Auto Added by WPeMatico
I am facing an issue where unwanted JavaScript code is being injected into my Magento 2 CMS static blocks. Every time I manually remove this obfuscated JavaScript code from a static block, it reappears automatically after about 5 minutes. Steps… Read More »Unwanted JavaScript Code Injected into Magento 2 CMS Static Block
I’m having a free theme provided by third party named FreeGo Solwin, this theme seem to load some font and js from an external site which violate the magento CSP. I’ve try add the whitelist file into folder etc of… Read More »How do i resolve CSP for my magento custom theme
We are trying to apply the security patch for the Cosmicsting vulnerabillty. The Magento version is 2.4.6 (Open Source). We have downloaded the patch For versions 2.4.6, 2.4.6-p1, 2.4.6-p2, 2.4.6-p3, 2.4.6-p4, 2.4.6-p5: VULN-27015-2.4.6x_v2_COMPOSER_patch.zip from Adobe website. Then, we unzipped the… Read More »Apply patch for Cosmicsting vulnerabillity
In my local dev system I need to symlink modules into the /vendor folder. Unfortunately magento checks if any included file actually resides inside magento’s root folder. Files from outside that scope are not permitted for security reasons. Since I… Read More »Override files in MagentoFrameworkFilesystemDirectory
We have a magento 2.4.6 and we are using the PAYPLUG payment module during checkout. It is configured so none datas about credit cards are asked on our own website BUT a popup opens leading customer to payplug website, where… Read More »Magento 2.4.6 security issues? Credit card fields added into checkout / payment module
I’m experiencing a problem where, for some reason, an attacker manages to create user accounts in my administration, and manages to change emails for existing users. I removed all malware from the site redid the default magento installation I changed… Read More »Magento 2.3.5 hacking problem
On a sizeable site, for the third time now, we’re seeing this type of attack: A request to GET /rest/V1/cmsBlock/search to find out some block IDs. A few minutes later there is PUT /rest/V1/cmsBlock/123 to insert some script into a… Read More »API keeps getting hacked, how is it still compromised?
I recently got my hands on magento_csp feature but I am not sure if I understood it correctly yet. I have created a custom modul which purpose is like a centralized summary of csp entries. app/code/Vendor/Modul/etc/csp_whitelist.xml <?xml version=”1.0″ encoding=”UTF-8″?> <csp_whitelist… Read More »Magento CSP csp_whitelist.xml but there are still violations remaining
I am trying to limit access to my Magento 2 admin panel via nginx using location ~* ^/(index.php/admin|admin) { 00.00.00.00; try_files $uri $uri/ /index.php?$args; location ~* .php$ { try_files /dummy @proxy; } deny all; } The problem I have is… Read More »Magento 2 Restrict access to admin
I have a simple store running on Magento 2.4.6 p2, with guest checkout disabled. I have added Google captcha on registration as well as login form. Still, once in a while, I receive spam orders like this. I am unable… Read More »Magento 2 : Spam Order Getting Placed