Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
3
votes
1answer
133 views

Access Denied errors showing for a permission assigned user (created custom module) after installing SUPEE-6285

I installed SUPER-6285 patch on our Mangeto 1.13.1.0. and created a custom module for sales and assign that modules to a user. Showing access denied for that users I applied the below function in my ...
3
votes
1answer
1k views

Other customers address show on checkout - security bug in magento

We have an issue with magento checkout - A customer logged into his account and in checkout page wrong address is shown and the interesting fact is that it is some other customer's address. The same ...
3
votes
1answer
57 views

Shell script dumps Model source code

Weird things happening. I've written a customized product import script which is executed as a shell script. In this script, I gather some XML input, parse it into an array and then try to import the ...
3
votes
0answers
19 views

Magento2 Security: How to best filter GET parameters before they reach Magento?

I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
3
votes
1answer
193 views

Magento 2 Set Previous Password History

I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last ...
3
votes
0answers
51 views

Magento 2 admin backend security

In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
3
votes
1answer
152 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
3
votes
1answer
24 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
3
votes
0answers
483 views

Security Patch SUPEE-10975 - Possible issues? [duplicate]

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10975 SUPEE-10975, Magento Commerce 1....
3
votes
1answer
99 views

Can anyone have any idea of security patch file of SUPEE-9652 V2?

As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
3
votes
1answer
584 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
3
votes
0answers
109 views

Removal of .orig files

In patching some Magento sites the patch leaves behind a .orig version of some of the files that were patched. I've been removing these from version control but was curious is there's any purpose to ...
3
votes
0answers
179 views

get.php in server logs - security issue?

I noticed multiple hits per day on get.php in the access logs of a Magento 1.14 store, resulting in PHP errors and a HTTP 500 response. Some of them have bot user agents like facebookexternalhit/1.1 (...
3
votes
0answers
148 views

Magento 2 filesystem permissions [closed]

In Magento 2 we have a new filesystem permissions guidelines. Reading this link I understand that Magento requires php user inside www-data group. What I do not understand is why static filesystem ...
2
votes
4answers
7k views

Newsletter Spam Subscriber

I got 700 Newsletter subscribers per day for my site, the subscriber name and email id not relevant. What is the possible way to prevent. I think these are all spam accounts.
2
votes
2answers
1k views

2 Step Authentication for admin URL

I want to add 2 step Authentication to an admin back end URL to my clients online Magento shop. I don't want to use a google app authentication or a phone app/sms system. I want a master Username/...
2
votes
4answers
179 views

Magento 2.3 secure your site back and front

Got a very security conscious client. I've searched stack exchange and only found partial solutions to certain security issues. I've also searched dev docs and again found one or two suggestions in ...
2
votes
3answers
4k views

SUPEE-9767 ERROR: Patch can't be applied/reverted successfully

Trying to apply newly released patch on our Magento EE 1.14.3.2 but getting the following error. bash PATCH_SUPEE-9767_EE_1.14.3.2_v1-2017-05-22-07-20-39.sh Checking if patch can be applied/reverted ...
2
votes
2answers
2k views

Patch 9767 getting invalid Form Key [duplicate]

I just patched my dev machine with Security Patch 9767. And enabled form key on checkout from backend. Also added the form key to my custom theme. But When I tested the checkout process it freeze on ...
2
votes
3answers
3k views

How to Block RSS in .htaccess?

I need to block RSS pages in htaccess, most importantly these /rss/catalog/new /rss/catalog/notifystock and /index.phprss/catalog/notifystock Especially the last one, as you can see it's /index....
2
votes
3answers
470 views

Can we IP protect the Magento Cron?

Is it ideal to IP protect the Magento cron.php? instead of folder protecting it (as referred in the http://devdocs.magento.com/guides/v2.0/config-guide/secy/secy-cron.html) because we want to harden ...
2
votes
1answer
3k views

After applying SUPEE-6788 , cron stopped working

I am using 1.9.2.1. After applying SUPEE-6788 , cron stopped working. Why?? I attached the cron setting of my system.
2
votes
2answers
265 views

Heartbleed bug affecting magento

Are magento sites affected by heartbleed bugs and if yes what can I do for mitigation?
2
votes
2answers
609 views

“There has been an error processing your request” - Errors displayed on frontend even though display_errors = 0

Magento is displaying the MySQL query and a stack trace on catalog pages. I can't figure out where it's coming from. DB queries should not be displaying on the frontend, for security reasons. Do you ...
2
votes
2answers
2k views

Credit Card Hijack Malware Detected

It appears that our website is infected with the Credit Card Hijack malware. We ran scans on magereport.com, webscan.foregenix.com, and quttera.com, and they all say that our /js/prototype/prototype....
2
votes
2answers
1k views

Magento 1.9.3.1: Prevented a potential Cross-Site Scripting (XSS) vulnerability when adding a category

As you may know 1.9.3.1 has been been released. In the release notes, I found that on top of bug fixes, there also was two security features: Prevented a potential Cross-Site Request Forgery (...
2
votes
1answer
732 views

Magento 2: Custom Form Security

I have created custom "Contact Us" form. Put Magento default Captcha as well. On server side i'm using if (!$this->_formKeyValidator->validate($this->getRequest())) { return $this->...
2
votes
1answer
747 views

What kind of risk will be there if Magento app/etc/local.xml file and release notes are publicly exposed?

I want some expert advice for the following. Suppose a Magento site has exposed local.xml in browser like following way. http://www.example.com/app/etc/local.xml and http://www.example.com/...
2
votes
2answers
4k views

Disable asking for “current admin password” when changing a password

Changing a password for the admins or a customer requires the "current admin password." That will require every admin to set memorable passwords, that have possibly been used in other sites, as ...
2
votes
1answer
2k views

Prevent Error Log display to the public

Whenever we rebuild the catalog_product_flat index, Magento displays its standard error page along with a stack trace that reveals file structure to the outside world. How do I stop this? I've tried ...
2
votes
2answers
3k views

Set Magento MySQL Connection to use SSL

We have a Magento site on a VM with 2GB of RAM. Right now, both Apache and MySQL are running on that same VM. Since that's just not enough RAM for this site, I have been tasked with separating the ...
2
votes
1answer
3k views

F5 key Flood and “Error log record number reporting” page

I have a VM testing Magento. Configuration is classic LAMP. Everything works fine but I discovered a big issue in running Magento. F5 flood. 1) Visit any page you want. 2) Keep F5 key pressed. Page ...
2
votes
2answers
2k views

iframe in backend: check if backend user is logged in

I'm using Magento 1.9. I have created a module and added a page in the backend that can be accessed by the menu. This page contains an iframe (declared in a phtml file) which loads an own application....
2
votes
1answer
69 views

Do I have a security hole? Is there anything in my Magento installed from a 3rd? [closed]

I can use my 1.8.1 Shop very well on my Ubuntu Desktop as well as in IE in my VirtualBox. But now I had the second visitor reporting issues like: If they click on a product, they are being forwarded ...
2
votes
2answers
78 views

Magento cloud hosted M2 EE site compromised and got malware attack

Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url: <script src="http://write-cdn.com/...
2
votes
2answers
364 views

Magento 1.9.2.1 how to prevent core_config_data from getting malicious scripts

I have been scanning the website at Magento Scan and getting the following error: Magento Compromise Injection Your site is compromised with injected JavaScript. (131) The malicious code ...
2
votes
2answers
4k views

Magento 1.9 CE security fixing end of life

I just read all answers from this question: Future Support of Magento 1.9 - Coming Magento 2.0 But I can't find a clear date or an official reference about the end of life date for Magento 1.9. Is ...
2
votes
2answers
365 views

Images not showing properly in email when site is password protected

My Magento development website is password protected through .htaccess and .htpasswd. I have a share via email feature in my website. On click of product share an email is sent with image of product. ...
2
votes
1answer
255 views

Is it safe to remove admin accounts?

My magento site was recently hacked, and I'm trying to clear out admin users from the database. I'm wondering if it's safe to delete all of the admin users that I don't recognize, or if some modules/...
2
votes
2answers
645 views

Magento security patches installation order

I am using Magento Version 1.6.2.0 I want to know if there there is any order for the installation of the security patches because I have installed the patches SUPEE-5994, SUPEE-6237, SUPEE-6285 and ...
2
votes
1answer
282 views

Still Get Reminder Messages Re Security Patch [duplicate]

I think the patches for the latest security issue with Magento has been installed, but I keep getting messages in the Admin area saying it is critical that I install the patches. Is this a standard ...
2
votes
3answers
1k views

Search Form attacks / bot detection

I'm looking at creating a Magento based solution to detect bots, specifically on search forms. I have a bot searching a very specific long tail string and it shows on the dashboard of admin as being ...
2
votes
1answer
557 views

Use Secure URLs in Admin causing loging out issue

When I set Use Secure URLs in Admin to "yes" it causes the backend to logout everytime I view something on the front end. Does anyone know what could be causing this. The backend works fine until I ...
2
votes
1answer
1k views

Blocking bots / hackers from accessing newsletter subscription

I am getting massive amounts of fake newsletter subscriptions - mostly a randomly generated Yahoo email address. I've looked through the logs and there are 50+ IP addresses, seems like it's from a ...
2
votes
2answers
51 views

How to securely run PHP scripts in Magento 2

I know that we can run php scripts by placing our script in root of magento 2 folder and we can load products, orders etc via object manager and perform our desired functionality. although this method ...
2
votes
2answers
92 views

Why admin added to the site?

Today automatically added two admins to my site? Is my site hacked? What should I do to fix this bug?
2
votes
1answer
156 views

is this a spam email or real

Message ID : <201812262203.wBQM3RsD009630@web1.gohost.sk> Sent Date : Wed, 26 Dec 2018 22:03:27 +0000 From : magento@gohost.sk Sender MailID : magento@gohost.sk Reply To : magento@gohost.sk To : ...
2
votes
1answer
1k views

How to escape output in templates in 2.2 - XSS security [duplicate]

I've noticed that the way we escape data in templates is changing as part of 2.2 Escape functions for templates For the following output cases, use the specified function to generate XSS-safe ...
2
votes
1answer
213 views

Is it safe to send admin credentials to rest API

I am getting data from magento2 REST api. I send admin credentials to get the token then I use the token to get the data and everything is working fine. Is it a safe way to do that? Should I create ...
2
votes
1answer
788 views

Backend repeatedly hacked in version 1.9.1.0 CE by changing Paypal account info. How to fix and secure?

Our site has been repeatedly hacked over the past week. This is our first Magento site and it has only been up a couple months. The hacker or bot, etc. will go in and disable the other forms of ...

1 3 4 5 6 7 13