Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
2
votes
1answer
25 views

How to secure Magento 2.x guest API

I realized that it is possible to register customers through API without authentication. https://devdocs.magento.com/guides/v2.2/rest/anonymous-api-security.html Just make a POST call to https://...
2
votes
2answers
40 views

How to securely run PHP scripts in Magento 2

I know that we can run php scripts by placing our script in root of magento 2 folder and we can load products, orders etc via object manager and perform our desired functionality. although this method ...
2
votes
2answers
206 views

Failed Magento SUPEE 6482 Security Check (APPSEC-1030) with Version 1.9.3.7 CE

The new Magento Security Scanner reports that there are vulnerabilities on the website and that patch SUPEE 6482 is required. This occurs even when there are no Modules enabled. However, we are ...
2
votes
2answers
85 views

Require password to purchase product?

Is there a way to password protect a single product in Magento 1? We have a product that should only be able to be purchased by customers who know the password. It could be accessible to others, as ...
2
votes
1answer
88 views

I've just applied SUPEE-9767 to a Magento 1.6.2.0 site and there is no formkey option to enable. How has this happened and how can I fix it please?

I have applied the SUPEE-9767 patch for the correct version (1.6.2.0) of Magento and in the admin area, I can see the warning at the top of the page, indicating that the patch was successful. However,...
2
votes
1answer
373 views

Patching Magento 1.9.2.0 with Security patch 9767

I get one error trying to patch my Magento. Any ideas whats going on and how to fix it? Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/reverted successfully. ...
2
votes
3answers
2k views

SUPEE-9767 - Hunk #1 FAILED at 225. 1 out of 1 hunk FAILED

Trying to install the security patch SUPEE-9767 onto M1 EE v1.13.1.0 and i'm receiving the following error: Hunk #1 FAILED at 225. 1 out of 1 hunk FAILED -- saving rejects to file app/design/...
2
votes
1answer
322 views

Security patch 8788 not patched in magento 1.9.3.1

I have recently installed 1.9.3.1 and when I run a MageReport scan, it states that the website is still at risk and vulnerable against the 8788 patch.
2
votes
1answer
677 views

can not apply security patch 8788 v2 on magento 1.7.0.2

this is output when I tried to apply 8788 v2 sh PATCH_SUPEE-8788_CE_1.7.0.2_v2-2016-10-14-09-32-17\ \(2\).sh sed: RE error: illegal byte sequence Checking if patch can be applied/reverted ...
2
votes
1answer
925 views

Magento 1.9.0.1 Error on Multiple Stores after Supee 8788

I have a few Magento shops which gets this error after installing the Supee 8788 Patch. I cannot find anyone who have the same problem on Google... Fatal error: Class 'Mage_Uploader_Helper_Data' ...
2
votes
2answers
303 views

php 5.3.3 and Magento 1.7 (vulnerable?)

I need some advice, Is it safe to run php 5.3.3 on Magento 1.7.0.2.? How critically important to update to higher php? Given that all latest patches are installed on Magento. I am concerned about ...
2
votes
1answer
1k views

SUPEE 8788 Magento 1.9.2.4 [duplicate]

Trying to apply this patch to a 1.9.2.4 site and getting errors. Have already managed this with other Magento versions, a few errors but nothing I can't fix. Getting these errors: patching file app/...
2
votes
1answer
84 views

Security patch 5344 (Shoplift) Error executing check

On Magereport.com in my site patches Security patch 5344 (Shoplift) showing Error executing check. how to resolve it ?
2
votes
1answer
51 views

magento compromised - index.php added

My magento installation seems to have had a security breach. In /skin/install/default/default/images/ a file called index.php has appeared. It contains the following code: <?php if(@$_REQUEST["...
2
votes
1answer
81 views

When not use Modman?

When should one not use Modman in Magento development? What are the dangers of activating Symlincs? Thanks!
2
votes
1answer
123 views

Installing SUPEE 6285, error message still present in Admin area [duplicate]

I made sure to remove 5994 and the old 6285 patch as can be seen in the following: user@domain.com [~/public_html]# sh PATCH_SUPEE-5994_CE_1.6.0.0_v1-2015-05-15-04-34-46.sh -R Checking if patch can ...
2
votes
1answer
330 views

Execution of non php files vulnerability

The magento team detail a remote code execution bug here: http://www.magentocommerce.com/knowledge-base/entry/security-add-handler The test is to create a file eg test.php.csv and see if it can be ...
2
votes
2answers
2k views

How can I disable access to local.xml and config.xml for external visitors?

I problem that anybody from web can observe my file local.xml and config.xml I enabled Deny From all in htaccess file in folder app and direct access have been disabled for all files in this folder ...
2
votes
1answer
332 views

Strange Looking Search Terms - Possible Malicious activity?

cbwV AND 2890=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(115)||CHR(111)||CHR(115)||CHR(113)||(SELECT (CASE WHEN (2890 Is just one of the terms, there are 10+ different ones cropping up,...
2
votes
2answers
874 views

Secure catalogsearch URL?

Whats the rule to makes the search form URL https? I tried: <secure_url> <catalogsearch>/result/</catalogsearch> </secure_url> But that doesnt do the job. ...
2
votes
1answer
596 views

Security issues using URL parameters

I'm writing a custom router for Magento. Here's a code snippet of what I'm doing in the match() method: $pathInfo = $request->getPathInfo(); $splitPath = explode('/', $pathInfo); $category = $...
2
votes
1answer
41 views

What does Magento 1's end of life mean for security?

With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
2
votes
1answer
338 views

Problem with patch SUPEE-10888 on Magento 1.9.0.1

Problem with patch PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-19-03-00-53.sh on Magento 1.9.0.1, with all previous patches installed: Checking if patch can be applied/reverted successfully... ERROR: ...
2
votes
1answer
69 views

How to stop fake reviews and fake signups on Magento 1 and Magento 2?

We have 2 websites one is on Magento 1 and the second is on Magento 2 , In both websites we get fake reviews and fake signups everyday. Someone told me to add captcha which will not let bots or ...
2
votes
1answer
114 views

How to create a nonce / secure hash in Magento 2?

I want a simple link to activate a customer out of an email that gets sent to the admin on registration. I am using this module: https://github.com/enrico69/magento2-customer-activation for the ...
2
votes
1answer
1k views

Using SVG logo in Magento 2.2.4

I am trying to upload an SVG logo for my Magento website, but it is not allowing me to upload an SVG file. It says that it is an unsupported file. Any idea how to resolve this? Based on internet ...
2
votes
1answer
143 views

Where can I find details about APPSEC-1793 vulnerability fixed in SUPEE-10266?

SUPEE-10266 is out with a long list of fixed issues. The severest one to me is "APPSEC-1793: Potential file uploads solely protected by .htaccess", which is a RCE. I'd like to find out more about the ...
2
votes
2answers
257 views

Is it safe to have composer in production?

Is it safe/ok to have composer in production on a server hosting Magento?
2
votes
1answer
451 views

Magento 2 websites : BLOCK access from ALL & ALLOW access only from some countries?

There are many options and many articles, but I want some advice for my particular setup from Pros who have more experience than I do. On my VPS I have tree magento websites. All websites have the ...
2
votes
1answer
44 views

magento patch9767 payment order issue

After installing the patch-9767 I am unable to move to the next step from payment information in onepage checkout page.
2
votes
2answers
274 views

Issue while applying PATCH_SUPEE-9767_CE_1.9.3.0_v1-2017-05-25-09-09-56.sh in magento 1.9.2.4

I am facing issue while Applying PATCH_SUPEE-9767_CE_1.9.3.0_v1-2017-05-25-09-09-56.sh in Magento 1.9.2.4. Found below message after applying the patch. I am not aware of the steps to resolve the ...
2
votes
1answer
65 views

SUPEE-8788 Issue on Magento 1.8

After installing SUPEE-8788 on Magento 1.8, a file is created in app/code/local/Mage/Core/functions.php. Why Mage file is here instead of app/code/core ?
2
votes
1answer
231 views

Magereport test unknown after adding RewriteRule

My store was showing all the installed patches on Magereport until I added RewriteCond %{REMOTE_ADDR} !^xx.xxx.xx.xxx RewriteRule ^(index.php/)?admin/ - [L,R=403] RewriteCond %{REMOTE_ADDR} !^xx.xxx....
2
votes
1answer
62 views

Who thinks they can decode this encryped PHP file? [closed]

http://pastebin.com/7jP67T2V I have decoded the first part($e = base64_decode) but after that I get stuck. I haven't seen a shell like this before and can't find any similar ones to see how they ...
2
votes
1answer
170 views

Attempted exploit via Catalog Advanced Search?

I just noticed a few suspicious crash reports on my site for someone accessing the "Catalog Advanced Search" page. However, that link is not exposed anywhere on my site, so someone is accessing a ...
2
votes
3answers
216 views

Probably security issue

Some months ago i have patched my magento with: SUPEE-1533 SUPEE-5344 SUPEE-6285 SUPEE-5994 SUPEE-6482 SUPEE-6788 and i patched using this instruction https://magentary.com/kb/install-supee-6788-...
2
votes
1answer
280 views

SUPEE 7405: Add Form Key to sidebar/default.phtml

After installing SUPEE 7405 my custom theme Sidebar Cart stopped deleting products. When delete button is clicked, throws an error: "Cannot remove the product". Looks like I need to add Form Key to ...
2
votes
1answer
2k views

magento redirect http to https

I want to redirect http requests to https on Magento CE 1.8. I followed the steps below, but none of the methods work: system->web->secure->Use Secure URLs in Frontend "yes" In my .htaccess ...
2
votes
2answers
4k views

How to remove magento malware

my website was hacked and know it contains an <iframe> malware according with Google Webmaster Tools. It appears to be in a page that doesn't exist, example: domain.com/?page_id=4712 And this ...
2
votes
1answer
2k views

Magento 1.9 cache permissions being set as 777

I am getting an issue with Magento where my cache files are being set to 777 every time I re-cache the site. Is this standard behavior as it seems to be wrong to me, as far as I know no file should ...
2
votes
2answers
8k views

Magento 1.9.1 Upgraded to 1.9.2 via Magento Connect

I want to upgraded Magento 1.9.1 to 1.9.2 via Magento Connect. I Updatet the Packet "Mage_All_Latest", which works without any error or warning. After going back to the Admin Panel, my Admin Footer ...
2
votes
1answer
157 views

Best Practice for running site as user

I have a question about best practice for running a dedicated Magento server. We have a security consultant who want to run the site as APACHE while the Magento documentation says we should run as a ...
2
votes
1answer
107 views

what is /media/catalog/product/N/o/NoImages100_184x.jpg and why is it growing?

We were running out of space on our server so we did a search for large files we could delete and found one in htdocs/media/catalog/product/N/o/ called "NoImages100_184x.jpg" which was 112MB. It was ...
2
votes
1answer
415 views

PayPal seller email has changed in the admin

I believe a site I've been working on has been hacked. Here's what I know: PayPal seller address has changed to a random address This is not a PayPal bug Going through the logs - this wasn't changed ...
2
votes
0answers
146 views

How to implement content security policy in magento 2

I want to know how to implement CSP on Magento 2 with GTM. The site has multiple stores. Tried to google but was unable to find any concrete result. Implimenting a Content Security Policy Magento 1....
2
votes
1answer
35 views

Security Report - patch 8788

Patch 8788 is available for <= 1.9.2.4. I have 1.9.3.4. How can I fix the issues addressed?
2
votes
0answers
127 views

Is Magento 2 REST API CSRF-proof?

As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
2
votes
1answer
1k views

Magento security patch issue

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
2
votes
1answer
620 views

Restricting access to anonymous web APIs

As given in the documentation here : http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html By default magento 2 only restrict Catalog, Store and CMS API from anonymous users. In a ...
2
votes
3answers
1k views

SUPEE-9767 Error [duplicate]

When I trying to apply SUPEE-9767 in my Magento Community Edition 1.9.0.1 getting following error. ./PATCH_SUPEE-9767_CE_1.9.0.1_v1-2017-05-25-09-15-34.sh Checking if patch can be applied/reverted ...