Magento Version 1.3.2.4 Security Update - XSS Vulnerability Fix
Magento Version 1.3.2.4 has been released in response to a major security issue that has been identified in all prior versions of Magento. The issue affects the customer account registration page, if you’re reluctant to upgrade, or if you’ve written to core files (shame on you), there are a couple of solutions:
Edit file (app/code/core/Mage/Customer/Model/Customer.php) as below:
674 675 676 | if (!Zend_Validate::is($this->getEmail(), 'EmailAddress')) { $errors[] = Mage::helper('customer')->__('Invalid email address "%s"', htmlentities($this->getEmail())); } |
Alternatively if you don’t want to edit core files, add the following to your .htaccess file:
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR]
RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|
|
).* [NC,OR]
RewriteCond %{HTTP_REFERER} ^(.*)(<|>|’|
|
|'|<|>|�).* [NC,OR]
RewriteCond %{HTTP_COOKIE} ^.*(<|>|’|
|
|'|<|>|�).* [NC,OR]
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|”>|”<|/|\\\.\.\\).{0,9999}.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|scan).* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|’|
|
|'|<|>|�).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(;|<|>|’|”|\)|
|
|"|'|<|>|�).*(/\*|union|select|insert|cast|set|declare|drop$).* [NC]
RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*\.[A-Za-z0-9].* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(<|>|’|
|
|'|<|>|�).* [NC]
RewriteRule ^(.*)$ badrequest.php
Change badrequest.php to the URL of your choice.
Panic over! 
Source: http://www.magentocommerce.com/boards/viewthread/51795/P0/
Recent Comments