Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Denotes security questions on Magento.

2
votes
1answer
1k views

Blocking bots / hackers from accessing newsletter subscription

I am getting massive amounts of fake newsletter subscriptions - mostly a randomly generated Yahoo email address. I've looked through the logs and there are 50+ IP addresses, seems like it's from a ...
1
vote
2answers
398 views

Malware in Miscellaneous Scripts section in General/ Design tab

OK so google informed me that my website had been compromised and had Malware so they were showing a warning to people coming to my website through Chrome. I have found the Malware it looked ...
8
votes
6answers
5k views

How to check if Magento patch has been installed?

So I just installed recent critical patches SUPEE-5994 + SUPEE-5344 + SUPEE-1533 - through SSH on my server. I did the following steps for installing each patch: Downloaded the patches from: https://...
6
votes
4answers
1k views

Does Magento 1.4.1.1 require patch SUPEE-6788?

I am using Magento 1.4.1.1 and I received a message: "New Magento Security Patch (SUPEE-6788) – Install Immediately" but I could not find patch SUPEE-6788 for Magento 1.4.1.1. Is it required to ...
4
votes
1answer
3k views

Magento 2: How to get registered customer IP

Anyone know how to determine registered customers IP? I have some spam registrations, so I have to block some IPs. If it's not available from M2 backend then by database table or something?
3
votes
1answer
2k views

Which patches do I need to apply on Magento 1.7.0.2

The site http://fabrizioballiano.net/magento-patches/ listes for Magento 1.7.0.2 the following patches: SUPEE-6482: SUPEE-6482 for CE 1.7.x - 1.8.0.0 (0.01 MB) SUPEE-6285: SUPEE-6285 for CE 1.7.0.0 - ...
2
votes
3answers
367 views

Applied Patches but still getting a vulnerable message?

I've applied the patches to both our dev site and our live site. We're running on Enterprise Edition 1.12.0.X so I've downloaded: PATCH_SUPEE-5345_EE_1.12.0.2_V1-2015-02-10-04-17-49.sh PATCH_SUPEE-...
2
votes
3answers
2k views

SUPEE-9767 - Hunk #1 FAILED at 225. 1 out of 1 hunk FAILED

Trying to install the security patch SUPEE-9767 onto M1 EE v1.13.1.0 and i'm receiving the following error: Hunk #1 FAILED at 225. 1 out of 1 hunk FAILED -- saving rejects to file app/design/...
2
votes
1answer
373 views

Patching Magento 1.9.2.0 with Security patch 9767

I get one error trying to patch my Magento. Any ideas whats going on and how to fix it? Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/reverted successfully. ...
47
votes
4answers
13k views

Passwords in sign up email. Bad practice? PCI compliant?

We use Magento Enterprise (1.12) and I have had several customers email me already complaining that they received their password via email when they signed up for an account. I know this is considered ...
14
votes
15answers
8k views

Security Patch SUPEE-10752 - Possible issues?

A new security patch is out for Magento 1, addressing 25 APPSEC issues https://magento.com/security/patches/supee-10752 What common issues do you have to watch out for when applying this patch? ...
8
votes
6answers
7k views

Tools to Scan Magento Code for Malicious Content

We have a client who is very concerned with Malicious code being introduced in third party modules, especially modules that are coming from Magento Connect (Or any free module) They would like to use ...
6
votes
1answer
2k views

Recommended File System Ownership and Privileges

I need help for recommended privileges on my dedicated server. My dedicated server is installed with Debian and on the official documentation of Magento it's recommended to follow the following ...
4
votes
2answers
6k views

SUPEE-5344 - Addresses a potential remote code execution exploit

What will be the major changes in the files after installation of patch SUPEE-5344 for Magento 1.4.2.0? I mean that any particular files permission changes something like that... Please help me for ...
16
votes
3answers
3k views

When is Magento CE 1.9.2 going to be released?

What is the release date for Magento Community Edition 1.9.2? In Magento's official post they say it will be released in "the next few weeks", which is kind of vague. Does anyone know a (unofficial) ...
12
votes
1answer
5k views

SUPEE-9767 V2 Possible problems and solved Issues

Magento just Release Updated version Of SUPEE-9767 and Magento - CE 1.9.3.4. So MY question is which bugs were solved in V2 and do we need to re apply V2 if we already apply v1. And what are the new ...
5
votes
1answer
396 views

Is my site open to MySQL injection?

As I was updating ready for installing the new patches on a site I have inherited, I found this in my reports: a:5:{i:0;s:313:"SQLSTATE[23000]: Integrity constraint violation: 1452 Cannot add or ...
29
votes
4answers
2k views

New patch supee-6788 how to apply patch

After weeks of waiting for the patch today (27.10.2015) it was released: SUPEE-6788 A lot of things were patched and also is encouraged to review installed modules for possible vulnerabilities. I ...
15
votes
2answers
3k views

Why is CSRF protection needed for add-to-cart?

Magento has since recent versions a form_key as part of the add to cart action, to protect against I think CSRF attacks. So now I wonder, is it really needed for this place, and why or better said, ...
9
votes
1answer
1k views

Magento 2.1.1 - Improve security with Content Security Policy

I have a store running fine with the latest version of Magento (currently 2.1.1) and I'm trying to improve security through Content Security Policy on Apache 2.4.7 (Ubuntu 14.04). I had removed all "&...
7
votes
1answer
1k views

What is the form_key used for?

I really don't understand the form_key feature. I have found several sites asking and dealing with issues about the form_key but none explained the reason for it's existence. Everyone just worked ...
6
votes
3answers
3k views

Is there a generic way I can apply input filtering to Magento form processing?

In checking my Magento-powered site for XSS, I've found a couple of problem forms in our custom code, that let users submit arbitrary HTML and script tags that we dutifully inject into our site. (...
4
votes
1answer
382 views

Error after installing patch 7405 on Magento 1.4.0.1

The Magento patch 7405 adds a function to app/code/core/Mage/Adminhtml/Helper/Sales.php that is as follows: /** * Escape string preserving links * * @param array|string $data * @param null|array $...
4
votes
4answers
116 views

Magento CLI options to check Security patch applied or not?

Is there any CLI options to check security patch is applied or not ? How many are pending. I have tried with online tool magereport and many of patch status is unknown. That is why am asking for a ...
6
votes
4answers
816 views

Magento Security Scan not able to verify site

I am trying magento's New Magento Security Tool with below url https://account.magento.com/scanner/index/form/ But i can not Verify Site Ownership, every time when i click on Verify Confirmation ...
4
votes
2answers
873 views

Hackers exploit Magento e-commerce vulnerability

This blog, PC world, claims that the hackers are attacking the e-commerce websites. and I should get updated with the latest patch. Check Point, which found the flaw, reported it to Magento, which ...
4
votes
1answer
578 views

Checkout page loading unauthenticated scripts

I am getting a little shield warning me that my checkout page is trying to load scripts from unauthenticated sources. I am guessing that some file(s) are being loaded via http instead of https, os ...
4
votes
2answers
2k views

How to purge (delete) credit card numbers stored on Magento 1.9.1.0?

We used the 'Saved CC' payment method in our Magento 1.9.1.0 store and now we would like to delete the credit card numbers for security reasons. What is the easiest procedure to delete all credit ...
4
votes
1answer
1k views

Filename of class Varien_Data_Collection_Filesystem getting renamed to Filesystem.php.suspected

We're getting the following error: Magento Fatal error: Class' Varien_Data_Collection_Filesystem' not found Checking the cause of the error, the Filesystem.php file is is renamed to Filesystem.php....
3
votes
1answer
682 views

Security Patch SUPEE-8788 failing at downloader/Maged/View.php (M1 v1.5.1.0) [duplicate]

On magento v1.5.1.0 patch Supee 8788 fails at downloader/Maged/View.php I downloaded a fresh install of Magento v1.5.1.0, copied the downloader file over and retried but still fails with the same ...
3
votes
1answer
900 views

Dangerous URL blocked on Magento checkout by Kapersky Internet Security Scanner

Iam running a website on Magento 1.9.2.2 and I've spotted that checkout pages of this website are being blocked by Kaspersky Internet security Software. This issue happened to myself and also was ...
2
votes
2answers
603 views

Magento security patches installation order

I am using Magento Version 1.6.2.0 I want to know if there there is any order for the installation of the security patches because I have installed the patches SUPEE-5994, SUPEE-6237, SUPEE-6285 and ...
2
votes
3answers
1k views

SUPEE-9767 Error [duplicate]

When I trying to apply SUPEE-9767 in my Magento Community Edition 1.9.0.1 getting following error. ./PATCH_SUPEE-9767_CE_1.9.0.1_v1-2017-05-25-09-15-34.sh Checking if patch can be applied/reverted ...
2
votes
1answer
4k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
2
votes
2answers
3k views

Set Magento MySQL Connection to use SSL

We have a Magento site on a VM with 2GB of RAM. Right now, both Apache and MySQL are running on that same VM. Since that's just not enough RAM for this site, I have been tasked with separating the ...
2
votes
2answers
2k views

Patch 9767 getting invalid Form Key [duplicate]

I just patched my dev machine with Security Patch 9767. And enabled form key on checkout from backend. Also added the form key to my custom theme. But When I tested the checkout process it freeze on ...
1
vote
1answer
146 views

What to do, when I was hacked

Over the past week this Superfish crap has appeared all over my Magento website it's literally hijacked it. What should i do?
1
vote
2answers
348 views

Ho can i install Patch on WAMP localhost

Localhost magento panel securty alert, Community Edition 1.9.X and SUPEE-**** Security Enhancements. The patch download and moved to root folder, run by sh patchname.sh Not working Getting error ...
0
votes
2answers
967 views

SUPEE-10266 cannot be applied to 1.9.3.2 [duplicate]

I am experiencing issues patching the new SUPEE 10266 on Magento 1.9.3.2 The files where the hunks start failing have not been modified by me. Anyone else experiencing the same issue or have managed ...
0
votes
1answer
76 views

My Database may have been affected by Shoplift vulnerability (SUPEE-5344)

I am trying to see all worst case scenario. My one of the site may have been shoplifted. Now, I am in process of quarantine it first then start fresh site with fresh files. However, I do need ...
0
votes
1answer
155 views

admin user and password stolen

For a few weeks, my admin and user password are stolen. I followed all the rules against brute force, but after a few days, after I restore the website with the old backup, I found a new admin user ...
7
votes
1answer
4k views

Why does Magento POST to its own /app/etc/local.xml?

It seems to be initiated at admin operations, such as catalog save/edit. As seen in the logs. The client IP for the POST is the server's internal IP. 302 2014-08-30T06:43:40+00:00 POST /index.php/...
7
votes
2answers
3k views

Admin routing compatibility mode for extensions: Enable or Disable?

I have just updatet my store to the latest Magento CE 1.9.2.2 software version (not the Patch SUPEE-6788, I did the full core update using the Magento Downloader). After the update I went to System &...
5
votes
1answer
13k views

Getting “access forbidden by rule” error at magento in nginx server /app/etc/local.xml

I am getting this error for my website which is built on magento-1.9.0. 2015/07/13 05:50:44 [error] 1371#0: *491517 access forbidden by rule, client: **.***.***.***, server: www.example.com, request: ...
5
votes
1answer
706 views

MageReport: “Malicious code found, you are vulnerable” - possible false positive?

I get a warning for one of our sites on magereport.com about the famous Credit Cart Hijack: Credit Card Hijack detected? But there is nothing added to "Miscellaneous HTML" or "Miscellaneous ...
4
votes
1answer
4k views

Password Requirements Complexity - Magento

I would like to increase password security for customer and admin accounts in Magento. In addition to minimum password length, contain uppercase, lowercase, special characters, and digits. I found ...
4
votes
1answer
5k views

What encryption model does Magento1 use?

I want to know what encryption methods are used by Magento. Is it simple md5 or salted or SHA? Where can I look into it in detail? I looked for code for md5 encryption in Mage_Core_Model_Encryption, ...
4
votes
2answers
196 views

How to know which Patches to Install?

Just downloaded the latest Magento Community Edition v1.9.1.1 and the first thing that popped up when I logged into the admin was that there were important security patches. I installed SUPEE-5994 as ...
3
votes
1answer
1k views

SUPEE-5994 Patch Bundle Admin Path Disclosure - Fix Not Working?

I've applied the SUPEE-5994 Patch Bundle to Magento v1.9.0.1 this morning on a development system, and I'm still able to get to the 'hidden' admin login when calling a module directly. Compilation is ...
3
votes
3answers
1k views

Magento SUPEE 9697 1.9.2.2 fails at Image.php

I'm attempting to apply patch 9697 (via patch PATCH_SUPEE-9767_CE_1.9.3.0_v1-2017-05-25-09-09-56) to Magento CE 1.9.2.2 however it's failing. The log states: Hunk #5 succeeded at 485 (offset 1 line)....