34

There is a better solution! You can change the XSS filtering member group by using some extra directives in your config file. Add the following, replacing the member group numbers as required; $config['xss_clean_member_group_exception'] = "1|6"; Using this method you can keep XSS filtering turned ON but remove it just for trusted members. I think you ...


20

We've had ExpressionEngine installs penetration tested in the past, most recently by the Security Operations team at one of the world's largest technology companies. The key takeaway was that the vast majority of issues were found in third-party add-ons. There were a few issues with ExpressionEngine itself; some of them were fixed in more recent versions of ...


18

READ FIRST: Payment Card Industry Data Security Standard Do you really looked over all risks of this? The field encryption is not what you need to worry about in this case. I don't even want to advise something about encryption, because I feeling really bad even about this idea. It's no good solution to keep CC info secure enough this way . To keep such ...


14

It seems that for whatever reason my 2.5.3 was permitting these forms to function even though "Process form data in Secure Mode?" was set to YES. After the upgrade to 2.7 this restriction began to be enforced on my admin forms as well. The solution comes in two parts: Add a hidden input field to carry the XID token Find and use a suitable value to assign ...


13

The issue is that certain PDFs falsely trigger the XSS screener's detection routines. And yes, this IS still a bug, although it is fairly difficult to predict which PDFs will be affected. I have had consistent issues with: PDFs exported from Microsoft Word on any platform PDFs with embedded color profile data The best way around it if you only need certain ...


13

DO NOT STORE FULL CREDIT CARD INFO ON YOUR OWN SERVER. Even if encrypted, storing full credit card data on your own server is generally a very bad idea due to the security and legal ramifications should your website/database/server ever be compromised. Many places store the last four digits of the credit card on their server for quick access or ease of ...


11

Do you have access to the MySQL database? If so, you can change the admin's email and initiate a password reset at the login screen.


9

I think this should be the solution, http://api.jquery.com/unload/ After this code executes, the alert will be displayed whenever the browser leaves the current page. It is not possible to cancel the unload event with .preventDefault(). This event is available so that scripts can perform cleanup when the user leaves the page. $(window).unload(...


8

I've done this by securing the ACT id with a token of sorts, then before calling the API to import the data - I simply create a temporary user session for a superadmin. Example: function login_temporary_user() { if( $this->EE->session->userdata['member_id'] == 0) { $this->EE->session->create_new_session(1, TRUE); $...


7

I assume that EE's native file upload functions use the Upload class, but what exactly does the Upload class do to validate and sanitize? Does it check MIME type using some sort of actual file analysis, or does it simply rely on what the browser reads it as? The Upload class uses the $_FILES array and it does use $_FILES[]['type'], but we do some ...


7

Yes, the cookies are still susceptible to being intercepted. The full set of cookies for matching domains is transmitted by the browser with each page request to that domain, even if the original cookies were set using HTTPS/SSL and the current page is HTTP. One way around this is by setting the "secure" flag on cookies you set. Any cookies set with the "...


6

Take a look at system/expressionengine/libraries/Auth.php. You should have all the available methods at your disposal to properly create any member session without actually submitting a login form. The ACT would work well I think, provided you pass all the other correct information. Here is a very minimal example of the proposed process. // Grab the member ...


6

If you're only allowing access to a single template, I'd imagine the easiest way would be to use PHP's header to add header('Access-Control-Allow-Origin: *'); At the top of the template


6

In your EE config.php / site configuration, is your site URL set with http:// or https:// ? If it's not the latter, try that to see if it solves the issue. I think EE matches the site_url to the exact URL (and protocol) that you set in this configuration variable. The trickier thing is when you have a site that's partially under HTTP and partially HTTPS. In ...


5

We keep all of our downloadable files above web root, so they're not directly accessible, similar to this setup: /public_html /system /files And of course, we use Link Vault to obfuscate, protect against hot linking, and track the downloads.


5

Version 1.1.1 of the Master Config added two global variables by default. Here's a sample of use: {if global:env == 'dev'} {if logged_out} {redirect='tmp/login'} {/if} {/if} An alternate approach without nesting conditionals: {if global:env == 'dev' && logged_out} {redirect='tmp/login'} {/if} If you are using a version before ...


5

It's because EE variables don't detect or utilise https by default, so you have to set them in code. The easiest way is to use an add-on: http://devot-ee.com/add-ons/https-support http://devot-ee.com/add-ons/dm-force-ssl http://devot-ee.com/add-ons/force-ssl (commercial) (In no particular order) I've not used any of these so can't ...


5

It looks like you moved your templates folder to outside the system folder. Since you already did it, why not move it to above the web root? Just remember to update the related settings. (see "Server path to site’s templates" at the bottom of the page) To keep all system files above the web root is good practice. Alternatively... If for some reason you ...


5

if you have v 2.10 - try to replace <input type="hidden" name="XID" value="{XID_HASH}"> with <input type="hidden" name="csrf_token" value="{CSRF_TOKEN}"> The XID constant is deprecated starting from 2.8.0


4

This is a bad idea - explain to your client that it's against the principles of HTTP. For example, a customer opens different pages of your site in two tabs/windows. The close the second one, and go back to the first tab, but not it's logged out and any link/page submit is going to cause an error. That would piss me right off. Secondly, Andy's solution is ...


4

In your templates you can wrap any custom fields that might contain a non-https embed code with Low Replace, finding and replacing any non-https embed sources. For example: {exp:low_replace find="http://www.youtube.com/embed" replace="https://www.youtube.com/embed" } {your_custom_field} {/exp:low_replace} Low Replace will allow you to ...


4

I would develop an EE add-on that implements an SSO (single sign on) protocol, like oauth or SAML: http://en.wikipedia.org/wiki/Security_Assertion_Markup_Language and then have the the 3rd party app authenticate the user using their EE credentials, which would get passed back and forth between EE and the app using oauth, saml, or some other open ...


4

You should be able to do this in htaccess: <IfModule mod_headers.c> SetEnvIf Request_URI "^/index.php/embeddable-content(/.*)?" CORS=TRUE Header set Access-Control-Allow-Origin "*" env=CORS </IfModule> This'll only set the CORS header when your request matches that URI.


4

According to the bug reported by Mark Drzycimski, for those who don't have an Ellislab account, the solution is listed as follows: In /system/expressionengine/libraries/Redirect.php on line 50, change: "<p><a href='".$_GET['URL']."'>".$_GET['URL']."</a></p>\n</body>\n</html>"; to: "<p><a href='".$_GET['URL']."'...


3

We are on Rackspace Managed Cloud Servers. We have vhosts set up. My folder structure looks like this: -/var/www/vhosts/mysite.com If this what you expect? could I just put the admin files in "www"? My setup is the same. I configure my vhosts with the following: mysite.com database log public system Public is where the vhost actually points to to ...


3

Jason Siffring at Surprise Highway posted an article on how to do this with .htaccess. Unfortunately it requires a .htpasswd file, which it looks like you're trying to avoid. Here's the link in case it's useful: http://surprisehighway.com/article/how-to-password-protect-development-and-staging-sites-with-htaccess


3

This is not a solution, but I am using EE 2.7 and have been able to narrow down the offending code. Simply commenting out these three lines allowed for my offending PDFs to pass. I personally am not using this in production, and I have spent time trying to modify the code to get it to work... with no luck. Maybe someone can use this information to help ...


3

It's worth bearing in mind that EE has plenty of hooks to make this sort of thing easier - sessions_end and member_member_logout are a couple that would be worth looking at. Depending on whether or not your app has a built in authentication library it would probably be fairly simple to write an extension that initiates a new session within your app. You'd ...


3

This is happening as the ip_address column was dropped in EE 2.5.4 and replaced with column session_id Solspace 'Friends' hasn't been updated since September 20th 2012 so it hasn't been patched to fix this issue. The only way around this is to either wait for an update or 'hack' mod.friends.php There will be a pre xid check in the comments of this file - ...


3

For an example of an existing approach to this you might want to take a look at how the Entry API module ($) handles this. This addon essentially provides CRUD api for channel entries via REST/XML-RPC (it also supports SOAP too if you happen to really hate yourself). It does use a member (which I's argue is a good thing, as you can then hook into the native ...


Only top voted, non community-wiki answers of a minimum length are eligible