Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
4
votes
1answer
5k views

What encryption model does Magento1 use?

I want to know what encryption methods are used by Magento. Is it simple md5 or salted or SHA? Where can I look into it in detail? I looked for code for md5 encryption in Mage_Core_Model_Encryption, ...
3
votes
1answer
1k views

SUPEE-5994 Patch Bundle Admin Path Disclosure - Fix Not Working?

I've applied the SUPEE-5994 Patch Bundle to Magento v1.9.0.1 this morning on a development system, and I'm still able to get to the 'hidden' admin login when calling a module directly. Compilation is ...
3
votes
1answer
2k views

Suddenly started using another logged in user's session - Magento 2

This might be too broad of a question but it is a gigantic security issue and I have no idea where to start debugging this. I was testing some features on my dev server while someone else was logged ...
3
votes
1answer
133 views

Access Denied errors showing for a permission assigned user (created custom module) after installing SUPEE-6285

I installed SUPER-6285 patch on our Mangeto 1.13.1.0. and created a custom module for sales and assign that modules to a user. Showing access denied for that users I applied the below function in my ...
3
votes
3answers
1k views

Magento SUPEE 9697 1.9.2.2 fails at Image.php

I'm attempting to apply patch 9697 (via patch PATCH_SUPEE-9767_CE_1.9.3.0_v1-2017-05-25-09-09-56) to Magento CE 1.9.2.2 however it's failing. The log states: Hunk #5 succeeded at 485 (offset 1 line)....
2
votes
3answers
4k views

SUPEE-9767 ERROR: Patch can't be applied/reverted successfully

Trying to apply newly released patch on our Magento EE 1.14.3.2 but getting the following error. bash PATCH_SUPEE-9767_EE_1.14.3.2_v1-2017-05-22-07-20-39.sh Checking if patch can be applied/reverted ...
2
votes
2answers
48 views

Magento cloud hosted M2 EE site compromised and got malware attack

Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url: <script src="http://write-cdn.com/...
2
votes
1answer
88 views

I've just applied SUPEE-9767 to a Magento 1.6.2.0 site and there is no formkey option to enable. How has this happened and how can I fix it please?

I have applied the SUPEE-9767 patch for the correct version (1.6.2.0) of Magento and in the admin area, I can see the warning at the top of the page, indicating that the patch was successful. However,...
2
votes
3answers
450 views

Can we IP protect the Magento Cron?

Is it ideal to IP protect the Magento cron.php? instead of folder protecting it (as referred in the http://devdocs.magento.com/guides/v2.0/config-guide/secy/secy-cron.html) because we want to harden ...
1
vote
1answer
188 views

What else adds order comments?

I have a task to add a WYSIWYG editor on the admin order comments. So far so good. I was able to make it work. But I have a concern. By default order comments are escaped when listed and only a few ...
1
vote
3answers
330 views

Magento website redirect to “https://ribinski.us/redirect_base/redirect.js” [duplicate]

I am using Magento 1.9.2.1. It is redirecting me to another website https://ribinski.us/redirect_base/redirect.js. When I checked the code then someone added the following code in the Admin header ...
1
vote
2answers
3k views

SUPEE-8788 and SUPEE 1533 (How to approach?) [duplicate]

As many are aware if you have SUPEE 1533 installed you cannot install SUPEE 8788. I figured that Reversing/uninstalling Supee 1533, we can install SUPEE 8788. But, then we cannot install SUPEE 1533 ...
1
vote
2answers
2k views

SUPEE-8788 patch can't be applied [duplicate]

I am trying to apply the SUPEE-8788 (PATCH_SUPEE-8788_CE_1.8.1.0_v2-2016-10-14-09-35-11.sh) on a Magento 1.8.1.0 installation. However when I run it I get a: ./PATCH_SUPEE-8788_CE_1.8.1.0_v2-2016-10-...
1
vote
1answer
42 views

SUPEE-6285_CE_1.9.0.0 - 1.9.1.1 [duplicate]

What is the mean of this security patch. SUPEE-6285_CE_1.9.0.0 - 1.9.1.1 Is it compatible from version 1.9.0.0 to 1.9.1.1 or Is it compatible with only 1.9.0.0 - 1.9.1.1
1
vote
2answers
198 views

Is there any necessary for patches if i have installed Magento 1.9.2.4

Currently i have upgrade my Magento from 1.9.2.3 to 1.9.2.4 So should i also need to install patches ? I have followed these links (https://www.magentocommerce.com/download?_ga=1.263831883....
1
vote
1answer
344 views

what are the sequence of mutliple patches apply on magento 1.7.0.2

Have a magento instance C.E 1.7.0.2. Any patches did not applied on this instance and now want to apply patches. As per as @benmarks sheet . require to apply patches below patches: SUPEE-6482 SUPEE-...
1
vote
0answers
730 views

Implimenting a Content Security Policy Magento 1.9.x

I'm looking to improve the security of my site with a Content Security Policy. I have set one up for my site in htaccess (using Content-Security-Policy-Report-Only and doing everything possible to ...
1
vote
1answer
583 views

Problems installing SUPEE-6788 patch on 1.9.2.1

Having issues while installing the SUPEE 6788 patch. First issue was I was using a custom edited .htaccess file. I've now replaced with the stock version for 1.9.2.1 but still getting errors as seen ...
0
votes
1answer
150 views

Data Security has been compromised

In my Magento 1.9 store, some of the Customer's Default Billing name and Address has been amended. I first got to know this when one of my customer complained to me about their name that has been ...
0
votes
3answers
2k views

Magento: Allowing insecure content on https pages

I'm facing an issue and I have no idea how to solve it. I use on another websites (which aren't developed in Magento) a jQuery script that gets an address once we type the zip code (a lot websites in ...
0
votes
3answers
2k views

how to remove security patches from magento site

we installed magento security patches before one month after that we did lot of chnages to our site. now some features are not working that was working before one month. we are not sure whether ...
0
votes
1answer
194 views

Magento 1 - Patch SUPEE-10415 is not applied

I have tried to apply path SUPEE-10415 to magento 1.9.1.0, but its won't succedeed. Please find the report below. Checking if patch can be applied/reverted successfully. ERROR: Patch can't be ...
0
votes
0answers
44 views

Magento 2.2.2 Security Patch Issue

I have download PRODSECBUG-2233 from magento official site patch -p1 < PRODSECBUG-2233-2.2.x-2019-07-26-08-35-48.patch When i try to use this command, it's not working and show me this errors. ...
0
votes
1answer
923 views

Magento 1 end of life on Nov. 2018 or not?

Please see this answer by an internal staff of Magento who states that: Magento 1.x end of life is November 2018. However on their official blog, this post states: Magento 1 has been and will ...