Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Magento eCommerce PHP Remote Code Execution

ma.ttias.be

Post reply on HN
Print view View original

11–20 of 81 posts

Re: Magento eCommerce PHP Remote Code Execution

#11

Post by ErrantX »

NietTim wrote: post #6
ebbv wrote: post #4

This is hardly unique to Magento. Lots of applications do this. It's not ideal, but it's not SO bad if the application nags you to patch on start up. I don't use Magento, so I'm not sure if it does.

It does, and looks like this, a screen filling alert view when you login into the backend. http://i.imgur.com/yeBKQIM.png

It's the wordpress problem; Magento has made e-commerce accessible to anyone with a shared webspace and the minimum of knowledge (speaking as someone who's company integrates with small businesses who use Magento). So it's very easy for things to get out of date.

(or even worse; one-click installers on some shared web host... so they can't update it even if they wish!)

Re: Magento eCommerce PHP Remote Code Execution

#12

Post by onli »

toxican wrote: post #9
smt88 wrote: post #5

Earlier quoted context omitted.

What's bad is that it's so easy to fix. It's the distribution platform for software . Shouldn't there be lots of interested people that could take 20 minutes and write some software to fix this problem?

But they did, didn't they? There's a security patch and they're nagging people to install it. What are they failing to do?

Normally, if you have a security patch you release a new version containing that patch. 1.9.0 -> 1.9.1.

Re: Magento eCommerce PHP Remote Code Execution

#13

Post by teh_klev »

jay-saint wrote: post #10
jay-saint wrote: post #8

Admin and developer of two Magento based sites here. Magento has just started posting notifications of these vulnerabilities in their notification center. They sent two messages. One on April 16 and another on April 19. See images of message here http://imgur.com/a/edVGy they did inform us that a press release with the vulnerability was coming. That said I am annoyed that the patch was from February 2015 and October…

One extra note for those who may run their Magento install on a shared host. You will likely not be able to use the patch as is. It is distributed as .sh file that requires SSH and permissions that are not available on most shared hosts. This is a serious shortfall of this patching method. You should create a trouble ticket with support and they should be able to run the patch scripts for you.

I agree for the most part here. But it's not totally insurmountable. Patch against your local development and/or staging copy then upload the changed files to your shared host.

Re: Magento eCommerce PHP Remote Code Execution

#14

Post by mrweasel »

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk.

Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible.

On the positive side Magento does have an impressive amount of features.

Re: Magento eCommerce PHP Remote Code Execution

#16

Post by Navarr »

mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

The team has been working on a rewrite "Magento 2" that should alleviate most of the complaints of the original Magento and adopts PHP development best practices (composer, etc).

I also asked them to clarify the versioning scheme[1] specifically related to patches, etc. It sounds like it should be better, but it's hard to tell at this early stage.

They've also taken a radically different approach to documentation with Magento 2. [2]

[1]: https://github.com/magento/magento2/issues/1051

[2]: http://devdocs.magento.com/

Re: Magento eCommerce PHP Remote Code Execution

#17

Post by Navarr »

sarciszewski wrote: post #15

Would anyone be interested if I were to host a maintained fork of the Magento community edition on github with up-to-date security patches so you can just `git pull` and be done with it?

The only problem with that is you have to fork off that for your own Magento site and it basically doesn't help anyone that doesn't already know what they're doing and patch right away already. :\

Re: Magento eCommerce PHP Remote Code Execution

#18

Post by jlas »

mrweasel wrote: post #14

Unless it got significantly better/redesigned in the last couple of years, Magento is a piece of junk. Arguably it's been years since I worked with it, but installation was weird, developing is slow a cumbersome, documentation was lacking, search was pretty much broken and it was slow. I can't image running it on a shared host, performance must be terrible. On the positive side Magento does have an impressive amount…

Magento code in general is of very dubious quality. I once ran a quick static analysis on it and found some ridiculous results: https://twitter.com/jlas_/status/391615992473722880

Re: Magento eCommerce PHP Remote Code Execution

#19

Post by sarciszewski »

Navarr wrote: post #17
sarciszewski wrote: post #15

Would anyone be interested if I were to host a maintained fork of the Magento community edition on github with up-to-date security patches so you can just `git pull` and be done with it?

The only problem with that is you have to fork off that for your own Magento site and it basically doesn't help anyone that doesn't already know what they're doing and patch right away already. :\

True, and it's unlikely that they would update their website to encourage this approach since their incentive is to get people to pay them instead.
Post reply on HN