Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
2
votes
3answers
1k views

SUPEE-9767 Error [duplicate]

When I trying to apply SUPEE-9767 in my Magento Community Edition 1.9.0.1 getting following error. ./PATCH_SUPEE-9767_CE_1.9.0.1_v1-2017-05-25-09-15-34.sh Checking if patch can be applied/reverted ...
2
votes
0answers
211 views

Magento 2.0.14 and 2.1.7 security update - possible issues? [closed]

Reference: Magento 2.0.14 and 2.1.7 security update How can I apply the 15 patches in older versions like 2.0.13 or 2.1.6? What are the possible issues?
2
votes
0answers
44 views

Magento 2 - How to create a new custom module API [duplicate]

In Magento 2, How to create custom module API? of course, I need have security? Anyone can help explain with a sample module, thanks!
2
votes
1answer
274 views

“Blind SQL Injection” alert from one scanner for Magento site…legit?

I help manage a Magento site and one of the tools we use in our efforts to stay on top of site security is Decertify. I just ran a report & it came back with a warning about possible "blind SQL ...
2
votes
1answer
402 views

Permanently delete phishing tools in Magento [closed]

My site was affected by guruincsite. I installed a backup, updated to the latest version of Magento and updated with all security packages. Also, I checked that nothing is referred to these tools or ...
2
votes
0answers
46 views

Moving App Folder to other location [closed]

I have already searched on google this question and I already ended up with no success. Ok basically the title of my question says it all.. Is there any possibility that I can set my app folder in a ...
2
votes
2answers
307 views

Contact form hack

I recently faced a problem where, I am receiving emails from an unknown source. Somehow they bypass the validation for email and sending me SQL statement in email fields for example: (SELECT CHAR(113)...
1
vote
5answers
4k views

How to force a admin user to change their password?

On Magento EE if you go to System > Configuration > Advanced > Admin > Security their is an option to set Password Change to Forced. If we do this and someone has an expired password will it lock ...
1
vote
1answer
146 views

What to do, when I was hacked

Over the past week this Superfish crap has appeared all over my Magento website it's literally hijacked it. What should i do?
1
vote
4answers
82 views

Magento 2.3 secure your site back and front

Got a very security conscious client. I've searched stack exchange and only found partial solutions to certain security issues. I've also searched dev docs and again found one or two suggestions in ...
1
vote
2answers
1k views

Magento: magmi.ini changed with xmlrpc.php … how could this happen?

we discovered that somebody changed the magmi.ini file. As the daily import of the 5000 skus not working we searched the system and found 2 files which where changed after the admins left for weekend....
1
vote
1answer
333 views

Paypal IPN - Is it safe to use the default Magento url?

By default Magento have a route allowing IPN request on the url: http://www.mystore.com/paypal/ipn Here mainly 2 infos are processed by on the request: Order ID: Mage_Paypal_Model_Ipn::_getOrder() ...
1
vote
1answer
341 views

How to install Magento security patch for Enterprise Edition (Commerce)?

How can I get Magento patches for Enterprise Edition (now Magento Commerce), I have followed: http://devdocs.magento.com/guides/m1x/other/ht_install-patches.html#get-ee but not getting the exact ...
1
vote
2answers
43 views

Magento 2: All Quote details in view source. Does it cause a security issue?

In Magento 2, all the quote, item, payment method, totals details loaded in view source and in window.checkoutConfig Js global variable. Does it cause a security issue?
1
vote
1answer
30 views

From my website some one sending an email to one email address continuously one after another

From my website some one is sending an email to one email address continuously one after another. I cant find where it is sending from , I use the SMTPPro extension to send emails. The email contents ...
1
vote
2answers
198 views

Is there any necessary for patches if i have installed Magento 1.9.2.4

Currently i have upgrade my Magento from 1.9.2.3 to 1.9.2.4 So should i also need to install patches ? I have followed these links (https://www.magentocommerce.com/download?_ga=1.263831883....
1
vote
3answers
53 views

Is “seolink” a virus?

On my site there is a script after the body tag, both on frontend and adminhtml. I can't find where it is included: It adds links in the header. Has anyone seen this?
1
vote
4answers
2k views

Can not restrict IP via htaccess

I have tried a lot of different methods of restricting the access via .htaccess and I can not get it to work. I have tried both methods on production and on fresh magento installation on new cPanel. ...
1
vote
5answers
2k views

How do i check if site is infected by SUPEE-5344 and SUPEE-1533

i applied already the two patches SUPEE-5344 and SUPEE-1533, but how do i check, or how do i know my site and files are not already infected? Thanks in advance.
1
vote
1answer
2k views

What is the risk of not using Magento's “getSubmitUrl” function?

This produces a URL that includes some encryption. If I want to create a custom "Add to Cart" button and use my own link: "/checkout/cart/add?qty=1&product=2" that does not have this encryption, ...
1
vote
1answer
278 views

SSL certificate requirement

If I install Magento on a site which does not have SSL certificates configured then will I be able to configure Magento to use an SSL certificate at a later time without having to reinstall. Is there ...
1
vote
2answers
192 views

Magento 1.9.3.2 - Exception printing is disabled by default for security reasons

I have just moved a Magento install from one server to another and now when I try to access the frontend I get the "Exception printing is disabled by default for security reasons" error. I have ...
1
vote
2answers
278 views

Magento 1.9.2.1 how to prevent core_config_data from getting malicious scripts

I have been scanning the website at Magento Scan and getting the following error: Magento Compromise Injection Your site is compromised with injected JavaScript. (131) The malicious code ...
1
vote
1answer
682 views

Magento Admin URL [Permission with Whitelist IP]

I'm trying to protect the URL of my login admin page. It's possible to allow only my ip to this page? And if another IP tries to open the admin login page, there is an unauthorized permission. I ...
1
vote
1answer
145 views

security patch 5944 - error

our site was hacked recently. we had backup , so we reverted and restricted site only to our ip , now we are trying to install all security patches. we installed 7405 , 5344 , 6482 patches. we cross ...
1
vote
1answer
971 views

Magento Plugin Password Policy

Is there any magento plugin that has the features below: force the user changed password in every 90 days. change password must required min 8 char
1
vote
5answers
834 views

How to extract security patch files from sh file

I need to install security patch "PATCH_SUPEE-7405_CE_1.9.2.2_v1-2016-01-20-04-35-33.sh" in magento ver 1.9.2.2 . Is there any way I can extract package of complete patch files from this file.
1
vote
1answer
110 views

How do I know security patch - 6788 applied or not?

I'm new to applying Magento Security Patch. So here Initially I have applied PATCH_SUPEE-6482_EE_1.13.1.0_v2.sh patch for which I'm getting applied.patches.list file in app/etc/. And the applied....
1
vote
1answer
40 views

Version 1.8 fully patched vs latest build

From a security point of view what's people's views on having version 1.8 running and it being fully patched vs the running the latest build. My view is that the latest build may have bug fixes and ...
1
vote
2answers
435 views

install security patches for magento 1.9.0 version

We need to install all security patches that required for community edition [ 1.9.0 ] In this link https://www.magentocommerce.com/download I found that the following security patches are necessary:...
1
vote
2answers
496 views

How to solve patch update/revert errors? SUPEE-6285 and 1.9.2.0

While reverting the SUPEE-6285 patch (in order to install SUPEE-6285-V2), I get errors like patching file downloader/template/connect/packages_prepare.phtml Hunk #1 FAILED at 33. 1 out of 1 ...
1
vote
1answer
2k views

Change minimum password length for customers in SOAP API

TL;DR: how do I change the minimum password length requirement for customers created via the SOAP v2 API? I need to change the minimum password length requirement for customers created via the SOAP ...
1
vote
2answers
82 views

Why admin added to the site?

Today automatically added two admins to my site? Is my site hacked? What should I do to fix this bug?
1
vote
1answer
144 views

Help! Credit Card Grabber Found on Magento 1.9

I've found a piece of code that contacts a really weird domain with CC info. Can someone confirm it doing something malicious? If so, what should I do without taking down the server? I'm a total ...
1
vote
1answer
227 views

Magento2 Two factor authentication for Frontend

Do you guys know where to purchase or download M2 2FA ext for FRONTEND (or both frontend and admin)
1
vote
1answer
63 views

Magento 1.9 with no security patches got hacked. How to install the security patches without Magento Connect?

Magento 1.9.1 Porto theme Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his ...
1
vote
2answers
393 views

Magento 1.9 Fake customer with address

I have encountered an interesting problem. One of the magento shops I support has a spam problem. A lot of fake customer accounts are created, which I could probably solve easily by adding a honeypot ...
1
vote
2answers
337 views

Checking , Applying & Verifying SUPEE Patches

I have a magento 1.9.2 installed for the past two years and never applied SUPEE security patches. I looked up so many articles online on how to apply these patches but there are some doubts I need to ...
1
vote
2answers
372 views

SUPEE 9767 V2 fail on Magento 1.8.1.0 CE

I am getting this error while patching : can't find file to patch at input line 433 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |diff -...
1
vote
1answer
1k views

Magento 2: How to secure AJAX request from hacking? [closed]

How to secure jQuery AJAX request on Client & Server side? So there will be minimum risk of hack. On server side we can use https
1
vote
2answers
98 views

Security patch supee-8788 - Can it be applied to Magento 2.0.6 community edition?

I would like to know if the supee-8788 security patch can be applied to magento 2.0.6 as I am unable to find any documentation on it relating to magento 2.0.6 ?
1
vote
1answer
33 views

Security concern

I am constantly checking my logs. Few requests are as follow: POST /admin/Cms_Wysiwyg/... POST /customer/admin/Cms_Wysiwyg/... POST /catalog/admin/Cms_Wysiwyg/... I know, these request are security ...
1
vote
2answers
422 views

Malware in Miscellaneous Scripts section in General/ Design tab

OK so google informed me that my website had been compromised and had Malware so they were showing a warning to people coming to my website through Chrome. I have found the Malware it looked ...
1
vote
1answer
35 views

Robos.txt & enable-cookies in Magento

From last 2 weeks a hacker / brute forces are attacking on our Magento website. First they have changed our emails, password may be for any kind of information because every time when we change ...
1
vote
2answers
2k views

Magento Payment Methods Not Showing - Shows a CC Form Instead

I have noticed a strange issue recently on the Magento checkout. The same thing occurs whether I am using the default onpage Magento checkout, or if I am using the lotusbreath onepage checkout ...
1
vote
1answer
28 views

Which folder should I put admin-related JS files?

I've written a few javascripts which are meant for the admin, but I'm not sure in which folder I should place these JS files. These scripts will be embeded in the pages in the Magento admin panel. ...
1
vote
1answer
81 views

'Clean' magento install 1.9.0.1 (patches installed) spam scripts installed?

I have a couple of magento webshops. And only one magento webshop without any extensions and with all patches installed has the issue that it installs some scripts that send out spam. Some facts: ...
1
vote
1answer
13 views

Is it necessary to do security patches before upgrading Magento?

I am new to Magento. I got a Magento project which I need to upgrade. To do so I read in some tutorials that there are security patches to be performed before upgrading Magento. I am curious if those ...
1
vote
1answer
338 views

How to sanitize custom Customer attributes?

I've created a customer attribute for the Customer model, and I added it to the Customer grid. This works like magic, simply adding the attribute to the frontend registration and edit forms allows a ...
1
vote
1answer
62 views

Apply patch not working supee-5345

Check my site with Magento 1.7.x detected that would solve several problems patching the project. I did, clean the cache of my project but it has not worked yet. bash PATCH_SUPEE-5345_CE_1.7.0.2_v1-...