first form: <?xml version="1.0"?> <form xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Ui:...
Dimitrios Desyllas's user avatar
0 votes
1 answer
283 views

Magento 2 Payment Method Hacked

My website's checkout was hacked this 4th time. The hacker somehow modifies the following files: lib/web/jquery.js vendor/magento/framework/Interception/Interceptor.php vendor/magento/framework/...
Arsalan Ul Haq's user avatar
1 vote
1 answer
36 views

How to stop attackers to execute script and run 100 requests to create account?

On client magento website has enabled google captcha version 2 on create account page. exception.log file has following errors (Magento\\Framework\\Stdlib\\Cookie\\CookieSizeLimitReachedException(code:...
Niraj Patel's user avatar
0 votes
2 answers
174 views

when logout Why i have to wait 5 second to redirect to homepage?

Would someone explain me for this feature please ? I do ask GPT , it say "It is designed to prevent potential security vulnerabilities, such as session fixation attacks." "This delay ...
Phạm Hòa's user avatar
2 votes
2 answers
971 views

How to install Security Update patch APSB23-35

is there any way to download the patch APSB23-35 and manually apply it ? I have several older Magento2 installations, and update them is a time consuming task - so i was wondering if there is a "...
Armindo Pereira's user avatar
0 votes
2 answers
62 views

Magento 2.3.7 orders mysteriously disappeared

I'm hoping this isn't an indication of some kind of breach/vulnerability. We recently discovered two orders where the buyers attempted to execute php using the ShipTo name. The code meant to append a ...
lbbrooks's user avatar
1 vote
1 answer
258 views

How can i check Magento site request comes from other unknown website in Magento 2?

for my Magento site marketing I use backlink,so some backlinks are right and some others are not not ok I need to block my site access from unknow sites backlink. i used htacces code but that not ...
Jay Parmar's user avatar
0 votes
1 answer
142 views

Magento2 - Secure your store from CSRF

Can anyone let me know how can I Secure store from CSRF. I am facing vulnerability issue like - Form Can Be Manipulated with Cross-Site Request Forgery (CSRF). Is this issue solved in Magento 2.4.4 ...
user3411's user avatar
  • 134
0 votes
2 answers
572 views

I get a strange search result when searching a couple of collections, but others are as they should be

It's puzzling. For example, when I search for "classic", I get a strange search result: Related search terms classic style 394 classic') AND 6096 IN (SELECT (CHAR(113)+CHAR(106)+CHAR(120)+...
pegeen's user avatar
  • 1
2 votes
1 answer
97 views

Magento2 Malware and security issues

We noticing since last few months that Magento instances are affecting of malware on the Magento2 sites? For example: health_check.php attack - this file compromised Credit card fields were update ...
Dharmendra Patidar's user avatar
2 votes
1 answer
118 views

Are the security fixes for Cross-Site Scripting introduced in 2.4.5-p1 and 2.4.4-p2 relevant to 2.4.3 systems?

Some of our shops are still running on 2.4.3-p3. From how I understand the most recent security patch notes, the security issues concerning Cross-Site Scripting are only relevant for 2.4.4 and 2.4.5 ...
Hurrpadurr's user avatar
1 vote
1 answer
3k views

Magento 2.4.4 - Can not resolve reCAPTCHA parameter

I just installed a new Magento 2.4.4 and configured the captcha inside Configuration > Security > Google reCAPTCHA Admin Panel. I tried configuring: reCAPTCHA v2 ("I am not a robot") ...
Rafael Corrêa Gomes's user avatar
5 votes
13 answers
7k views

Magento 2: Fake customer order came through with weird code instead of customer name

Just had a fake order come through on my Magento 2 website. The address is nonsense and instead of a customer name it had this code: {{ var this.getTemplateFilter().filter($order.shipping_address....
Bella's user avatar
  • 51
0 votes
0 answers
382 views

Magento 2: NO RATE LIMIT IMPLEMENTED

During Penetration Test Scan it is found that website did not implement any rate-limiting on contact us page, Attacker can submit multiple forms and spam the database with false queries. ...
Paras Arora's user avatar
1 vote
0 answers
69 views

How to Configure Magento 2 Security Scan?

Can anyone please explain STEP-BY-STEP PROCESS TO CONFIGURE MAGENTO 2 SECURITY SCAN? Thanks
Kuldeep Sharma's user avatar
1 vote
2 answers
387 views

Security update for Magento Open Source APSB22-12 Which version?

I need to run the new security patches on Magento Open Source 2.4.3 - 2.4.3-p1 but Adobe don't actually elaborate on how to choose the correct version. My guess would be the COMPOSER version, but I ...
SilkSpin's user avatar
  • 192
2 votes
1 answer
1k views

Magento2.4.2 Too many password reset requests

About to migrate. I get this issue for Admins. I need to disable this so my team (18 people) can choose their own passwords. Can I disable this ? If only for an hour or so.
RoboxFuze's user avatar
  • 119
0 votes
1 answer
43 views

Do Security updates require a compile?

I would like to apply the security hotfix for the recently found vulnerabilites: https://support.magento.com/hc/en-us/articles/4426353041293-Security-updates-available-for-Adobe-Commerce-APSB22-12- Is ...
Hurrpadurr's user avatar
1 vote
1 answer
384 views

How to know if my ElasticSearch is vulnerable against Log4j?

I don't have Java installed in my main Docker, but I'm using ElasticSearch v6.8.3 in another instance. curl -XGET 'http://localhost:9200' Am I vulnerable against Log4j even not running ElasticSearch ...
Rafael Corrêa Gomes's user avatar
1 vote
2 answers
496 views

How to check Log4j in Magento installation?

I don't know if my Magento server is infected by Log4j, how could I check it?
Rafael Corrêa Gomes's user avatar
1 vote
2 answers
1k views

Prevent Bot traffic with .htaccess on Magento 2?

How to prevent(block) bad bots traffic with .htaccess for Magento 2 ? What you recommend ? I do not know how to do this. And which codes in .htaccess I need to modify. Or Do we have any other ...
Kaan Burak's user avatar
1 vote
2 answers
360 views

Magento2 Apply Patches

I have some customers that use some "older" Magento 2 versions, like for example 2.3.4. I would like to keep the store updated with the latest security patches but without doing a full ...
Armindo Pereira's user avatar
0 votes
1 answer
360 views

Unable to find 2FA tab under security tab in store configuration

I want to enable 2FA for admin login in Magento 2.4.2 but it is missing. Thanks
Nilesh Dubey's user avatar
  • 1,087
1 vote
1 answer
224 views

JavaScript url being stripped out of html

I have a very odd issue happening that I have been struggling with and can't find answer to. We have a 3rd party module to add GTM to the site and after doing a deploy the GTM is fine. After a ...
Trevor Orr's user avatar
-1 votes
1 answer
4k views

How to disable Magento 2 Content Security Policy with theme edit only

I have searched alot on the internet and I want to hide this error (magento 2.4) content security policy error , we don't have authority to disable magento_csp module and we can not create module, we ...
samair ali's user avatar
0 votes
1 answer
237 views

Make action available only for admin

I added a button to admin order view which sends request to an url of an action controller (using ajax), and now I need to somehow make it available only for admin. What is the best solution for this ...
Igor Atsberger's user avatar
1 vote
1 answer
134 views

Security issue ? User with restricted scope can access ALL orders on a multiwebsite setup

Using Magento Cloud EE here but this issue might be the same on CE I'm not sure. Create user foo Create role test Assign foo to test Restrict website scope for test to www.website1.com only Login ...
Sorcy's user avatar
  • 128
1 vote
0 answers
101 views

Magento 2.2 - Mage-Report Exposed Magento 2 API

Magento 2.2.3 I have scan the website in Mage Report, How to solve Exposed Api issue. What magento2 patch for this instead to upgrade version.
Sourav's user avatar
  • 1,298
0 votes
1 answer
306 views

Payment Failed Emails M 2.3.5 - Not working for us

We are currently using Magento 2.3.5 From my understanding, payment failed emails are sent when a transaction fails. By fails I hope that this means it is declined or voided by the payment method. ...
shimon's user avatar
  • 41
1 vote
0 answers
170 views

prevent brute force attacks on the discount codes

Is there a way to prevent brute force attacks on the discount code input eg limit the number of discount codes a customer can enter a day?
Goose84's user avatar
  • 2,611
1 vote
1 answer
578 views

Script injection below body tag in Magento 2.4.1

I upgraded our Magento from 1.9 to 2.4.1 after we found malware that was trying copy customer credit cards before allowing the customer to use PayPal. I used Magento's migration tools to copy data to ...
Kiwi-9080's user avatar
1 vote
0 answers
258 views

"Catalog Search index process unknown error:" 403 Forbidden

My System info: Apache2 /php7.4(mod-security, mod_proxy) /Mysql8 /Elastic7.10 After a fresh installation of M2.4 and configure it for the E7 with Apache proxy port 8080 to 9200. When I tried to run ...
MJC's user avatar
  • 13
1 vote
1 answer
532 views

Is the Magento 2 file system allowed to be owned by www-data? + Permissions question

I work at a company where I noticed that most of our Magento 2 file system is owned by www-data and in the www-data group on our Ubuntu server.Furthermore, the docroot directory /var/www/<...
audio-engineer's user avatar
0 votes
1 answer
1k views

How to check Magento Cloud patches available?

My Magento 2.3 Cloud is not updated, and I see some issues that when I reporting to Magento they send me a patch already released. Is there a way to see the list of patches available?
Rafael Corrêa Gomes's user avatar
0 votes
1 answer
257 views

How to fix XSS in website in url ? Magento 1

I can see that browsing url like this https://www.anywebsite.com/?p=%3Cscript%3Ealert(document.cookie)%3C/script%3E shows alert into browser window. Is their any way to prevent it ? its XSS.
Hamendra Sunthwal's user avatar
0 votes
0 answers
66 views

Category/search images not showing in Firefox

I get Content Security Policy errors in Firefox. I have a CSP module that handles this just fine in Chrome, but this remains an issue in Firefox. Are there more steps that have to be taken to make ...
web master's user avatar
0 votes
1 answer
75 views

Phishing Attack - Magento 1.9 - Too many Get method request for customer login page - Site Down

The IP : 167.172.230.190 hit my customer login page too many hits makes my server down Screenshot : https://snipboard.io/kde4fw.jpg Notes : Custom login page captcha enabled, added that IP in IP ...
zus's user avatar
  • 165
2 votes
3 answers
2k views

Two-Factor Authentication Invalid in Magento 2 admin panel

My client enabled 2FA (Two-Factor Authentication) in the Magento 2 admin panel, but every time that I scan the code to have it configured in my Google Authenticator and try to enter the code, it's ...
Rafael Corrêa Gomes's user avatar
0 votes
1 answer
107 views

Basic Auth / Restricting backend admin panel for M1

Good evening. Should it not be possible toeither restrict or use basic auth on the admin panel for login? Just as an extra security layer. Can there be any flaws/errors regadring 3rd party extentions ...
Andreas Therkildsen's user avatar
2 votes
1 answer
941 views

Magento 2 module to log failed login attempts, for Fail2ban

I want to log failed login attempts to the admin backend of Magento 2 to a simple text file, to later be consumed by Fail2ban easily. E.g. for every failed login attempt, the module would add a line ...
Danila Vershinin's user avatar
10 votes
1 answer
4k views

Sanitizing HTML output in templates in 2.4

Before 2.4 the way you could sanitize an html value in a template was to use $block->escapeHtml($valueHere);. Where $blick is the instance of the current block. This still works in 2.4, but the ...
Marius's user avatar
  • 198k
0 votes
1 answer
233 views

Magento 2 and SELinux

So it turned out that SELinux is causing all the issues I've been having with USPS shipping calculation and Paypal redirecting. This is my current stack: 2.3.5p1 CentOS 8 PHP 7.3.18 Apache/2.4.37 ...
J W's user avatar
  • 33
1 vote
0 answers
77 views

5 malicious files found in Magento with a malware scan - are they for real or false positive?

Magento 1.9.x Softaculous installer in Cpanel A malware scan on our server has detected the following 5 malicious files - are these really problematic or could these just be false positives? /home/...
Allysin's user avatar
  • 260
0 votes
2 answers
343 views

Why is BitDefender flagging Magento 1 sites as containing malware

I'm not sure if this is the right place to ask this question, so apologies in advance. I've just noticed that several Magento 1 sites I look after including development sites are now being blocked by ...
Mark H's user avatar
  • 53
0 votes
1 answer
107 views

Static content deploy generate thousands of weird folder names

i've run setup:static-content:deploy -f and now i'm getting a lot of strange folders on my pub/static/frontend folder For example one folder has the name "G7oLVFdw'; waitfor delay '0:0:6' -- " This ...
Armindo Pereira's user avatar
19 votes
10 answers
30k views

Magento 2.3.5-p1 CSP font-src self unsafe-inline

In regarding to CSP I create own csp_whitelist, but still I am getting: The Content Security Policy 'font-src 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag....
Konrad Siamro's user avatar
5 votes
4 answers
15k views

How can I fix "Refused to load the stylesheet because it violates the following Content" in Magento 2.3.5

I've recently upgraded to Magento 2.3.5 and I've been encountering an issue with my Content Security Policy when trying to load a style sheet. The error (Chrome dev console): I've added maxcdn to ...
Hunter's user avatar
  • 809

1
2 3 4 5
14