magento / security-package Goto Github PK
View Code? Open in Web Editor NEWMagento Security Extensions
License: Open Software License 3.0
Magento Security Extensions
License: Open Software License 3.0
Need to check
Introduce new ReCaptchaAdminUi module and move to it corresponding functionality
Introduce new ReCaptchaContact module and move to it corresponding functionality
Introduce new ReCaptchaSendFriend module and move to it corresponding functionality
Need to check all of SuppressWarnings
(mechanism of static tests skipping) and remove redundant.
Need to check ALL of the modules
Introduce new ReCaptchaCustomer module and move to it corresponding functionality
When not configured/enabled.
JS Error - TypeError: this.settings is undefined in FF && Uncaught TypeError: Cannot read property 'lang' of undefined in Chrome in every product page.
FireFox
TypeError: this.settings is undefined
Chrome
VM2267:72 Uncaught TypeError: Cannot read property 'lang' of undefined
Need to verify and transfer (if needed) issues from
https://github.com/magento/magespecialist_TwoFactorAuth/prs
https://github.com/magento/magespecialist_ReCaptcha/pulls
repositories to the new one
https://github.com/magento/security-package/pulls
I'm working on Magento 2.3.1 version. And enabled Google ReCaptcha v2
The error you can see in the attachment file happens when a "not logged in" user with only virtual products in his cart goes to checkout.
In this situation the checkout appears a little bit different, because the virtual product doesn't need the first checkout step (shipping step) info.
If user fills email field with an already registered customer email, Magento "knows" the user is a registered customer email and adds the password field for login.
But ReCaptcha field doesn't appear. So when the customer clicks on Login button Magento shows the error message: Incorrect reCaptcha.
This is a serious problem for merchant that have only virtual products.
Can you fix it?
Thanks
Update README.md of security package
Provide a clear explanation of package responsibility
Event bridge integration should be removed
The link to recaptchs js is added several times to head, which slightly delays the loading time of the captcha on required pages.
Current dependency:
<virtualType name="Magento\NotifierAdminUi\Model\ResourceModel\UI\Channel\Collection"
type="Magento\Framework\View\Element\UiComponent\DataProvider\SearchResult">
<arguments>
<argument name="mainTable" xsi:type="string">notifier_channel</argument>
<argument name="resourceModel"
xsi:type="string">Magento\Notifier\Model\ResourceModel\Channel\Collection</argument>
</arguments>
</virtualType>
Need to replace Magento\Notifier\Model\ResourceModel\Channel\Collection
dependency on \Magento\NotifierApi\Api\ChannelRepositoryInterface
Example how to reflect current code:
https://github.com/naydav/Magento2Samples/blob/2.3/app/code/Engine/Location/view/adminhtml/ui_component/engine_location_city_form.xml#L36
https://github.com/naydav/Magento2Samples/blob/2.3/app/code/Engine/Location/Ui/DataProvider/CityDataProvider.php#L22
I have concerns about such method like
\Magento\NotifierApi\Api\AdapterInterface::validateMessage
\Magento\NotifierApi\Api\AdapterInterface::sendMessage
Looks like current service has some state, we need to separate "DTO" and "Service/Operation" logic into different concepts
\Magento\NotifierApi\Api\AdapterInterface
into AdapterDTO and sendMessage
service (\Magento\NotifierApi\Api\AdapterInterface::sendMessage)Examples can be found in
https://github.com/magento/async-import/blob/2.3-asynchronous-import-module/app/code/Magento/AsynchronousImportCsvApi/Api/Data/CsvFormatInterface.php
Unskip and fix integration test \Magento\TwoFactorAuth\Test\Integration\UserConfigManagerTest
Introduce new ReCaptchaCheckout module and move to it corresponding functionality
Update db_schema_whitelist.json for ALL of the modules according to
When creating a new table, remember to generate the db_schema_whitelist.json file.
When creating a new table, remember to generate the db_schema_whitelist.json file.
Unskip and fix integration test \Magento\NotifierEvent\Test\Integration\Rule\Validator\ValidateTemplateIdTest
Create/Update README.md of all of the modules
Provide a clear explanation of module responsibility
For details see https://github.com/magento/devdocs/wiki/Magento-module-README.md
For a customer want to enforce usage of 2FA but let the users decide which method to use (in our case either Google or U2F Key). Since the module does not currently support this scenario we must manually make sure that each user has at least one 2FA method configured.
Introduce new ReCaptchafrontendUi module and move to it corresponding functionality
This package requires very old and outdated version of endroid/qr-code v2.5(from 2017)
The endroid/qr-code v2.5 depends on some old symfony modules (like symfony/options-resolver).
This prevents from using other packages wich also requires symfony components but with higher versions in Magento2 projects.
For example requiring phpro/grumphp will fail on a fresh magento 2 project.
composer require --dev phpro/grumphp
Because of the conflicting symfony bundles version.
Need to verify and transfer (if needed) issues from
https://github.com/magento/magespecialist_TwoFactorAuth/issues
https://github.com/magento/magespecialist_ReCaptcha/issues
repositories to the new one
https://github.com/magento/security-package/issues
AC: ReCaptcha moved from MageSpecialist to Magento namespace and refactor for 2.4
Need to remove setter methods from:
Examples can be found in
https://github.com/magento/async-import/blob/2.3-asynchronous-import-module/app/code/Magento/AsynchronousImportCsvApi/Api/Data/CsvFormatInterface.php
Implementation should receive init parameters via constructor
\Magento\NotifierApi\Model\SerializerInterface
and \Magento\Notifier\Model\Serializer
\Magento\Framework\Serialize\SerializerInterface
The input to enter the 2FA code, (at least with the Google Authenticator provider for sure) obscures the input. This is generally considered security theatre at the cost of usability. At minimum a "show code" checkbox to toggle visibility would be nice, although I think there's no reason to obscure the input at all.
Unskip and fix integration test \Magento\NotifierTemplate\Test\Integration\TemplateGetterTest
Reafact ReCaptcha according to Magento Technical Guidelines
Data not saved on failed attempts
On Magento captcha code, it's here: https://github.com/magento/magento2/blob/2.3-develop/app/code/Magento/Captcha/Observer/CheckContactUsFormObserver.php#L80
We should have the same behavior on that class: https://github.com/magento/magespecialist_ReCaptcha/blob/2.3-develop/Observer/ReCaptchaObserver.php#L94
I don't understand where MSP\ReCaptcha\Observer\Frontend\ContactFormObserver is generated so I can't make the pull request by myself :(
Configure two websites e.g. using next flow:
Configure reCaptcha v2 or v3 with different settings for websites
Flow on Storefront
the recaptcha code is not used with the contact form widget in custom cms pages.
{{block class="Magento\Contact\Block\ContactForm" name="contactForm" template="Magento_Contact::form.phtml"}}
AC: 2FA moved from MageSpecialist to Magento namespace and refactor for 2.4
Our 2fa broke after 2.3.1 upgrade and we have spent countless hours trying to fix it.
When you enable 2fa the login page is blank.
2fa module also does not write to the table msp_tfa_user_config
and it remains empty after enabling 2fa.
Also no error logs anywhere. yay.
Please advice.
Empty msp_tfa_user_config
table.
A setting to automatically send an email when 2FA is disabled makes a lot of sense.
Note: Not 100% sure is it expected or not. Possibly the idea is to have a different statistic/log/data in google/recaptcha/admin
for different websites.
But I sure that different types of erCaptcha could require different API keys to work correctly on Storefront
Current dependencises:
Magento\Cms\Block\Adminhtml\Page\Edit\GenericButton
Magento\Catalog\Block\Adminhtml\Product\Edit\Button\Generic
Declaration:
<buttons>
<button name="back" class="Magento\NotifierAdminUi\Ui\Component\Form\Channel\BackButton"/>
<button name="save" class="Magento\NotifierAdminUi\Ui\Component\Form\Channel\SaveButton"/>
</buttons>
Could be resolved in two way:
The use of recaptcha as a reCaptcha Type results in an error This site key is not enabled for the invisible captcha. if Yes is selected to use recaptcha for the newsletter. This is because the newsletter use the invisible by default in https://github.com/magento/magespecialist_ReCaptcha/blob/2.3-develop/view/frontend/layout/default.xml#L60. It is not documented in the admin panel that by using the recaptcha for the newsletter, the invisible type should be selected.
Introduce new ReCaptchaReview module and move to it corresponding functionality
Introduce new ReCaptchaNewsletter module and move to it corresponding functionality
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.