Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
107
votes
30answers
49k views

Security Patch SUPEE-8788 - Possible Problems?

The latest Magento 1 security patch SUPEE-8788 contains 17 APPSEC updates, so it is very important to apply it as soon as possible. On the other hand, there are many potential backward compatibility ...
107
votes
23answers
35k views

Security Patch SUPEE-9767 - Possible issues?

A new security patch is out for Magento 1, addressing 16 APPSEC issues: https://magento.com/security/patches/supee-9767 Seven of the vulnerabilities score 8.0 or higher for CVSSv3 Severity, and they ...
139
votes
15answers
53k views

Security Patch SUPEE-7405 - Possible Problems?

It's time for another patch day, SUPEE-7405 for Magento 1.x is out and the list of fixes is long: https://magento.com/security/patches/supee-7405 After the experience with the last patches, I have to ...
50
votes
6answers
31k views

Critical Reminder: Download and install Magento security patches. (FTP with no SSH access)

The Magento security patches look like they are .sh files, how would someone apply these patches without SSH access to their Magento installations? Also, are these patches cumulative? IE: Will they ...
37
votes
9answers
15k views

Security Patch SUPEE-10415 - Possible Issues?

New Magento 1 patch has been released, SUPEE-10415. This patch provides protection against several types of security-related issues Info page: https://magento.com/security/patches/supee-10415 ...
35
votes
11answers
11k views

Security Patch SUPEE-10266 - Possible issues?

A new security patch is out for Magento 1, addressing 13 APPSEC issues https://magento.com/security/patches/supee-10266 What common issues do you have to watch out for when applying this patch? ...
84
votes
3answers
24k views

Access Denied errors after installing SUPEE-6285

After installing the SUPEE-6285 patch on our Magento 1.7.0.2 store the system is showing an "Access Denied" error when attempting to access all custom modules for users who have selective permissions (...
44
votes
4answers
48k views

How to check the latest patch version applied to magento?

I just applied the security patch PATCH_SUPEE-5344_CE_1.8.0.0_v1-2015-02-10-08-10-38.sh Since I have no SSH access to the web server, the provider did the work for me. How can I check by myself if ...
16
votes
2answers
6k views

Magento hacked even after applied patch

Some days before my Magento community edition 1.8.1 site is hacked, because we are late to apply the patch. we found certain files were changed those are index.php [hackers added some code to it]. ...
45
votes
16answers
11k views

Security Patch SUPEE-10570 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10570 SUPEE-10570, Magento Commerce 1....
29
votes
4answers
23k views

Recommended method to protect /downloader?

Since Magento uses the /downloader as a way to conveniently install programs via Magento Connect Manager it is apparent that this is also a security concern since it allows the possibility for bots or ...
21
votes
5answers
15k views

Why does PATCH_SUPEE-6788 appear to have no effect on a 1.7.0.2 installation?

Note: This issue appears to apply to all versions of Magento which received the SUPEE-6788 patch. You'll see in my answer that both .htaccess and .htaccess.sample need to be restored for the patch ...
7
votes
4answers
2k views

Upgrading compromised Magento from 1.7 to 1.9

I've been doing some research but there appears to be multiple solutions, and I want to get it right. I need to upgrade my Magento from 1.7.0.2 to the latest (1.9) being that our server was ...
5
votes
3answers
756 views

Security Patch (SUPEE-6285) – Install Immediately In Magento 1.9.0.1

How To Resolve New Magento Security Patch (SUPEE-6285) – Install Immediately In Magento 1.9.0.1 please find the below image I have tried this code passthru("/bin/bash PATCH_SUPEE-6285_CE_1.9.1.1_v2-...
71
votes
5answers
17k views

How to check which modules are affected by security patch SUPEE-6788

On October 27, 2015, Magento has released security patch SUPEE-6788. According to the technical details, 4 APPSEC's that have been fixed require some rework in local and community modules: APPSEC-...
21
votes
6answers
36k views

What permissions should I give /var and /media?

I understand that magento says to have /var and /media at 700 for folders and 600 for files but when I do this, it breaks certain parts of my site. I am curious to see what permissions most people use ...
27
votes
4answers
27k views

How to escape output data?

Is there a built-in Magento helper to escape outputted template data to prevent XSS? Or should I just use the PHP htmlspecialchars or htmlentities functions?
19
votes
6answers
13k views

SUPEE-9767 Patch/CE 1.9.3.3 - One Page Checkout - Customer Registration issue

On a clean, vanilla install of Magento 1.9.2.4, patched with SUPEE-8788, SUPEE-9652 and SUPEE-9767, and with the new 'Enable Form Key Validation On Checkout' setting turned on, following a successful ...
10
votes
5answers
15k views

Restrict access to admin area by IP

What is the best way to restrict the access to the admin area by IP in Magento? Bear in mind that admin can work either from /admin or index.php/admin
9
votes
1answer
4k views

ERROR: “/app/etc/” must exist for proper tool work magento 1.9

I am trying to install the newly release security patch for magento 1.9. I am working on window system. and I am getting the following error. D:\xampp\htdocs\magento>sh PATCH_SUPEE-1533_EE_1.13....
8
votes
5answers
10k views

How to apply the Magento 2 patches?

I'm using the Magento 2.1.6 and I want to apply the patch CE-MAGETWO-67805.patch. How can I apply the *.patch files?
2
votes
1answer
3k views

After applying SUPEE-6788 , cron stopped working

I am using 1.9.2.1. After applying SUPEE-6788 , cron stopped working. Why?? I attached the cron setting of my system.
4
votes
4answers
5k views

Magento 1.9.2.0 SUPEE-8788 v2 Hunk #1 FAILED at 91 after reverting SUPEE-1533 [duplicate]

I reverted SUPEE-1533 as suggested successfully but when I try to patch SUPEE-8788, I get "Hunk #1 FAILED at 91" Please see the log below sh PATCH_SUPEE-8788_CE_1.9.2.0_v2-2016-10-14-09-39-55.sh ...
29
votes
2answers
6k views

Magento 2: template security: which method to use?

I'm aware Magento 2 has several methods available to secure the template: $block->escapeHtml() $block->escapeQuote() $block->escapeUrl() $block->escapeXssInUrl() But I'm wondering when ...
24
votes
17answers
5k views

Security Patch SUPEE-11086 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible." ...
16
votes
15answers
6k views

SUPEE-10975 Potential Issues

SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support? So far these ...
6
votes
1answer
9k views

Error while Patching Security Patch (SUPEE-6285)

While trying to patch magento, which I have done a few times now with prior patches successfully, I encountered an issue with this latest patch. Checking if patch can be applied/reverted successfully....
25
votes
6answers
14k views

SUPEE-6285 patch, what has been changed?

OK, somebody has to ask this: today, 7/7/2015 a new security patch for Magento < 1.9.2 has been released. update your shops ASAP! But what has been changed? Are there known exploits of the ...
26
votes
18answers
5k views

Security Patch SUPEE-11155 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What common issues do you have to watch out for when applying this patch/upgrade? Magento 1 https://magento.com/security/...
16
votes
4answers
4k views

SecurityPatch 9652: Possible problems after SUPEE-9652 applied

Magento has released its security patch SUPEE-9652, for Magento 1.x CE and EE I just want to know what are the possible problems after applying this security patch and What are the new changes in ...
12
votes
3answers
2k views

Should I upgrade or patch Magento?

I am currently patching Magento with the latest patches and wondered whether it is worth applying the patches or upgrading to the latest version? As far as I can tell the only changes seem to be the ...
4
votes
2answers
304 views

Carding attack on website

I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal. This doesn't seem to be doing enough to stop the attacks. Paypal threatens to shut off my account, ...
2
votes
3answers
214 views

Probably security issue

Some months ago i have patched my magento with: SUPEE-1533 SUPEE-5344 SUPEE-6285 SUPEE-5994 SUPEE-6482 SUPEE-6788 and i patched using this instruction https://magentary.com/kb/install-supee-6788-...
10
votes
2answers
844 views

Why is using {{base_url}} in a production server not recommended?

This is for intelectual purposes only, as I am curious. Searching through google, I cannot find a definite answer to this, so as the subject says, why is it not recommended? What can go wrong? The ...
4
votes
1answer
1k views

Spam bots & SQL Injections - How do I stop this?

how do I stop this? Hundreds upon hundreds of these searches.
1
vote
2answers
4k views

5344 security patch installation error in Magento

Showing given below error, While I am installing the patch file in my Magento version 1.4.2.0. Please help me to find out the reason for the error! Checking if patch can be applied/reverted ...
27
votes
3answers
978 views

Magento Security Punch list

It is very often that we take a site from another firm and now we are stuck with a conglomeration of code and potentially dozens of people who have worked on a site. I am looking for a punch list of ...
22
votes
3answers
8k views

How did they find my custom admin URL?

I have a custom admin url, still I saw someone trying to login into admin. I even changed it, and shortly after the next login was tried. How could this happen, I thought its secure?
21
votes
16answers
7k views

Security Patch SUPEE-10888 - Possible issues?

SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues. https://magento.com/security/patches/supee-10888 SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3....
17
votes
4answers
3k views

How can I tell if a corrupt image file is being used for credit card skimming?

I'm working with a site that I believe has been hacked to collect customer credit card data, but I can't be certain. I did not find any suspicious code in the common places I've seen suggested in ...
8
votes
1answer
4k views

Is magento http/https secure or should the entire website be forced to use https?

I'm setting up a magento website but one thing i've noticed is https can be used only for secure content such as login pages and account details etc. This means on product pages regular http is used. ...
5
votes
5answers
1k views

Magento Hacked: displays list of user emails and error message

-My client suspects his site was hacked,I'm not sure, but when I open index.php I get a list of emails and usernames, and what appears to be encrypted passwords (please correct me if I'm wrong). I ...
4
votes
3answers
2k views

Shoplift vulnerability if admin panel is hidden?

Among the six installations I have access to there's one that was apparently compromised by Shoplift. This is the only one that has a standard /admin backend url. After patching all of them and ...
5
votes
1answer
3k views

Is it necessary to override _isAllowed in your Admin controller?

The _isAllowed method is where you, as a Admin Panel programmer, should place your ACL checks. As you can see, by default, this method returns true. That means if you don’t define your own ...
0
votes
1answer
416 views

Critical security Patches [duplicate]

I got this Notification message every time i open the admin. Can anybody tell me in detail what to do ? How to install these patches ?
8
votes
2answers
1k views

Using different escaping methods

I noticed class vendor/magento/framework/Escaper.php which contains a few useful security methods used inside (mainly) templates. Some of them are quite common (escapeHtml()), but some of them are ...
5
votes
4answers
4k views

Magento 1.9.1.0 patch SUPEE-6788 1 out of 1 hunk ignored missing .htaccess.sample

I am using Magento 1.9.1.0 and tried to install the new patch SUPEE-6788 through SSH but getting ERROR below. I am not able to understand what's wrong and where exactly the error lies I have ...
5
votes
1answer
472 views

What files/folder do not belong on production?

Some community members suggest that folders like downloader and dev don't belong on a production environment. Is there an official list somewhere? What else has no place on the production server?
4
votes
1answer
873 views

Protect a site from wappalyzer [duplicate]

It's possible to protect a website built with magento to the scan activity of some CMS detector, like Wappalyzer?
3
votes
1answer
2k views

failed while applying security patch SUPEE-6285 [duplicate]

i got error while applying SUPEE-6285 i saw online that i have to apply SUPEE-5994 and i got this error when i applied: $ Sh PATCH_SUPEE-5994.sh Checking if patch can be applied/reverted ...