18 votes
Accepted

Saving Credit Card Info

READ FIRST: Payment Card Industry Data Security Standard Do you really looked over all risks of this? The field encryption is not what you need to worry about in this case. I don't even want to ...
user avatar
  • 5,781
13 votes

Saving Credit Card Info

DO NOT STORE FULL CREDIT CARD INFO ON YOUR OWN SERVER. Even if encrypted, storing full credit card data on your own server is generally a very bad idea due to the security and legal ramifications ...
user avatar
  • 607
7 votes
Accepted

What is the level of risk in enabling user-uploaded photos in EE?

I assume that EE's native file upload functions use the Upload class, but what exactly does the Upload class do to validate and sanitize? Does it check MIME type using some sort of actual file ...
user avatar
  • 520
7 votes
Accepted

Variable SSL and Cookies

Yes, the cookies are still susceptible to being intercepted. The full set of cookies for matching domains is transmitted by the browser with each page request to that domain, even if the original ...
user avatar
  • 1,232
5 votes
Accepted

What is best practice for protecting templates saved as files?

It looks like you moved your templates folder to outside the system folder. Since you already did it, why not move it to above the web root? Just remember to update the related settings. (see "Server ...
5 votes

How to fix "This form has expired. Please refresh and try again."

if you have v 2.10 - try to replace <input type="hidden" name="XID" value="{XID_HASH}"> with <input type="hidden" name="csrf_token" value="{CSRF_TOKEN}"> The XID constant is ...
user avatar
  • 107
3 votes
Accepted

Automatically creating an alphanumeric number for each new entry

If you are using EE4 then you could use the built-in encrypt / decrypt variable modifiers. So your template entry could end up with something like this perhaps: {path='SingleSignon/Microsite'}?...
user avatar
  • 3,572
3 votes
Accepted

Is there any setting in Expression Engine that does not permit cross-origin framing?

Le sigh... I always forget to RTFM. https://docs.expressionengine.com/v3/general/system_configuration_overrides.html#x-frame-options You can set it in your config.php to NONE. Edit Just FFS, here'...
user avatar
  • 5,900
3 votes
Accepted

Module development: Any reasons creating catch-all action is a bad idea?

It's really your choice here. I imagine that this framework is best for smaller addons. One point of access is always slightly frowned upon; because it creates a SPOF in your addon. Trust me, I ...
user avatar
  • 5,900
3 votes
Accepted

"This license is in use on multiple domains" - Privacy & Security issue?

Addons is too broad for the forum, you'll have to contact the manufacurers however I've never seen a 3rd party phone home from the popular developers (SolSPace, P&T, GotoLow, Expresso, ...
user avatar
  • 2,418
3 votes
Accepted

How to fix "This form has expired. Please refresh and try again."

I've looked through the source code for you but I'm drawing a blank. I thought there was an arbitrery timeout value in the token however in 2.9.2 this seems to have been depreciated (or I imagined it)!...
user avatar
  • 2,418
3 votes
Accepted

Security issues with putting member id in URI segments?

Nope, none whatsoever, those id's are simply unique identifiers, but are not meant to be private.
user avatar
  • 2,255
2 votes

How to make Freeform forms editable without using the entry_id in the URL

First, for guests to be able to edit Freeform entries, you need to use the restrict_edit_to_author="no" parameter (http://www.solspace.com/docs/freeform/edit/#restrict_edit_to_author) in your {exp:...
user avatar
  • 6,139
2 votes
Accepted

Security on a redirect page for a short URL service

The only thing i see from a security standpoint is EllisLab considers php in template a bad practice. If this where me I would create a small plugin that would render your PHP for you. and pass the ...
user avatar
  • 1,029
2 votes
Accepted

Can you add to the restricted tags filter for security in EE to secure the application further?

I too have been faced with rather demanding security injection testing on EE (and non EE) sites so I can fee lyour pain, and speak from some experiance. First the direct answer to your question. ...
user avatar
  • 2,418
2 votes
Accepted

Security of an Action URL called from AJAX

What data does the script which is being triggered with action URL accept? If that's EE form submission, then you should not worry if you follow standard EE forms security settings/practice. If it's ...
user avatar
  • 2,831
2 votes

Securing form data

Mathods is dependet on how sensitive this data for you: Yes, you can encrypt this data using openssl-encrypt for example (for php >=5.3), but if user have enough time and is transparent what data you ...
user avatar
  • 5,781
2 votes

Does anyone know any details on the recent security release notifications?

You'll discover all patch notes here in the changelog. Security patches are a combination of both EE & underlying frameworks. EE is pretty resilient and a lot of security issues are more server ...
user avatar
  • 3,163
1 vote

Mod_Security Roadblocks, Hosting EE

Your best bet is still to open a support ticket with HostGator and asking them to 'whitelist' those mod_sec rules that are causing the problem. As EE5 isn't as common as say WordPress, most hosting ...
user avatar
1 vote

Installation hacked - rogue link inserted onto page

The only timeI've encountered something like this is when the site was on a shared hosting. It turned out this happened because of a leaky joomla install on that same server. You can safely delete the ...
user avatar
1 vote

Does anyone know any details on the recent security release notifications?

I found out from Robin Sowell with Ellis Lab that the latest security release fixes a previously unknown issue in CodeIgnitor, which is at the core of version 2. So this definitely affects all ...
user avatar
1 vote

How to fix "This form has expired. Please refresh and try again."

There's also another possibility that I ran into with the "This form has expired. Please refresh and try again." error. Using Stash, I recently turned on caching on my pages that include forms. The ...
user avatar
1 vote
Accepted

Is it necessary to hide the system folder from search robots?

I would not put it in your robots.txt file. As you noted, it exposes the path to your system folder. Malicious bots or users will certainly look at that file and poke around the paths you have in ...
user avatar
  • 611
1 vote

Channel Form: Why is Wygwam/CKFinder disabling the file browser for security reasons?

This just in from Brad at P&T: From what I can tell, if Admin->Security & Privacy->Security & Settings's "Website Session Type" is set to anything with session in it (session only, ...
user avatar
1 vote

Securing form data

If the form is submitted to the same template (e.g. not to a module action-id) then you don't have to expose the data at all on the page to the user. After posting the form, your template tag is ...
user avatar
  • 2,157
1 vote

ExpressionEngine and CORS?

If you don't want to enable PHP in your templates you can also use https://github.com/nathanpitman/np_access_control_allow_origin.pi.ee_addon to do this. :)
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible