18

READ FIRST: Payment Card Industry Data Security Standard Do you really looked over all risks of this? The field encryption is not what you need to worry about in this case. I don't even want to advise something about encryption, because I feeling really bad even about this idea. It's no good solution to keep CC info secure enough this way . To keep such ...


13

DO NOT STORE FULL CREDIT CARD INFO ON YOUR OWN SERVER. Even if encrypted, storing full credit card data on your own server is generally a very bad idea due to the security and legal ramifications should your website/database/server ever be compromised. Many places store the last four digits of the credit card on their server for quick access or ease of ...


7

I assume that EE's native file upload functions use the Upload class, but what exactly does the Upload class do to validate and sanitize? Does it check MIME type using some sort of actual file analysis, or does it simply rely on what the browser reads it as? The Upload class uses the $_FILES array and it does use $_FILES[]['type'], but we do some ...


7

Yes, the cookies are still susceptible to being intercepted. The full set of cookies for matching domains is transmitted by the browser with each page request to that domain, even if the original cookies were set using HTTPS/SSL and the current page is HTTP. One way around this is by setting the "secure" flag on cookies you set. Any cookies set with the "...


6

In your EE config.php / site configuration, is your site URL set with http:// or https:// ? If it's not the latter, try that to see if it solves the issue. I think EE matches the site_url to the exact URL (and protocol) that you set in this configuration variable. The trickier thing is when you have a site that's partially under HTTP and partially HTTPS. In ...


5

if you have v 2.10 - try to replace <input type="hidden" name="XID" value="{XID_HASH}"> with <input type="hidden" name="csrf_token" value="{CSRF_TOKEN}"> The XID constant is deprecated starting from 2.8.0


5

It looks like you moved your templates folder to outside the system folder. Since you already did it, why not move it to above the web root? Just remember to update the related settings. (see "Server path to site’s templates" at the bottom of the page) To keep all system files above the web root is good practice. Alternatively... If for some reason you ...


5

It's because EE variables don't detect or utilise https by default, so you have to set them in code. The easiest way is to use an add-on: http://devot-ee.com/add-ons/https-support http://devot-ee.com/add-ons/dm-force-ssl http://devot-ee.com/add-ons/force-ssl (commercial) (In no particular order) I've not used any of these so can't ...


4

According to the bug reported by Mark Drzycimski, for those who don't have an Ellislab account, the solution is listed as follows: In /system/expressionengine/libraries/Redirect.php on line 50, change: "<p><a href='".$_GET['URL']."'>".$_GET['URL']."</a></p>\n</body>\n</html>"; to: "<p><a href='".$_GET['URL']."'...


3

It's really your choice here. I imagine that this framework is best for smaller addons. One point of access is always slightly frowned upon; because it creates a SPOF in your addon. Trust me, I totally get the code-install-test-uninstall-ad.nauseam development path of EE modules, I'm sick of it too. However, I've found, that paying more careful attention ...


3

Addons is too broad for the forum, you'll have to contact the manufacurers however I've never seen a 3rd party phone home from the popular developers (SolSPace, P&T, GotoLow, Expresso, PutYourLightsOn)... The Licence check came in on version 2.9 (July 15, 2014), all it does is send some server details back to EllisLabs, heres the actual payload code for ...


3

I've looked through the source code for you but I'm drawing a blank. I thought there was an arbitrery timeout value in the token however in 2.9.2 this seems to have been depreciated (or I imagined it)! I'm also going to assume the error is not a missing XID/CSRF_token as this has been covered above and no answer is forth-coming. First Question : How are ...


3

Nope, none whatsoever, those id's are simply unique identifiers, but are not meant to be private.


3

You can do this with last version (2.8.8) of MX Title Control. You can add {random_string} tag into URL Title Pattern and get 10 characters random string. Hidden Configuration Variables $config['mx_random_string_length'] = "20"; $config['mx_random_string_pattern'] = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";


3

We have fixed this with a couple of changes, seems Cartthrob has a couple of issues... 1) Based on this post XID POST from third party we added the we added 'csrf_exempt' => 1 into the database for the payment_return_action in the Cartthrob exp_actions table. We do not know if this helped, but seems like we should do it. Carttrhob does not add this in when ...


3

Le sigh... I always forget to RTFM. https://docs.expressionengine.com/v3/general/system_configuration_overrides.html#x-frame-options You can set it in your config.php to NONE. Edit Just FFS, here's how I figured it out: cd ~/ee3-path/ grep -nr X-Frame-Options Results had this line: ee()->output->set_header('X-Frame-Options: '.$frame_options); ...


3

If you are using EE4 then you could use the built-in encrypt / decrypt variable modifiers. So your template entry could end up with something like this perhaps: {path='SingleSignon/Microsite'}?externalId={entry_id:encrypt}{email:encrypt} HTH


2

Change the Control Panel Session type to Cookies Only: http://ellislab.com/expressionengine/user-guide/cp/admin/security_settings.html This will get a Remember Me checkbox showing on the login screen.


2

I know it'd be hacking core, but wouldn't throwing a rel="nofollow" attribute on the anchor negate the effectiveness of this?


2

First, for guests to be able to edit Freeform entries, you need to use the restrict_edit_to_author="no" parameter (http://www.solspace.com/docs/freeform/edit/#restrict_edit_to_author) in your {exp:freeform:edit} form. In your initial form, i.e. when using {exp:freeform:form} or {exp:freeform:composer}, make sure to have created and associated a field (eg. ...


2

The only thing i see from a security standpoint is EllisLab considers php in template a bad practice. If this where me I would create a small plugin that would render your PHP for you. and pass the segment through a parameter. That would then redirect the user. To create a plugin you can use my plugin starterkit. 1.) Create a folder with lowercase plugin ...


2

I too have been faced with rather demanding security injection testing on EE (and non EE) sites so I can fee lyour pain, and speak from some experiance. First the direct answer to your question. There isn't a directory/list, however you can read and modify the security library here (it uses the CodeIgniter Lib, whcih is assimilated by the EE_Security file) :...


2

What data does the script which is being triggered with action URL accept? If that's EE form submission, then you should not worry if you follow standard EE forms security settings/practice. If it's a custom script that accepts ANY data, then you of course might need to add additional protection to it. There's a separate chapter in EE docs on security ...


2

Mathods is dependet on how sensitive this data for you: Yes, you can encrypt this data using openssl-encrypt for example (for php >=5.3), but if user have enough time and is transparent what data you keep in this encrypted message, user can find way to decrypt. Needs to add salt. Salt needs to keep somewhere. So I think more secure solutions is keep ...


2

You'll discover all patch notes here in the changelog. Security patches are a combination of both EE & underlying frameworks. EE is pretty resilient and a lot of security issues are more server side orientated.


1

I found out from Robin Sowell with Ellis Lab that the latest security release fixes a previously unknown issue in CodeIgnitor, which is at the core of version 2. So this definitely affects all installs of EE2.


1

There's also another possibility that I ran into with the "This form has expired. Please refresh and try again." error. Using Stash, I recently turned on caching on my pages that include forms. The issue here is that the the CSRF token from a previous user is cached in this scenario. This created the error on every page including a submitted form. It was a "...


1

I would not put it in your robots.txt file. As you noted, it exposes the path to your system folder. Malicious bots or users will certainly look at that file and poke around the paths you have in there. So long as you don't have a hyperlink to your system folder in your site, an SEO bot won't stumble upon or find it anyways


1

This just in from Brad at P&T: From what I can tell, if Admin->Security & Privacy->Security & Settings's "Website Session Type" is set to anything with session in it (session only, cookies and session), then EE just won't log you in from the front-end of the site at all. No idea why. It will only work with "cookies only" selected. ...


1

If the form is submitted to the same template (e.g. not to a module action-id) then you don't have to expose the data at all on the page to the user. After posting the form, your template tag is called again. You can handle the form data and at the same time, the tag parameters are available. add-on tips Make sure the parameter data does not contain the ...


Only top voted, non community-wiki answers of a minimum length are eligible