Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
3
votes
1answer
40 views

Shell script dumps Model source code

Weird things happening. I've written a customized product import script which is executed as a shell script. In this script, I gather some XML input, parse it into an array and then try to import the ...
3
votes
0answers
17 views

Magento2 Security: How to best filter GET parameters before they reach Magento?

I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
3
votes
1answer
100 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
3
votes
1answer
22 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
3
votes
0answers
478 views

Security Patch SUPEE-10975 - Possible issues? [duplicate]

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10975 SUPEE-10975, Magento Commerce 1....
3
votes
1answer
87 views

Can anyone have any idea of security patch file of SUPEE-9652 V2?

As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
3
votes
1answer
488 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
3
votes
0answers
102 views

Removal of .orig files

In patching some Magento sites the patch leaves behind a .orig version of some of the files that were patched. I've been removing these from version control but was curious is there's any purpose to ...
3
votes
0answers
171 views

get.php in server logs - security issue?

I noticed multiple hits per day on get.php in the access logs of a Magento 1.14 store, resulting in PHP errors and a HTTP 500 response. Some of them have bot user agents like facebookexternalhit/1.1 (...
3
votes
0answers
147 views

Magento 2 filesystem permissions [closed]

In Magento 2 we have a new filesystem permissions guidelines. Reading this link I understand that Magento requires php user inside www-data group. What I do not understand is why static filesystem ...
2
votes
4answers
7k views

Newsletter Spam Subscriber

I got 700 Newsletter subscribers per day for my site, the subscriber name and email id not relevant. What is the possible way to prevent. I think these are all spam accounts.
2
votes
2answers
922 views

2 Step Authentication for admin URL

I want to add 2 step Authentication to an admin back end URL to my clients online Magento shop. I don't want to use a google app authentication or a phone app/sms system. I want a master Username/...
2
votes
4answers
4k views

spam email/account @qq.com

Please can you help me with a problem started 1 week ago? every day a customer with chinese name appear on the customer list and our server start to send spam email (fortunately we block automatically ...
2
votes
3answers
4k views

SUPEE-9767 ERROR: Patch can't be applied/reverted successfully

Trying to apply newly released patch on our Magento EE 1.14.3.2 but getting the following error. bash PATCH_SUPEE-9767_EE_1.14.3.2_v1-2017-05-22-07-20-39.sh Checking if patch can be applied/reverted ...
2
votes
2answers
2k views

Patch 9767 getting invalid Form Key [duplicate]

I just patched my dev machine with Security Patch 9767. And enabled form key on checkout from backend. Also added the form key to my custom theme. But When I tested the checkout process it freeze on ...
2
votes
3answers
3k views

How to Block RSS in .htaccess?

I need to block RSS pages in htaccess, most importantly these /rss/catalog/new /rss/catalog/notifystock and /index.phprss/catalog/notifystock Especially the last one, as you can see it's /index....
2
votes
3answers
450 views

Can we IP protect the Magento Cron?

Is it ideal to IP protect the Magento cron.php? instead of folder protecting it (as referred in the http://devdocs.magento.com/guides/v2.0/config-guide/secy/secy-cron.html) because we want to harden ...
2
votes
1answer
3k views

After applying SUPEE-6788 , cron stopped working

I am using 1.9.2.1. After applying SUPEE-6788 , cron stopped working. Why?? I attached the cron setting of my system.
2
votes
2answers
265 views

Heartbleed bug affecting magento

Are magento sites affected by heartbleed bugs and if yes what can I do for mitigation?
2
votes
2answers
608 views

“There has been an error processing your request” - Errors displayed on frontend even though display_errors = 0

Magento is displaying the MySQL query and a stack trace on catalog pages. I can't figure out where it's coming from. DB queries should not be displaying on the frontend, for security reasons. Do you ...
2
votes
2answers
2k views

Credit Card Hijack Malware Detected

It appears that our website is infected with the Credit Card Hijack malware. We ran scans on magereport.com, webscan.foregenix.com, and quttera.com, and they all say that our /js/prototype/prototype....
2
votes
2answers
1k views

Magento 1.9.3.1: Prevented a potential Cross-Site Scripting (XSS) vulnerability when adding a category

As you may know 1.9.3.1 has been been released. In the release notes, I found that on top of bug fixes, there also was two security features: Prevented a potential Cross-Site Request Forgery (...
2
votes
1answer
644 views

Magento 2: Custom Form Security

I have created custom "Contact Us" form. Put Magento default Captcha as well. On server side i'm using if (!$this->_formKeyValidator->validate($this->getRequest())) { return $this->...
2
votes
1answer
734 views

What kind of risk will be there if Magento app/etc/local.xml file and release notes are publicly exposed?

I want some expert advice for the following. Suppose a Magento site has exposed local.xml in browser like following way. http://www.example.com/app/etc/local.xml and http://www.example.com/...
2
votes
2answers
4k views

Disable asking for “current admin password” when changing a password

Changing a password for the admins or a customer requires the "current admin password." That will require every admin to set memorable passwords, that have possibly been used in other sites, as ...
2
votes
1answer
2k views

Prevent Error Log display to the public

Whenever we rebuild the catalog_product_flat index, Magento displays its standard error page along with a stack trace that reveals file structure to the outside world. How do I stop this? I've tried ...
2
votes
2answers
3k views

Set Magento MySQL Connection to use SSL

We have a Magento site on a VM with 2GB of RAM. Right now, both Apache and MySQL are running on that same VM. Since that's just not enough RAM for this site, I have been tasked with separating the ...
2
votes
1answer
3k views

F5 key Flood and “Error log record number reporting” page

I have a VM testing Magento. Configuration is classic LAMP. Everything works fine but I discovered a big issue in running Magento. F5 flood. 1) Visit any page you want. 2) Keep F5 key pressed. Page ...
2
votes
2answers
2k views

iframe in backend: check if backend user is logged in

I'm using Magento 1.9. I have created a module and added a page in the backend that can be accessed by the menu. This page contains an iframe (declared in a phtml file) which loads an own application....
2
votes
1answer
69 views

Do I have a security hole? Is there anything in my Magento installed from a 3rd? [closed]

I can use my 1.8.1 Shop very well on my Ubuntu Desktop as well as in IE in my VirtualBox. But now I had the second visitor reporting issues like: If they click on a product, they are being forwarded ...
2
votes
2answers
48 views

Magento cloud hosted M2 EE site compromised and got malware attack

Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url: <script src="http://write-cdn.com/...
2
votes
2answers
4k views

Magento 1.9 CE security fixing end of life

I just read all answers from this question: Future Support of Magento 1.9 - Coming Magento 2.0 But I can't find a clear date or an official reference about the end of life date for Magento 1.9. Is ...
2
votes
2answers
343 views

Images not showing properly in email when site is password protected

My Magento development website is password protected through .htaccess and .htpasswd. I have a share via email feature in my website. On click of product share an email is sent with image of product. ...
2
votes
1answer
247 views

Is it safe to remove admin accounts?

My magento site was recently hacked, and I'm trying to clear out admin users from the database. I'm wondering if it's safe to delete all of the admin users that I don't recognize, or if some modules/...
2
votes
2answers
631 views

Magento security patches installation order

I am using Magento Version 1.6.2.0 I want to know if there there is any order for the installation of the security patches because I have installed the patches SUPEE-5994, SUPEE-6237, SUPEE-6285 and ...
2
votes
1answer
281 views

Still Get Reminder Messages Re Security Patch [duplicate]

I think the patches for the latest security issue with Magento has been installed, but I keep getting messages in the Admin area saying it is critical that I install the patches. Is this a standard ...
2
votes
3answers
1k views

Search Form attacks / bot detection

I'm looking at creating a Magento based solution to detect bots, specifically on search forms. I have a bot searching a very specific long tail string and it shows on the dashboard of admin as being ...
2
votes
1answer
556 views

Use Secure URLs in Admin causing loging out issue

When I set Use Secure URLs in Admin to "yes" it causes the backend to logout everytime I view something on the front end. Does anyone know what could be causing this. The backend works fine until I ...
2
votes
1answer
1k views

Blocking bots / hackers from accessing newsletter subscription

I am getting massive amounts of fake newsletter subscriptions - mostly a randomly generated Yahoo email address. I've looked through the logs and there are 50+ IP addresses, seems like it's from a ...
2
votes
1answer
149 views

is this a spam email or real

Message ID : <201812262203.wBQM3RsD009630@web1.gohost.sk> Sent Date : Wed, 26 Dec 2018 22:03:27 +0000 From : magento@gohost.sk Sender MailID : magento@gohost.sk Reply To : magento@gohost.sk To : ...
2
votes
1answer
1k views

How to escape output in templates in 2.2 - XSS security [duplicate]

I've noticed that the way we escape data in templates is changing as part of 2.2 Escape functions for templates For the following output cases, use the specified function to generate XSS-safe ...
2
votes
1answer
199 views

Is it safe to send admin credentials to rest API

I am getting data from magento2 REST api. I send admin credentials to get the token then I use the token to get the data and everything is working fine. Is it a safe way to do that? Should I create ...
2
votes
1answer
701 views

Backend repeatedly hacked in version 1.9.1.0 CE by changing Paypal account info. How to fix and secure?

Our site has been repeatedly hacked over the past week. This is our first Magento site and it has only been up a couple months. The hacker or bot, etc. will go in and disable the other forms of ...
2
votes
1answer
128 views

Magento 1.9 “public” directory model

I want to be confident that access to my Magento 1 code bases is restricted. I have: created a folder in my Magento root directory named public moved .htaccess to public/.htaccess created public/...
2
votes
2answers
2k views

Where can i get patch SUPEE-3941 for installing SUPEE-8788 Magento 1.13.1 EE?

I tried to install SUPEE-8788 through this manual: But can't find patch SUPEE-3941. Where can i find it? Thanks
2
votes
2answers
61 views

Can no longer login to Magento, Customers cannot place orders

doodle-bag.com is no longer functioning, customers cannot complete their purchases, however I cannot login to our Magento account to diagnose the problem. Any help would be appreciated. Thanks.
2
votes
1answer
442 views

nginx stopping people from hacking our admin url

We use nginx and in an effort to stop all thos IP's trying to find our secret admin url we wanted to add a nginx location rule: Looking in location Where the first directory/folder contains the word ...
2
votes
1answer
63 views

Magento security question database available in root dir /

I worked on a Magento install where I found database dumps lying in the root index / i.e. the same directory as the magento base url. Like: mystore.com/databasename.datethedumpwasmade.sql mystore.com/...
2
votes
3answers
369 views

Applied Patches but still getting a vulnerable message?

I've applied the patches to both our dev site and our live site. We're running on Enterprise Edition 1.12.0.X so I've downloaded: PATCH_SUPEE-5345_EE_1.12.0.2_V1-2015-02-10-04-17-49.sh PATCH_SUPEE-...
2
votes
1answer
879 views

SUPEE-5344 and SUPEE-1533 solution for magento ce-1.3?

Reading about those security risks, I wonder if there is something I can do for clients with 1.3 ce stores, where upgrade will require a new theme development.