Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
1
vote
1answer
779 views

Removing HTML Escape on history item comment

My theme has a file: app/design/{theme}/default/template/sales/order/view.phtml Around line 78: <?php if (count($_history)): ?> <div class="order-additional order-comments"> <h2 ...
0
votes
1answer
265 views

nginx configuration for blocking bots

I took over a magento site running on nginx. I looked and saw that currently there are ~100 "online" guests, all of them are bingbot. There are a lot of suggestions for how to properly block bots, ...
4
votes
1answer
1k views

Possible arbitrary file inclusion

This is the 3rd time I have seen this on a relatively fresh install of Magento. The only place that the email Hello@example.com exists is in: System > Configuration > Contacts > Email ...
3
votes
1answer
440 views

Forgotten password page: Show information about registered customer e-mail addresses

When someone goes onto the forgotten password page and enters an email address once they click submit it reloads the log in page even if the email address doesn't exist on the database. Is there a way ...
2
votes
1answer
415 views

PayPal seller email has changed in the admin

I believe a site I've been working on has been hacked. Here's what I know: PayPal seller address has changed to a random address This is not a PayPal bug Going through the logs - this wasn't changed ...
12
votes
1answer
2k views

Magento swf XSS vulnerability - How to address it?

Per the SWF / Flash vulnerability listed at: http://appcheck-ng.com/unpatched-vulnerabilites-in-magento-e-commerce-platform/ which I've verified does still exist in Magento 1.9.1.0, what is the best ...
2
votes
1answer
2k views

Prevent Error Log display to the public

Whenever we rebuild the catalog_product_flat index, Magento displays its standard error page along with a stack trace that reveals file structure to the outside world. How do I stop this? I've tried ...
1
vote
1answer
36 views

Am I vulnerable if the public has access to my customer IDs?

I created a referral program that uses a custom referral link and it includes the customer ID. I assume this is bad practice, but what specifically did I open myself up to? (If anything)
0
votes
1answer
26 views

Is this an attempt to mess with the shop?

when i check in backend, customers online, is see an ip address viewing the site with a url that is strange The url structure is: https://www.mydomain.com/nl/category/page.html but i see someone ...
2
votes
2answers
3k views

Set Magento MySQL Connection to use SSL

We have a Magento site on a VM with 2GB of RAM. Right now, both Apache and MySQL are running on that same VM. Since that's just not enough RAM for this site, I have been tasked with separating the ...
2
votes
2answers
2k views

How can I disable access to local.xml and config.xml for external visitors?

I problem that anybody from web can observe my file local.xml and config.xml I enabled Deny From all in htaccess file in folder app and direct access have been disabled for all files in this folder ...
3
votes
1answer
150 views

Magento 1.9.0.1 SECURITY ISSUE

In the past few weeks, at least three customers have found that, at checkout, other people's details are showing up in their address book (totally unrelated people...no similarity in name, email or ...
2
votes
1answer
3k views

F5 key Flood and “Error log record number reporting” page

I have a VM testing Magento. Configuration is classic LAMP. Everything works fine but I discovered a big issue in running Magento. F5 flood. 1) Visit any page you want. 2) Keep F5 key pressed. Page ...
2
votes
1answer
331 views

Strange Looking Search Terms - Possible Malicious activity?

cbwV AND 2890=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(115)||CHR(111)||CHR(115)||CHR(113)||(SELECT (CASE WHEN (2890 Is just one of the terms, there are 10+ different ones cropping up,...
0
votes
3answers
2k views

Magento: Allowing insecure content on https pages

I'm facing an issue and I have no idea how to solve it. I use on another websites (which aren't developed in Magento) a jQuery script that gets an address once we type the zip code (a lot websites in ...
-1
votes
2answers
595 views

Remote Code Execution Exploit solution on shared server

http://www.magentocommerce.com/knowledge-base/entry/security-add-handler I read about the issue today seems my server is vulnerable. So I applied patch. However, I cannot edit httpd.conf as I am on ...
2
votes
1answer
904 views

Customer Password Security Rules

I would like for my customers to have to adhere to certain rules when creating an account/creating a password. These rules are for password security and are as follows: Greater than 8 characters ...
0
votes
2answers
41 views

Magento Reviews Disappearing from Database

We have a strange issue occurring where product reviews are mysteriously disappearing from the Magento database. They are there one day and then the next we check the database and they are completely ...
1
vote
1answer
499 views

Pager causing Reflected Cross-Site Scripting

I got a PCI compliance report that raised an issue with Reflected Cross-Site Scripting on category pages. On testing it would appear that the 'Items Per Page' drop down can be made to print some ...
4
votes
1answer
3k views

How does magento encrypt credit card numbers?

I have been playing around with the Credit cards (saved) payment option and noticed it encrypts the credit card numbers. What algorithm is it using? What are the specifics? I quite interested to see ...
1
vote
1answer
146 views

What to do, when I was hacked

Over the past week this Superfish crap has appeared all over my Magento website it's literally hijacked it. What should i do?
1
vote
1answer
2k views

Change minimum password length for customers in SOAP API

TL;DR: how do I change the minimum password length requirement for customers created via the SOAP v2 API? I need to change the minimum password length requirement for customers created via the SOAP ...
2
votes
2answers
874 views

Secure catalogsearch URL?

Whats the rule to makes the search form URL https? I tried: <secure_url> <catalogsearch>/result/</catalogsearch> </secure_url> But that doesnt do the job. ...
2
votes
3answers
1k views

Search Form attacks / bot detection

I'm looking at creating a Magento based solution to detect bots, specifically on search forms. I have a bot searching a very specific long tail string and it shows on the dashboard of admin as being ...
1
vote
1answer
187 views

What else adds order comments?

I have a task to add a WYSIWYG editor on the admin order comments. So far so good. I was able to make it work. But I have a concern. By default order comments are escaped when listed and only a few ...
7
votes
1answer
1k views

What permissions schema should I use when deploying Magento securely?

We run what I feel is pretty standard Magento setup: Deployed via rsync (it should also be deployable with git pull and scp/SFTP for simpler server configurations and to make developers' lives easier....
1
vote
1answer
179 views

Indexable Web Directories - PCI

I have failed my PCI scan and one of the issues is, "Indexable Web Directories". This included /errors/, /icons/, /icons/small/ etc. How do I resolve this without causing issues with my storefront?
2
votes
2answers
265 views

Heartbleed bug affecting magento

Are magento sites affected by heartbleed bugs and if yes what can I do for mitigation?
2
votes
1answer
556 views

Use Secure URLs in Admin causing loging out issue

When I set Use Secure URLs in Admin to "yes" it causes the backend to logout everytime I view something on the front end. Does anyone know what could be causing this. The backend works fine until I ...
7
votes
1answer
1k views

password protection

these days I have deployed a magento instance, but the webshop is not online yet, so I have added an .htaccess password protection to the website which indeed worked fine, but caused problems when my ...
1
vote
1answer
2k views

What is the risk of not using Magento's “getSubmitUrl” function?

This produces a URL that includes some encryption. If I want to create a custom "Add to Cart" button and use my own link: "/checkout/cart/add?qty=1&product=2" that does not have this encryption, ...
2
votes
1answer
1k views

Blocking bots / hackers from accessing newsletter subscription

I am getting massive amounts of fake newsletter subscriptions - mostly a randomly generated Yahoo email address. I've looked through the logs and there are 50+ IP addresses, seems like it's from a ...
1
vote
1answer
173 views

copying a URL with SID (while logged in) then pasting it (while logged out) re-loads the page

While customer is logged in to the Customer Account page, for example, the URL looks something like https://www.oursite.com/customer/account/?SID=<randomstring>. URL is copied, customer account ...
4
votes
1answer
2k views

Magento CE 1.8 Password Storage

CE 1.8 inherits from EE 1.13 and lists as a change: “The cryptographic methods used to store passwords were improved to enhance security” As far as I know, earlier versions used APR1 which is a 1000 ...
1
vote
1answer
278 views

SSL certificate requirement

If I install Magento on a site which does not have SSL certificates configured then will I be able to configure Magento to use an SSL certificate at a later time without having to reinstall. Is there ...
2
votes
1answer
596 views

Security issues using URL parameters

I'm writing a custom router for Magento. Here's a code snippet of what I'm doing in the match() method: $pathInfo = $request->getPathInfo(); $splitPath = explode('/', $pathInfo); $category = $...
12
votes
2answers
3k views

CSRF Attack & Session Hijack Vulnerability

From the 1.8CE Alpha release notes: The Magento web store has additional Cross Site Request Forgery (CSRF) protections, meaning an imposter can no longer impersonate a newly registered customer ...
10
votes
2answers
849 views

Why is using {{base_url}} in a production server not recommended?

This is for intelectual purposes only, as I am curious. Searching through google, I cannot find a definite answer to this, so as the subject says, why is it not recommended? What can go wrong? The ...
2
votes
2answers
608 views

“There has been an error processing your request” - Errors displayed on frontend even though display_errors = 0

Magento is displaying the MySQL query and a stack trace on catalog pages. I can't figure out where it's coming from. DB queries should not be displaying on the frontend, for security reasons. Do you ...
-1
votes
1answer
959 views

If i secure magmi will my scripts on the server still be able to access it?

I recently discovered that my magmi ui in magento is not secured. I found instructions on securing it but I need to ensure that my scripts can still access it when I secure it. Can anyone help me with ...
3
votes
1answer
7k views

Securing add to cart http request

I have a Magento site which integrates with a Javascript based product configurator using reverse proxy on a specific CMS page. The user configures their product and then hits 'Add to Cart' at which ...