Jump to content

Recommended Posts

security-lite.thumb.png.eb0aa698fa6f51f671934c3a875f2198.png

PrestaShop Module: Security Lite

With this module the risk of getting hacked is decreased. You should always care about security. By using this module, you add another layer of security to your PrestaShop website, that will benefit you in case someone tries to get unauthorized access.

I did not add settings that are obviously already covered by PrestaShop core with another technique, but when that it said, if some technique having more layers is good practice, I added those extra layers of security.
 

Here are the features you will have with this FREE module:

  • Brute force protection
  • Analyze HTTP headers
  • Block custom list of IP addresses
  • Block custom list of user agents
  • Ban IP’s
  • Automatic backup database
  • Generate strong passwords
  • Fix insecure permissions
  • Remove malicious files
  • Disable right click
  • Disable right click for images only
  • Check your shop for all known vulnerabilities
 
Download it here (v. 4.5.1): securitylite.zip

The installation of Security Pro is 100% according to PrestaShop's standards.

For PrestaShop 1.6.1.x and thirty bees 1.x.x Login into your shop's back office Go to "Add a new module" Click on "Choose a file" Browse for the module Click on "Upload this module" Look for the module and click "Install".

For PrestaShop 1.7.x.x Login into your shop's back office Go to "Modules & Services" Click on "Upload a Module" Browse for the module Upload and install the module.

The code quality is high and follows PretaShop's guidelines. The code is optimized for performance and security.

The module does not use overrides and none of the core-files are modified, so you are completely safe against conflicts between other modules.

Works on all major server software (Apache, Nginx, LiteSpeed, etc.). Works on PrestaShop 1.6.1.x, 1.7.x.x and on thirty bees 1.x.x. Works on PHP 5.6.x, 7.0.x, 7.1.x and 7.2.x.

Everything is very well tested. No known bugs exist and the module is battle tested! The module is already in production on many stores.

 

Raw screenshot:

screenshot.thumb.png.a202ed793a2f4a957d4922bae8c8e99a.png
 
Explanation:

1.thumb.png.3e6ceea30b09b1f9be64d2494c5381e1.png

2.thumb.png.c9a56ca32caaebbdaaf6de74d776e4a2.png

17.thumb.png.8fbb3ae00152b056df37e34496675da9.png

 

3.thumb.png.04139dde1904be834c6444ee99ec740b.png

4.thumb.png.ecae1b23500684c04aff56157eb947e4.png

5.thumb.png.0691f0c125c7e55518cedf0161852d34.png

6.thumb.png.93c4a68695b4575ef28a42b0a2db0c04.png

7.thumb.png.35e7ad13dcc227175490434cd83a7819.png

8.thumb.png.01a8c0b6744525fa80eb62851225b68c.png

18.thumb.png.ab5fa4d38dd55c9bc349a2cd9b8bef24.png

9.thumb.png.c470bd7247cf1536c0f68a4521f8d1c8.png

10.thumb.png.4be3e1f00f41a750f0a018673d86fceb.png

11.thumb.png.201919d2dfcd4eb62e8d5aed67265d75.png

12.thumb.png.2eb30c6845dd48125064ca8bad5ea231.png

13.thumb.png.4957bf30709745c7630c37d3bf7bd5d0.png

14.thumb.png.0dfd8bcda078fb4b63eaa04d87df6c7e.png

15.thumb.png.03e70e50a1ee1abd324c897bd76854d5.png

16.thumb.png.d6d1aa2f5c5bdb0ce8b969253ec511b9.png

111.thumb.png.7d5f82dfac9c711f8ff26c0b140ad8d1.png

 

Edited by MathiasReker
New major version (see edit history)
  • Thanks 1

Share this post


Link to post
Share on other sites

Hello.

I have review your module a little and I have an advice for an improvement and a report for an issue.

1. Will be good, if you add to your free version of the module the functionality to check security vulnerabilities that are known from CVE. This is my free and open-source library, that you can use on your free and paid module versions both: Security vulnerability checker :)

2. In your SecurityLite::getContent() method there is an issue. Every loading of the module settings page, your module clear the system cache ;)

    public function getContent()
    {
        $output = null;

        if ((bool) Tools::isSubmit('submitSecurityLiteModule')) { ... }

        return $output . $this->renderForm() . $this->checkSystem() . $this->securityPro() . $this->clearCache();
    }
    public function clearCache()
    {
        Tools::clearSmartyCache();
        Tools::clearXMLCache();
        Media::clearCache();
        Tools::generateIndex();
    }

 

Edited by zapalm
Fixed a typo (see edit history)

Share this post


Link to post
Share on other sites
5 hours ago, zapalm said:

Hello.

I have review your module a little and I have an advice for an improvement and a report for an issue.

1. Will be good, if you add to your free version of the module the functionality to check security vulnerabilities that are known from CVE. This is my free and open-source library, that you can use on your free and paid module versions both: Security vulnerability checker :)

2. In your SecurityLite::getContent() method there is an issue. Every loading of the module settings page, your module clear the system cache ;)


    public function getContent()
    {
        $output = null;

        if ((bool) Tools::isSubmit('submitSecurityLiteModule')) { ... }

        return $output . $this->renderForm() . $this->checkSystem() . $this->securityPro() . $this->clearCache();
    }

    public function clearCache()
    {
        Tools::clearSmartyCache();
        Tools::clearXMLCache();
        Media::clearCache();
        Tools::generateIndex();
    }

 

 

zapalm Your module error
 
[PrestaShop] Fatal error in module file :/home/.../../classes/module/Module.php(1361) : eval()'d code:
syntax error, unexpected 'zapalm' (T_STRING), expecting \\ (T_NS_SEPARATOR)

PS 1.6.1.23

Edited by TCHOUPI (see edit history)

Share this post


Link to post
Share on other sites

@zapalm Thank you.

1) I included your suggestions and made a fix for CVE-2018-7491.

2) You are right, it is superfluous to clear the case.

@TCHOUPI You can't install @zapalm's library as a module, it is a script. Btw. I included the checks in my module.
 

  • Like 1

Share this post


Link to post
Share on other sites
13 hours ago, shinetech.dk said:

@zapalm Thank you.

1) I included your suggestions and made a fix for CVE-2018-7491.

2) You are right, it is superfluous to clear the case.

@TCHOUPI You can't install @zapalm's library as a module, it is a script. Btw. I included the checks in my module.
 

ok thanks you, for ps 16 it can work ?
 

Share this post


Link to post
Share on other sites
14 hours ago, shinetech.dk said:

1) I included your suggestions and made a fix for CVE-2018-7491.

Advice for you for the future work :) You lose the benefits if you copy the library's code into your module. The best way is using Composer to keep up to date the library and get new vulnerability checks ;)

Share this post


Link to post
Share on other sites
22 minutes ago, zapalm said:

Advice for you for the future work :) You lose the benefits if you copy the library's code into your module. The best way is using Composer to keep up to date the library and get new vulnerability checks ;)

I had to refactor your functions. Also I don't want to include the checks for 1.6. :-)

Share this post


Link to post
Share on other sites

Hi, wanted to try the module, PS 1.7.5.1, debug enabled, see the image pls. What exactly does it mean?

security_lite.png

Share this post


Link to post
Share on other sites

mr_absinthe, your server settings is not right configured.

You need to go to your php.ini file and look for allow_url_fopen. The value of this PHP configuration should be "On".

allow_url_fopen = On

Allow_url_fopen is required when you use PrestaShop.

If you don't know how, you can ask your hosting to change the value for you.

Share this post


Link to post
Share on other sites

That is exactly what I have in php.ini. Cache cleared, browser and PS. Still the same.

Share this post


Link to post
Share on other sites

Can you try to restart your server? Do you have any files overriding your php.ini file?

Share this post


Link to post
Share on other sites

Server rebooted. Still the same. No I don't have any overrides related to php.ini as far as I know. Resetting module didn't help either.

Edited by mr_absinthe (see edit history)

Share this post


Link to post
Share on other sites
10 minutes ago, mr_absinthe said:

Server rebooted. Still the same. No I don't have any overrides related to php.ini as far as I know. Resetting module didn't help either.

Weird.

I managed to reproduce the warning with "allow_url_fopen = Off". I made a refractory of my code to make it work with the setting off.

I will release new version tonight.

Share this post


Link to post
Share on other sites
5 minutes ago, mr_absinthe said:

Weird is that I have


allow_url_fopen = On

Yes, it is weird that you get the warning with allow_url_fopen = On

But don't worry. I fixed it on my dev version. I will release a new version very soon.

Edited by shinetech.dk (see edit history)

Share this post


Link to post
Share on other sites

@mr_absinthe I just uploaded a new version, please give it a try. It should fix your warning. 🙂

Share this post


Link to post
Share on other sites

Seems to be working fine, on my test server at the moment 😉 Will go for PRO version if there will be some kind of discount available in the near future. Is your "file changes" section checking for Size | Permissions {File | Group | Owner} | Time | Stamp ?

Share this post


Link to post
Share on other sites
44 minutes ago, mr_absinthe said:

Seems to be working fine, on my test server at the moment 😉 Will go for PRO version if there will be some kind of discount available in the near future. Is your "file changes" section checking for Size | Permissions {File | Group | Owner} | Time | Stamp ? 

The file changes will send you an e-mail with all files changes since last check. You decide how often you want to check. You set that interval in a cron-job. In the e-mail you will get a full path to the changed files. The file changes works by comparing a hash. 🙂

Share this post


Link to post
Share on other sites

There will be a discount period when next release of PRO version get released. I release a new version this week with new PRO features.

Share this post


Link to post
Share on other sites

OK, if you will be sending a discount code, please let me have one as the current price is rather steep.

Share this post


Link to post
Share on other sites

What about the umask issue in core PrestaShop that converts new module directories to 0777 once they get uploaded?

Share this post


Link to post
Share on other sites
15 minutes ago, tapanda.gr said:

What about the umask issue in core PrestaShop that converts new module directories to 0777 once they get uploaded?

It is already solved. click on the tab "Permissions" then enable the features and "Save". This will run a script that fix all permissions on your PrestaShop website. Repeat this everytime you install a module.

image.png.f37af2627864200cec0bfc23f3b9ad14.png

 

It is overkill to hook this script or set it up as a cronjob. Lets keep the module lightweight so it does not affect your shops performance.

Edited by MathiasReker (see edit history)

Share this post


Link to post
Share on other sites

Hi I have this error when I try to configure the module.
The installation went ok, the configuration doesn't work.

[Tue Jul 23 10:26:39.988752 2019] [fcgid:warn] [pid 11106] [client 83.224.157.129:52003] mod_fcgid: stderr: PHP Fatal error:  Call to undefined method SecurityLite::displayInformation() in /var/www/clients/client6/web114/web/modules/securitylite/securitylite.php on line 86, referer: https://*************.it/************/index.php/module/manage?_token=QmCkpOIcZKEgO5smDIgcI9RnYFw-qSn1c2z466iYRkA

[Tue Jul 23 10:26:39.988844 2019] [fcgid:warn] [pid 11106] [client 83.224.157.129:52003] mod_fcgid: stderr: #2 /var/www/clients/client6/web114/web/vendor/symfony/symfony/src/Symfony/Component/Debug/ErrorHandler.php(668): Symfony\\Component\\Debug\\ErrorHandler->handleException(Object(Symfony in /var/www/clients/client6/web114/web/app/bootstrap.php.cache on line 3231, referer: https://********.it/***********/index.php/module/manage?_token=QmCkpOIcZKEgO5smDIgcI9RnYFw-qSn1c2z466iYRkA

Thanks in advance
 

Share this post


Link to post
Share on other sites
7 minutes ago, linoolmostudio said:

Hi I have this error when I try to configure the module.
The installation went ok, the configuration doesn't work.

[Tue Jul 23 10:26:39.988752 2019] [fcgid:warn] [pid 11106] [client 83.224.157.129:52003] mod_fcgid: stderr: PHP Fatal error:  Call to undefined method SecurityLite::displayInformation() in /var/www/clients/client6/web114/web/modules/securitylite/securitylite.php on line 86, referer: https://*************.it/************/index.php/module/manage?_token=QmCkpOIcZKEgO5smDIgcI9RnYFw-qSn1c2z466iYRkA

[Tue Jul 23 10:26:39.988844 2019] [fcgid:warn] [pid 11106] [client 83.224.157.129:52003] mod_fcgid: stderr: #2 /var/www/clients/client6/web114/web/vendor/symfony/symfony/src/Symfony/Component/Debug/ErrorHandler.php(668): Symfony\\Component\\Debug\\ErrorHandler->handleException(Object(Symfony in /var/www/clients/client6/web114/web/app/bootstrap.php.cache on line 3231, referer: https://********.it/***********/index.php/module/manage?_token=QmCkpOIcZKEgO5smDIgcI9RnYFw-qSn1c2z466iYRkA

Thanks in advance
 

What is your PrestaShop version and your PHP version?

Share this post


Link to post
Share on other sites

@linoolmostudio I did not manage to reproduce your warning. Can you send me a copy of your htaccess file in a private message?

Share this post


Link to post
Share on other sites
21 minutes ago, MathiasReker said:

@linoolmostudio I did not manage to reproduce your warning. Can you send me a copy of your htaccess file in a private message?

Just sent a private message.
thx :)

Share this post


Link to post
Share on other sites
4 minutes ago, linoolmostudio said:

Just sent a private message.
thx :)

I send a msg. I think it should be solve by that solution. If you need anymore help, please let me know  🙂

Share this post


Link to post
Share on other sites

Thanks Mathias,
Now both links are working.

Do you have a discount code to buy a security pro?

Regards,

Marcos

Share this post


Link to post
Share on other sites

Hello Marcos,

The price is already adjusted, so everyone gets the discount.

You can buy the module here: https://addons.prestashop.com/en/website-security-access/44413-security-pro.html

Best regards

Mathias

 

Share this post


Link to post
Share on other sites

New Pro version released: https://addons.prestashop.com/en/website-security-access/44413-security-pro.html

Share this post


Link to post
Share on other sites

Hi,
does your module support range IP block? If so, do I use 192.168.0.* or 192.168.0.1/24? Also, are blocked IPs listed in searchable table?

Share this post


Link to post
Share on other sites
On 9/4/2019 at 2:50 PM, mr_absinthe said:

Hi,
does your module support range IP block? If so, do I use 192.168.0.* or 192.168.0.1/24? Also, are blocked IPs listed in searchable table?

Maybe I will support IP range in next version. Are you on free or pro version?

Share this post


Link to post
Share on other sites
3 minutes ago, mr_absinthe said:

Currently trying the free version

Okay. I will see how much work it takes. Maybe I will include IP ranges.

Share this post


Link to post
Share on other sites

sorry to disturb you.


same problem as linoolmostudio
The installation went fine, fatal error in configuration.

PrestaShop version: 1.7.2.4
security lite: 2.00

best regards

Share this post


Link to post
Share on other sites
15 minutes ago, larrson said:

sorry to disturb you.


same problem as linoolmostudio
The installation went fine, fatal error in configuration.

PrestaShop version: 1.7.2.4
security lite: 2.00

best regards

Can you send me a screenshot, then I will get a clue how to fix it, because I am not able to reproduce the error.

 

Share this post


Link to post
Share on other sites
20 hours ago, MathiasReker said:

Okay. I will see how much work it takes. Maybe I will include IP ranges.

That would be certainly good feature to have, also if those banned IPs are listed below each other, such as:

123.12.12.11

123.11.11.13

etc. so we can search them unlike it is done on the maintenance settings.

On my two servers, I noticed "Some features in Security Pro might not work on your setup, because your .htaccess file is not used! (Apache)" however on both the .htaccess is present in root.

Share this post


Link to post
Share on other sites
1 minute ago, mr_absinthe said:

That would be certainly good feature to have, also if those banned IPs are listed below each other, such as:

123.12.12.11

123.11.11.13

etc. so we can search them unlike it is done on the maintenance settings.

On my two servers, I noticed "Some features in Security Pro might not work on your setup, because your .htaccess file is not used! (Apache)" however on both the .htaccess is present in root.

Are you on a Apache, nginx or litespeed?

Share this post


Link to post
Share on other sites

first one:

Server information Linux #1 SMP Tue May 14 21:24:32 UTC 2019 x86_64

Server software version: Apache, PHP version: 7.2.22

second one:

Apache, CGI with Apache Worker or another webserver, PHP version: 7.2.22

Both running PrestaShop version: 1.7.6.1

Edited by mr_absinthe (see edit history)

Share this post


Link to post
Share on other sites
4 minutes ago, mr_absinthe said:

first one:

Server information Linux #1 SMP Tue May 14 21:24:32 UTC 2019 x86_64

Server software version: Apache, PHP version: 7.2.22

second one:

Apache, CGI with Apache Worker or another webserver, PHP version: 7.2.22

Both running PrestaShop version: 1.7.6.1

Can you try to clear your cache and check if that message is still displayed?

Share this post


Link to post
Share on other sites
1 minute ago, mr_absinthe said:

Cache cleared browser + ps and it is still the same on both.

Okay, I will make some additional checks. I release a new version soon :)

Share this post


Link to post
Share on other sites
37 minutes ago, larrson said:

sorry to disturb you.


same problem as linoolmostudio
The installation went fine, fatal error in configuration.

PrestaShop version: 1.7.2.4
security lite: 2.00

best regards

It might be, that your htaccess file is not writeable. Can you please check?

Share this post


Link to post
Share on other sites
8 hours ago, MathiasReker said:

It might be, that your htaccess file is not writeable. Can you please check?

Unfortunately, it's still doesn't work. I tried everything. 0655, 0755, and even 0777.

best regards

Share this post


Link to post
Share on other sites

Just to let you know, if I enable Debug mode and run on PS v 1.7.5.1 and security lite: 2.00 I receive this error popup:

Warning on line 159 in file /home/xsxsxsxsxs/public_html/modules/securitylite/securitylite.php
[2] chmod(): Operation not permitted
 

Share this post


Link to post
Share on other sites
2 hours ago, mr_absinthe said:

Just to let you know, if I enable Debug mode and run on PS v 1.7.5.1 and security lite: 2.00 I receive this error popup:

Warning on line 159 in file /home/xsxsxsxsxs/public_html/modules/securitylite/securitylite.php
[2] chmod(): Operation not permitted
 

You get this error because you do not have permission to use chmod(). Ask your hosting administrator to grant you that permission.

Share this post


Link to post
Share on other sites
On 9/12/2019 at 10:05 PM, larrson said:

Unfortunately, it's still doesn't work. I tried everything. 0655, 0755, and even 0777.

best regards

Please send me a screenshot of the error.

Share this post


Link to post
Share on other sites

As a test, I have manually changed permissions an a directory to 777 using FileZilla. With debug disabled, I run the fix using your module, permissions are changed back to 755 and success message "Permissions updated!" is received. Do you still think that I do not have permission to use chmod()?

Share this post


Link to post
Share on other sites
14 hours ago, Giovanni - HexaNet said:

Well it doesnt work

please let me know what does not work, and I will apply a fix.

Share this post


Link to post
Share on other sites

Hi, did you manage to have a look at the issue mentioned above:  "On my two servers, I noticed "Some features in Security Pro might not work on your setup, because your .htaccess file is not used! (Apache)" however on both servers the .htaccess is present in root." ?

Edited by mr_absinthe (see edit history)

Share this post


Link to post
Share on other sites

 

2 minutes ago, mr_absinthe said:

Hi, did you manage to have a look at the issue mentioned above:  "On my two servers, I noticed "Some features in Security Pro might not work on your setup, because your .htaccess file is not used! (Apache)" however on both servers the .htaccess is present in root." ?

It is solved in the pro version. I will fix it it lite version in this week. Thank you.

Share this post


Link to post
Share on other sites

Hi Mathias,

I'm testing to Free module but the file permissions doesn't solve my problem.
Sorry the text is in Dutch but you can understand it I think. :>)

Secuirty Lite_2019-12-04_14-37-12.jpg

Share this post


Link to post
Share on other sites
21 hours ago, spacestar said:

Hi Mathias,

I'm testing to Free module but the file permissions doesn't solve my problem.
Sorry the text is in Dutch but you can understand it I think. :>)

Secuirty Lite_2019-12-04_14-37-12.jpg

Can you show me a screenshot where you see this message?

Share this post


Link to post
Share on other sites
Just now, spacestar said:

This is/was😁 the screenshot.

Please show a full shreenshot with all content on the page. You can send me a private message.

Share this post


Link to post
Share on other sites

You should all consider to download my new module, that fix the critical security issue reported by Prestashop today.

 

Share this post


Link to post
Share on other sites
On 5/5/2019 at 12:05 PM, Soyons Solidaire said:

 

zapalm Your module error
 
[PrestaShop] Fatal error in module file :/home/.../../classes/module/Module.php(1361) : eval()'d code:
syntax error, unexpected 'zapalm' (T_STRING), expecting \\ (T_NS_SEPARATOR)

PS 1.6.1.23

The module is now compatible with 1.6.1.x +

Share this post


Link to post
Share on other sites
Posted (edited)
On 9/4/2019 at 2:50 PM, mr_absinthe said:

Hi,
does your module support range IP block? If so, do I use 192.168.0.* or 192.168.0.1/24? Also, are blocked IPs listed in searchable table?

The module does now support IP ranges. 🙂 Both formats are supported.

Edited by MathiasReker (see edit history)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
×
  • Create New...

Important Information

Cookies ensure the smooth running of our services. Using these, you accept the use of cookies. Learn More