Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
140
votes
15answers
53k views

Security Patch SUPEE-7405 - Possible Problems?

It's time for another patch day, SUPEE-7405 for Magento 1.x is out and the list of fixes is long: https://magento.com/security/patches/supee-7405 After the experience with the last patches, I have to ...
108
votes
30answers
49k views

Security Patch SUPEE-8788 - Possible Problems?

The latest Magento 1 security patch SUPEE-8788 contains 17 APPSEC updates, so it is very important to apply it as soon as possible. On the other hand, there are many potential backward compatibility ...
108
votes
23answers
35k views

Security Patch SUPEE-9767 - Possible issues?

A new security patch is out for Magento 1, addressing 16 APPSEC issues: https://magento.com/security/patches/supee-9767 Seven of the vulnerabilities score 8.0 or higher for CVSSv3 Severity, and they ...
85
votes
3answers
25k views

Access Denied errors after installing SUPEE-6285

After installing the SUPEE-6285 patch on our Magento 1.7.0.2 store the system is showing an "Access Denied" error when attempting to access all custom modules for users who have selective permissions (...
71
votes
5answers
17k views

How to check which modules are affected by security patch SUPEE-6788

On October 27, 2015, Magento has released security patch SUPEE-6788. According to the technical details, 4 APPSEC's that have been fixed require some rework in local and community modules: APPSEC-...
50
votes
6answers
31k views

Critical Reminder: Download and install Magento security patches. (FTP with no SSH access)

The Magento security patches look like they are .sh files, how would someone apply these patches without SSH access to their Magento installations? Also, are these patches cumulative? IE: Will they ...
48
votes
4answers
14k views

Passwords in sign up email. Bad practice? PCI compliant?

We use Magento Enterprise (1.12) and I have had several customers email me already complaining that they received their password via email when they signed up for an account. I know this is considered ...
45
votes
16answers
11k views

Security Patch SUPEE-10570 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10570 SUPEE-10570, Magento Commerce 1....
44
votes
4answers
48k views

How to check the latest patch version applied to magento?

I just applied the security patch PATCH_SUPEE-5344_CE_1.8.0.0_v1-2015-02-10-08-10-38.sh Since I have no SSH access to the web server, the provider did the work for me. How can I check by myself if ...
37
votes
9answers
15k views

Security Patch SUPEE-10415 - Possible Issues?

New Magento 1 patch has been released, SUPEE-10415. This patch provides protection against several types of security-related issues Info page: https://magento.com/security/patches/supee-10415 ...
36
votes
11answers
11k views

Security Patch SUPEE-10266 - Possible issues?

A new security patch is out for Magento 1, addressing 13 APPSEC issues https://magento.com/security/patches/supee-10266 What common issues do you have to watch out for when applying this patch? ...
35
votes
5answers
9k views

Are Symlinks on templates a security problem, and if yes, why?

Magento recommends to not use templates via symlinks: Advanced > Developer > Template Settings > Allow Symlinks Warning! Enabling this feature is not recommended on production ...
29
votes
4answers
23k views

Recommended method to protect /downloader?

Since Magento uses the /downloader as a way to conveniently install programs via Magento Connect Manager it is apparent that this is also a security concern since it allows the possibility for bots or ...
29
votes
2answers
6k views

Magento 2: template security: which method to use?

I'm aware Magento 2 has several methods available to secure the template: $block->escapeHtml() $block->escapeQuote() $block->escapeUrl() $block->escapeXssInUrl() But I'm wondering when ...
29
votes
4answers
2k views

New patch supee-6788 how to apply patch

After weeks of waiting for the patch today (27.10.2015) it was released: SUPEE-6788 A lot of things were patched and also is encouraged to review installed modules for possible vulnerabilities. I ...
28
votes
18answers
6k views

Security Patch SUPEE-11155 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What common issues do you have to watch out for when applying this patch/upgrade? Magento 1 https://magento.com/security/...
28
votes
6answers
7k views

Magento security patch SUPEE-6482, What is patched?

Today 04.08.2015 there was a new security patch released, some colleagues and I were checking the patch, and is always nice to have some discussion about what changed, also does anyone know what are ...
27
votes
4answers
27k views

How to escape output data?

Is there a built-in Magento helper to escape outputted template data to prevent XSS? Or should I just use the PHP htmlspecialchars or htmlentities functions?
27
votes
3answers
982 views

Magento Security Punch list

It is very often that we take a site from another firm and now we are stuck with a conglomeration of code and potentially dozens of people who have worked on a site. I am looking for a punch list of ...
26
votes
6answers
14k views

SUPEE-6285 patch, what has been changed?

OK, somebody has to ask this: today, 7/7/2015 a new security patch for Magento < 1.9.2 has been released. update your shops ASAP! But what has been changed? Are there known exploits of the ...
24
votes
17answers
5k views

Security Patch SUPEE-11086 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible." ...
22
votes
5answers
2k views

How to get information about Magento security patches?

Today a friend alerted me about a critical security update for Magento - SUPEE-5344. I didn't see any articles about this patch on major IT websites. Even if I google for this update, I see SE pages ...
22
votes
3answers
8k views

How did they find my custom admin URL?

I have a custom admin url, still I saw someone trying to login into admin. I even changed it, and shortly after the next login was tried. How could this happen, I thought its secure?
21
votes
6answers
36k views

What permissions should I give /var and /media?

I understand that magento says to have /var and /media at 700 for folders and 600 for files but when I do this, it breaks certain parts of my site. I am curious to see what permissions most people use ...
21
votes
16answers
7k views

Security Patch SUPEE-10888 - Possible issues?

SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues. https://magento.com/security/patches/supee-10888 SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3....
21
votes
5answers
15k views

Why does PATCH_SUPEE-6788 appear to have no effect on a 1.7.0.2 installation?

Note: This issue appears to apply to all versions of Magento which received the SUPEE-6788 patch. You'll see in my answer that both .htaccess and .htaccess.sample need to be restored for the patch ...
19
votes
6answers
13k views

SUPEE-9767 Patch/CE 1.9.3.3 - One Page Checkout - Customer Registration issue

On a clean, vanilla install of Magento 1.9.2.4, patched with SUPEE-8788, SUPEE-9652 and SUPEE-9767, and with the new 'Enable Form Key Validation On Checkout' setting turned on, following a successful ...
18
votes
3answers
24k views

Getting correct FormKey

I have a page that I listed products, that's it. Its kind of catalog/view.phtml clone. Just included app/Mage.php. In this page I use Mage::getSingleton('core/session')->getFormKey(); but it's ...
18
votes
8answers
6k views

Magento 2: “Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider”

My Magento 2 development environment has started poking me with the following error message Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact ...
17
votes
4answers
3k views

How can I tell if a corrupt image file is being used for credit card skimming?

I'm working with a site that I believe has been hacked to collect customer credit card data, but I can't be certain. I did not find any suspicious code in the common places I've seen suggested in ...
16
votes
15answers
6k views

SUPEE-10975 Potential Issues

SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support? So far these ...
16
votes
4answers
4k views

SecurityPatch 9652: Possible problems after SUPEE-9652 applied

Magento has released its security patch SUPEE-9652, for Magento 1.x CE and EE I just want to know what are the possible problems after applying this security patch and What are the new changes in ...
16
votes
2answers
6k views

Magento hacked even after applied patch

Some days before my Magento community edition 1.8.1 site is hacked, because we are late to apply the patch. we found certain files were changed those are index.php [hackers added some code to it]. ...
16
votes
3answers
3k views

When is Magento CE 1.9.2 going to be released?

What is the release date for Magento Community Edition 1.9.2? In Magento's official post they say it will be released in "the next few weeks", which is kind of vague. Does anyone know a (unofficial) ...
15
votes
2answers
3k views

Why is CSRF protection needed for add-to-cart?

Magento has since recent versions a form_key as part of the add to cart action, to protect against I think CSRF attacks. So now I wonder, is it really needed for this place, and why or better said, ...
15
votes
5answers
633 views

Magento store not secure

Recently I took over the management of a Magento store. Yesterday we recieved an email from an IT company stating our store wasn't secure. Eventhough I doubt the legitimacy of the email, it did show ...
15
votes
1answer
1k views

SQL injections vulnerabilities when using SQL models of the Zend Framework

When joining tables, I use SQL models of the Zend Framework. As example I modified my actual code, but I think you will get the point: $this->getSelect()->join( array('...
14
votes
15answers
8k views

Security Patch SUPEE-10752 - Possible issues?

A new security patch is out for Magento 1, addressing 25 APPSEC issues https://magento.com/security/patches/supee-10752 What common issues do you have to watch out for when applying this patch? ...
12
votes
4answers
12k views

security risk of require_once 'app/Mage.php'; in Magento root

I have a file in my Magento root that require_once 'app/Mage.php'; to give me access to Mage::getStoreConfig system variables. Does this cause a security risk? Should I place it in another folder? ...
12
votes
1answer
5k views

SUPEE-9767 V2 Possible problems and solved Issues

Magento just Release Updated version Of SUPEE-9767 and Magento - CE 1.9.3.4. So MY question is which bugs were solved in V2 and do we need to re apply V2 if we already apply v1. And what are the new ...
12
votes
3answers
2k views

Should I upgrade or patch Magento?

I am currently patching Magento with the latest patches and wondered whether it is worth applying the patches or upgrading to the latest version? As far as I can tell the only changes seem to be the ...
12
votes
2answers
3k views

CSRF Attack & Session Hijack Vulnerability

From the 1.8CE Alpha release notes: The Magento web store has additional Cross Site Request Forgery (CSRF) protections, meaning an imposter can no longer impersonate a newly registered customer ...
12
votes
1answer
572 views

Security reminders keep rolling in… (SUPEE-5344 & SUPEE-1533)

I have several Magento installations, that I manage on behalf of our clients. We already patched the vulnerabilities, but the warnings keep rolling in. We just received the third warning on all sites. ...
12
votes
1answer
2k views

Magento swf XSS vulnerability - How to address it?

Per the SWF / Flash vulnerability listed at: http://appcheck-ng.com/unpatched-vulnerabilites-in-magento-e-commerce-platform/ which I've verified does still exist in Magento 1.9.1.0, what is the best ...
11
votes
3answers
474 views

What to do against the latest vulnerability: stolen credit card data?

After the news came out a few days ago, I haven't heard much - and no official statement - about the newest vulnerability. Sucuri says that it is possible to receive credit card information, or even ...
11
votes
1answer
4k views

How do I make my custom module pages use SSL?

I've created a Module with some pages and I'm wondering how do I force this pages to use SSL on the url, like the customer login page. Not all of the pages need it, but some do. What comes to mind (...
10
votes
5answers
15k views

Restrict access to admin area by IP

What is the best way to restrict the access to the admin area by IP in Magento? Bear in mind that admin can work either from /admin or index.php/admin
10
votes
2answers
849 views

Why is using {{base_url}} in a production server not recommended?

This is for intelectual purposes only, as I am curious. Searching through google, I cannot find a definite answer to this, so as the subject says, why is it not recommended? What can go wrong? The ...
10
votes
1answer
1k views

Magento 2.1.1 - Improve security with Content Security Policy

I have a store running fine with the latest version of Magento (currently 2.1.1) and I'm trying to improve security through Content Security Policy on Apache 2.4.7 (Ubuntu 14.04). I had removed all "&...
9
votes
5answers
10k views

How to apply the Magento 2 patches?

I'm using the Magento 2.1.6 and I want to apply the patch CE-MAGETWO-67805.patch. How can I apply the *.patch files?