Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
98 views

Mod_Security Roadblocks, Hosting EE

I am experiencing recurring issues related to Mod_Security with EE on my current host, HostGator. I have seen HostGator suggested as a good host for EE projects in several articles and my work already ...
0
votes
1answer
25 views

Automatically creating an alphanumeric number for each new entry

I have setup a JSON feed to allow single sign-on to another system. Currently the entry_id and email are used as part of the URL string to access the 3rd party system, but this number could be guessed....
0
votes
1answer
41 views

Cannot login to CP importing db

I'm using EE v .3.4.4 and have used a dump of the site's live database to keep my development machine in sync from time to time. This has not been a problem in this project until last week. After ...
1
vote
2answers
194 views

Is there any setting in Expression Engine that does not permit cross-origin framing?

Running EE 3.5.11 In the portfolio section of my website, I display websites that I have built using an iFrame. Most of them work and display properly, but there are a handful of ExpressionEngine ...
0
votes
1answer
29 views

Installation hacked - rogue link inserted onto page

I've got a very old installation v2 that I think has been hacked. I've found a URL that is a clone of a template on the system, and has a rogue link inserted. I know that I need to update the whole ...
1
vote
2answers
102 views

Does anyone know any details on the recent security release notifications?

All our EE2 sites are displaying: "An ExpressionEngine version 2.11.6, build 20170207 has been released as a security release" Does anyone have any details about what security vulnerabilities are ...
0
votes
2answers
405 views

Prevent CSRF token expiring for EE powered kiosk

We are building a 'kiosk' interface into a site powered by EE (2.8.1) which makes various POST requests to other site templates as part of the flow. The problem we are having is that because the ...
0
votes
1answer
70 views

How to secure uploaded files

I'm looking for the best way to secure files uploaded via a front-end form into a standard File field. I need users to be able to upload a file, but I only want members of certain member groups to be ...
0
votes
1answer
37 views

Module development: Any reasons creating catch-all action is a bad idea?

When developing a website in EE, I often create custom modules to accomplish some task, such as processing a custom form, etc. I started creating 'actions' for each form, but this grew inconvenient ...
1
vote
2answers
48 views

What file holds the “Invalid username” message?

In trying to prevent username enumeration, I'm editing login messages to obfuscate whether the username or password was incorrect. I've successfully edited the messages for when the password is wrong, ...
0
votes
1answer
153 views

“This license is in use on multiple domains” - Privacy & Security issue?

I noticed the following in my EE account: "This license is in use on multiple domains, please make sure each use is authorized". The reason seems to be due to me having EE installed on development ...
1
vote
1answer
66 views

Security test fails on freemember:update_profile form

EDIT This question is related to compliance to a specific security test, the problem has nothing to do with Freemember extension. For the record : The solution found to pass the test was to simply ...
6
votes
6answers
19k views

How to fix “This form has expired. Please refresh and try again.”

I have a contact form that, if used after a certain time, will throw a "This form has expired. Please refresh and try again." error. I have added the following to my contact form, thinking it would ...
0
votes
1answer
44 views

Is it necessary to hide the system folder from search robots?

Does this make any sense in a robots.txt? User-Agent: * Disallow: /your_system_folder I'm guessing since the robots.txt file can be read it makes it even more dangerous to expose the system folder's ...
2
votes
3answers
74 views

Can you add to the restricted tags filter for security in EE to secure the application further?

I have a client who got a security check done on their site (they are a security company) and they came back with this in relation to an expresso store checkout: Checkout functionality Although ...
0
votes
1answer
157 views

Security of an Action URL called from AJAX

I have an action URL, index.php?ACT=23, that calls a function which inserts some info into the database. This is being called from an AJAX function, so I can't control where it is called from. My ...
0
votes
1answer
416 views

Channel Form: Why is Wygwam/CKFinder disabling the file browser for security reasons?

EE 2.9.2 - WYGWAM 3.3.3 In a Channel Form, I am getting the error... "The file browser is disabled for security reasons. Please contact your system administrator and check the CKFinder ...
1
vote
1answer
129 views

How to make Freeform forms editable without using the entry_id in the URL

I want to still allow users to edit their freeform entries without being logged in, but I need some security so the entry ID isn't in the URL, or hashed so it's not easily guessed. How is this ...
0
votes
1answer
51 views

Security on a redirect page for a short URL service

I'm setting up a simple short url service which utilises a template (code below) to forward the user to the correct page based on an entry id in the URL. The following code is based on EllisLab's ...
3
votes
2answers
401 views

Variable SSL and Cookies

Let's say I have a membership site, and my login page & form are served with SSL: https://mysite.com/member/login. <form action='https://mysite.com' method='post' class='login'> <!-- ...
4
votes
1answer
216 views

What is best practice for protecting templates saved as files?

I've just discovered that all of the templates I'm saving to the filesystem are accessible through the browser if the name is known, and now I've got a case of the screamin' heebie jeebies. For ...
6
votes
2answers
156 views

Securing form data

I have a tag pair that generates a form. I am trying to pass some sensitive information in the tag params, trying to think of a way to avoid exposing it by showing it via hidden field. For example, ...
0
votes
1answer
42 views

Security issues with putting member id in URI segments?

I'm using Safecracker Registration so that I can leverage Channels for my member data. I want to create pages that display member data in the frontend. Is there a security issue with using member ids (...
6
votes
2answers
1k views

Saving Credit Card Info

I am working on a website in ExpressionEngine2 and need to save the user's credit card information in the database as I also need to display this in a dropdownlist in the front end (whichever credit ...
3
votes
1answer
135 views

What is the level of risk in enabling user-uploaded photos in EE?

I know there will always be some level of risk when allowing user-submitted data, but what exactly does EE do natively to filter, validate, and sanitize photo uploads through the standard interface? ...
0
votes
0answers
56 views

Is it safe to initiate a temporary session in plugin for use with the Channel Entries API?

I have a plugin that will accept posted form data from a member group and then create or update a channel entry which that member group is not given permission to post or update in (via the control ...
1
vote
0answers
129 views

No matching hash algorithm on login

We're finding that on login forms for users who are not super admins we get this response. Is this a server or config issue maybe? EE 2.7.3
0
votes
1answer
206 views

Building a client portal

I built an EE site for a business client several years ago, and they are now asking about my adding a client portal to store and share documents. This would need to be a secure area of the site, as ...
2
votes
2answers
401 views

Auto-create random ‘secure’ (obfuscated) url titles

I have a site in which I'd like to achieve the following: Provide a publicly accessible but obfuscated and hard to guess at URL to which a customer can be referred to, to submit some data via a ...
4
votes
4answers
2k views

How to stop external site redirect hijacking?

We are recently seeing a number of external sites trying to leverage the core of EE to use our site to force referrals that look like they are coming from our domain. My assumption is they are trying ...
2
votes
2answers
581 views

EE, SSL, and insecure content

I've installed an SSL on my server and I'm forcing https:// via htaccess. The entire site needs to be secured. Unfortunately, the browsers are complaining of insecure content. For example: <link ...
2
votes
1answer
94 views

Login Password Does Not Save

The login password does not save when I login in ether Chrome or Safari (on Mac). I am running 2.7. This is a pain in the ass when I am developing, I need to login 25 times a day with my password. ...
3
votes
4answers
269 views

Cartthrob payment gateway (Worldpay) callback gives “the action you have requested invalid post back”

Using Cartthrob 2.4 and EE 2.7, paying via Worldpay, returns this message: the action you have requested is invalid My guess is its the new security introduced for POST requests, that require a new ...
0
votes
1answer
90 views

Site Hacked, No Original Email

I have a slight issue.. Actually a major one! The site I am working on is built in expression engine and it was hacked and whoever has done it has changed the password and the client has no idea what ...
4
votes
1answer
178 views

What is the security issue that 2.7.2 solves?

I'm asking because I have roughly 30 sites, most of which were started before my tenure here, that will need to be updated if this version is as critical as they say. It is hard for me to justify the ...
1
vote
1answer
319 views

XID created for every page load and many non-form items increasing size exp_security_hashes table. Bug with 2.7.1?

Here's the setup: secure forms turned on empty template (there are no forms, nothing at all in the template) EE 2.7.1 logged in/out (makes no difference) empty exp_security_hashes table ...
9
votes
1answer
1k views

Have forms been broken by new security issue?

I've just completed an upgrade from 2.5.3 to 2.7.0 (never want to do THAT again ;) ) and have run into an issue that seems to be coming from some changed security restrictions. I have several simple ...
1
vote
1answer
106 views

Set item pricing based on incoming (referer) URL

I am working on a site that sells books. There is one book that should be discounted for students of an affiliated college program. However only active students in the class can have access to the ...
15
votes
1answer
2k views

How secure is EE? Will it pass penetration tests?

I'm looking into the possibility of using Expression Engine to build secure sites. How does the EE core hold up against penetration tests and vulnerability scans that check for things like cross site ...
0
votes
1answer
41 views

Prevent access to templates from a remote server

I have some templates that output JSON in ExpressionEngine which we are called using a simple CURL request from a CodeIgniter app elsewhere on the same domain - we don't want these templates to be ...
1
vote
0answers
167 views

Does Throttling affect “good” bots negatively?

Throttling limits, "the number of page requests by a single IP address within a given time interval." In the ebook Securing ExpressionEngine 2, Mark Huot writes that, "[Throttling is] one of the first ...
0
votes
0answers
87 views

Vimeo pro/plus content with Duct Videos

Is it possible to access videos in a Vimeo pro or plus account that have been flagged as private/domain restricted?
1
vote
1answer
463 views

Safecracker forms fail PCI DSS

On our site we have a number of front-end Safecracker forms. Also, our website needs to be fully PCI DSS compliant and in order to achieve this, we have to use a scanning tool provided by our Merchant ...
0
votes
1answer
443 views

Recovering from a site hack, preventing another one

I am trying to help someone recover from a hack and prevent a further incident. They are running version 1.7.3. The result of the hack was modified index.php files in the root and system folders ...
0
votes
1answer
118 views

Expression engine core version limitations

I'm new to EE and I'm trying to do some securitiy testing on EE. Is it possible to make user login/registration and fileupload with exression engine core version? I tried using third party module ...
2
votes
2answers
282 views

Secure Login Forms

At present there doesn't seem to be an easy way to login securely using the Member module. Safecraker provides useful parameters in secure_action="yes" and secure_return="yes" to ensure encrypted ...
2
votes
2answers
100 views

Issues when putting system outside web root

Following 'best practice' of putting the EE system directory outside of the web root I have found that I now have a problem with password reset links. It seems the reset url sent in the emails when a ...
4
votes
1answer
292 views

Intelligent ways to force redirects before a session ends?

I was hoping to pick people's brains on a topic. I am developing a web app which sits on top of Expression Engine and this has worked really well so far. I have one issue though and I have a quick ...
2
votes
2answers
119 views

General backup security question when using Amazon S3

I have a general security/privacy question about addons that use Amazon S3 for backup / file storage. Here's my scenario: I host most of my client sites myself and use my own Amazon S3 account to ...
4
votes
1answer
534 views

Securing the control panel with SSL

I'm in the process of securing my control panel with SSL using the following rewrite rules RewriteEngine On RewriteCond %{HTTPS} off RewriteCond $1 ^(member|system) [NC] RewriteRule (.*) https://%{...