Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
17 votes
3 answers
2k views

Are PDFs still an XSS problem with EE uploads?

I keep running into this and I'm hoping there is a suitable solution - PDF uploads by anyone other than a super admin run into the error "the file cannot be written to disk". This persists unless, as ...
Jean St-Amand's user avatar
15 votes
1 answer
2k views

How secure is EE? Will it pass penetration tests?

I'm looking into the possibility of using Expression Engine to build secure sites. How does the EE core hold up against penetration tests and vulnerability scans that check for things like cross site ...
user1974's user avatar
  • 151
15 votes
4 answers
1k views

How would you wrap EE authentication around a custom app?

A client has an EE2 site and wants us to setup a 3rd party app but keep it private to EE members only. How would you extend EE's member sessions to provide single sign on with a 3rd party PHP app? ...
Jason Siffring's user avatar
9 votes
1 answer
1k views

Have forms been broken by new security issue?

I've just completed an upgrade from 2.5.3 to 2.7.0 (never want to do THAT again ;) ) and have run into an issue that seems to be coming from some changed security restrictions. I have several simple ...
Andy's user avatar
  • 515
9 votes
3 answers
392 views

Inserting entries from remote posted XML

I'm trying to post/update/delete entries in a channel by posting XML to a URL. I've created a module with an action URL that does the processing and uses the Channel Entries API to manage the entries ...
Tom's user avatar
  • 93
6 votes
2 answers
1k views

Saving Credit Card Info

I am working on a website in ExpressionEngine2 and need to save the user's credit card information in the database as I also need to display this in a dropdownlist in the front end (whichever credit ...
heinkasner's user avatar
6 votes
6 answers
24k views

How to fix "This form has expired. Please refresh and try again."

I have a contact form that, if used after a certain time, will throw a "This form has expired. Please refresh and try again." error. I have added the following to my contact form, thinking it would ...
ExpressionEngineNewbie's user avatar
6 votes
2 answers
169 views

Securing form data

I have a tag pair that generates a form. I am trying to pass some sensitive information in the tag params, trying to think of a way to avoid exposing it by showing it via hidden field. For example, ...
developarvin's user avatar
  • 2,347
4 votes
5 answers
226 views

Password Protect Development Environment Only?

I'm developing a site with Git and Master Config, and up until yesterday I was forcing users to log-in to view the site on the development server with this code in my document head template: {if ...
kmgdev's user avatar
  • 2,724
4 votes
2 answers
3k views

Log out upon tab/window close

I have an ExpressionEngine application that displays some financial information, and the client is requesting that the user is logged out upon closing a tab/window. Is that possible? I currently ...
Zachary's user avatar
  • 101
4 votes
4 answers
3k views

How to stop external site redirect hijacking?

We are recently seeing a number of external sites trying to leverage the core of EE to use our site to force referrals that look like they are coming from our domain. My assumption is they are trying ...
Adam Christianson's user avatar
4 votes
1 answer
220 views

What is best practice for protecting templates saved as files?

I've just discovered that all of the templates I'm saving to the filesystem are accessible through the browser if the name is known, and now I've got a case of the screamin' heebie jeebies. For ...
Andy's user avatar
  • 515
4 votes
1 answer
185 views

What is the security issue that 2.7.2 solves?

I'm asking because I have roughly 30 sites, most of which were started before my tenure here, that will need to be updated if this version is as critical as they say. It is hard for me to justify the ...
thatgibbyguy's user avatar
4 votes
1 answer
296 views

Intelligent ways to force redirects before a session ends?

I was hoping to pick people's brains on a topic. I am developing a web app which sits on top of Expression Engine and this has worked really well so far. I have one issue though and I have a quick ...
Conor Higgins's user avatar
4 votes
1 answer
544 views

Securing the control panel with SSL

I'm in the process of securing my control panel with SSL using the following rewrite rules RewriteEngine On RewriteCond %{HTTPS} off RewriteCond $1 ^(member|system) [NC] RewriteRule (.*) https://%{...
Dylan's user avatar
  • 1,074
3 votes
3 answers
1k views

ExpressionEngine and CORS?

I need to enable cross-domain AJAX requests on my site, while limiting the cross-domain access to a particular template. This template is in its own template group, so the requests from the script ...
Tim's user avatar
  • 636
3 votes
1 answer
140 views

What is the level of risk in enabling user-uploaded photos in EE?

I know there will always be some level of risk when allowing user-submitted data, but what exactly does EE do natively to filter, validate, and sanitize photo uploads through the standard interface? ...
positlux's user avatar
  • 607
3 votes
2 answers
440 views

Variable SSL and Cookies

Let's say I have a membership site, and my login page & form are served with SSL: https://mysite.com/member/login. <form action='https://mysite.com' method='post' class='login'> <!-- ...
kmgdev's user avatar
  • 2,724
3 votes
3 answers
111 views

Update User-Added Resources to SSL-Friendly URLs?

I have a field in my publish form where users can add embed code for a video, and they can also embed videos using Wygwam. The entire site has SSL enabled, but the video embed codes use the insecure "...
kmgdev's user avatar
  • 2,724
3 votes
4 answers
281 views

Cartthrob payment gateway (Worldpay) callback gives "the action you have requested invalid post back"

Using Cartthrob 2.4 and EE 2.7, paying via Worldpay, returns this message: the action you have requested is invalid My guess is its the new security introduced for POST requests, that require a new ...
Laurence Cope's user avatar
2 votes
2 answers
598 views

EE, SSL, and insecure content

I've installed an SSL on my server and I'm forcing https:// via htaccess. The entire site needs to be secured. Unfortunately, the browsers are complaining of insecure content. For example: <link ...
ExpressionEngineNewbie's user avatar
2 votes
2 answers
376 views

How to protect a digital directory but allow downloads?

First time setting up a digital purchases online and would like some pointers/tips on how to protect the directory where all the digital items are stored so someone can't access the file directly like:...
Siebird's user avatar
  • 4,815
2 votes
2 answers
421 views

Auto-create random ‘secure’ (obfuscated) url titles

I have a site in which I'd like to achieve the following: Provide a publicly accessible but obfuscated and hard to guess at URL to which a customer can be referred to, to submit some data via a ...
Jonathan Schofield's user avatar
2 votes
3 answers
93 views

Can you add to the restricted tags filter for security in EE to secure the application further?

I have a client who got a security check done on their site (they are a security company) and they came back with this in relation to an expresso store checkout: Checkout functionality Although ...
Aaron's user avatar
  • 1,162
2 votes
1 answer
96 views

Login Password Does Not Save

The login password does not save when I login in ether Chrome or Safari (on Mac). I am running 2.7. This is a pain in the ass when I am developing, I need to login 25 times a day with my password. ...
seeingis's user avatar
  • 325
2 votes
2 answers
104 views

Issues when putting system outside web root

Following 'best practice' of putting the EE system directory outside of the web root I have found that I now have a problem with password reset links. It seems the reset url sent in the emails when a ...
foamcow's user avatar
  • 7,176
2 votes
2 answers
122 views

General backup security question when using Amazon S3

I have a general security/privacy question about addons that use Amazon S3 for backup / file storage. Here's my scenario: I host most of my client sites myself and use my own Amazon S3 account to ...
Jim Pannell's user avatar
2 votes
2 answers
290 views

Secure Login Forms

At present there doesn't seem to be an easy way to login securely using the Member module. Safecraker provides useful parameters in secure_action="yes" and secure_return="yes" to ensure encrypted ...
Ian Young's user avatar
  • 5,407
1 vote
2 answers
136 views

DB Error with Solspace Friends on new Install of EE 2.5.5. Solutions?

I'm testing the code pack from Solspace for the Friends module. This is on a brand new clean install of EE 2.5.5 The error occurs when trying to add a comment. Full error code below Having done a ...
Frequency's user avatar
  • 169
1 vote
2 answers
256 views

Is there any setting in Expression Engine that does not permit cross-origin framing?

Running EE 3.5.11 In the portfolio section of my website, I display websites that I have built using an iFrame. Most of them work and display properly, but there are a handful of ExpressionEngine ...
forrest's user avatar
  • 1,068
1 vote
2 answers
110 views

Does anyone know any details on the recent security release notifications?

All our EE2 sites are displaying: "An ExpressionEngine version 2.11.6, build 20170207 has been released as a security release" Does anyone have any details about what security vulnerabilities are ...
Marketing Alliance's user avatar
1 vote
1 answer
44 views

Security issues with putting member id in URI segments?

I'm using Safecracker Registration so that I can leverage Channels for my member data. I want to create pages that display member data in the frontend. Is there a security issue with using member ids (...
ExpressionEngineNewbie's user avatar
1 vote
1 answer
133 views

How to make Freeform forms editable without using the entry_id in the URL

I want to still allow users to edit their freeform entries without being logged in, but I need some security so the entry ID isn't in the URL, or hashed so it's not easily guessed. How is this ...
user1840204's user avatar
1 vote
1 answer
47 views

Page refresh on submission of entry_form with the text "select" in it

I'm using the exp:channel:entry_form to allow users to add content to my site. A nagging bug for quite some time has been that the page the entry form is submitted on just refreshes if the form ...
user452886's user avatar
1 vote
1 answer
324 views

XID created for every page load and many non-form items increasing size exp_security_hashes table. Bug with 2.7.1?

Here's the setup: secure forms turned on empty template (there are no forms, nothing at all in the template) EE 2.7.1 logged in/out (makes no difference) empty exp_security_hashes table ...
Lloyd Hill's user avatar
1 vote
1 answer
108 views

Set item pricing based on incoming (referer) URL

I am working on a site that sells books. There is one book that should be discounted for students of an affiliated college program. However only active students in the class can have access to the ...
Doug's user avatar
  • 587
1 vote
1 answer
474 views

Safecracker forms fail PCI DSS

On our site we have a number of front-end Safecracker forms. Also, our website needs to be fully PCI DSS compliant and in order to achieve this, we have to use a scanning tool provided by our Merchant ...
doubleplusgood's user avatar
1 vote
2 answers
56 views

What file holds the "Invalid username" message?

In trying to prevent username enumeration, I'm editing login messages to obfuscate whether the username or password was incorrect. I've successfully edited the messages for when the password is wrong, ...
Vince Falconi's user avatar
1 vote
1 answer
74 views

Security test fails on freemember:update_profile form

EDIT This question is related to compliance to a specific security test, the problem has nothing to do with Freemember extension. For the record : The solution found to pass the test was to simply ...
laurent's user avatar
  • 225
1 vote
0 answers
167 views

No matching hash algorithm on login

We're finding that on login forms for users who are not super admins we get this response. Is this a server or config issue maybe? EE 2.7.3
Russ Back's user avatar
  • 479
1 vote
0 answers
171 views

Does Throttling affect "good" bots negatively?

Throttling limits, "the number of page requests by a single IP address within a given time interval." In the ebook Securing ExpressionEngine 2, Mark Huot writes that, "[Throttling is] one of the first ...
Daniel's user avatar
  • 23
0 votes
1 answer
93 views

Site Hacked, No Original Email

I have a slight issue.. Actually a major one! The site I am working on is built in expression engine and it was hacked and whoever has done it has changed the password and the client has no idea what ...
user2240's user avatar
0 votes
1 answer
32 views

Automatically creating an alphanumeric number for each new entry

I have setup a JSON feed to allow single sign-on to another system. Currently the entry_id and email are used as part of the URL string to access the 3rd party system, but this number could be guessed....
user2265915's user avatar
0 votes
1 answer
40 views

Module development: Any reasons creating catch-all action is a bad idea?

When developing a website in EE, I often create custom modules to accomplish some task, such as processing a custom form, etc. I started creating 'actions' for each form, but this grew inconvenient ...
Gary Reckard's user avatar
0 votes
1 answer
153 views

"This license is in use on multiple domains" - Privacy & Security issue?

I noticed the following in my EE account: "This license is in use on multiple domains, please make sure each use is authorized". The reason seems to be due to me having EE installed on development ...
ExpressionEngineNewbie's user avatar
0 votes
1 answer
247 views

How do I implement EE security best practice with vhost dedicated server

I was attempting the implement the additional security steps highlighted in the post installation documentation here on a dedicated server. I came to realize after talking with a Rackspace, my ...
Thomas's user avatar
  • 293
0 votes
1 answer
181 views

Security of an Action URL called from AJAX

I have an action URL, index.php?ACT=23, that calls a function which inserts some info into the database. This is being called from an AJAX function, so I can't control where it is called from. My ...
wot's user avatar
  • 321
0 votes
1 answer
51 views

Security on a redirect page for a short URL service

I'm setting up a simple short url service which utilises a template (code below) to forward the user to the correct page based on an entry id in the URL. The following code is based on EllisLab's ...
Adam George's user avatar
0 votes
1 answer
184 views

Mod_Security Roadblocks, Hosting EE

I am experiencing recurring issues related to Mod_Security with EE on my current host, HostGator. I have seen HostGator suggested as a good host for EE projects in several articles and my work already ...
Shayne's user avatar
  • 317
0 votes
1 answer
33 views

Installation hacked - rogue link inserted onto page

I've got a very old installation v2 that I think has been hacked. I've found a URL that is a clone of a template on the system, and has a rogue link inserted. I know that I need to update the whole ...
Andrew's user avatar
  • 393