secconsult
Forum Replies Created
-
Forum: Plugins
In reply to: [MVIS Security Center] Blank plugin settings dashboard after activatingHello Andrew,
I am glad to hear that you like the plugin 🙂
Regarding your problem, please take a look at the error logs of your site, there should be an indication of what causes the problem. Let me know if you find something that looks suspicious, then we can narrow down the problem.
Feel free to send the log file to mvis_wp@sec-consult.com, then I can help you with the analysis.
Cheers,
StefanHello terminij,
the bug was identified and fixed. Please update to MVIS Security Center 1.3.3, empty your browser cache and then everything will work as expected.
Thanks again,
StefanHello terminij,
First of all thank you for your honest feedback.
What I was just able to reproduce is that if you search for plugins, even though you can download plugins directly using “Install Now” and click on “Details” to open a tab with information, it is indeed not possible to click any link in that “Details” frame. I will start investigating and testing a solution to this problem and deploy a version fixing this issue asap.
Additionally, I would like to show our appreciation for bug reports like this by giving you a code for a one-year free subscription for one site. Please get in touch with me via the “Feedback, Bugs or Feature Requests?” link in the top right corner of the plugin to receive the code.
Regarding the manual update, if you allow the plugin to communicate with our servers by clicking the according checkbox during the first setup, it will automatically update the vulnerability feed once a day. The free version though will always be exactly 30 days behind and only with the subscription you will be receiving immediate up-to-date email alerts as well as the updated vulnerability feed and vulnerability details in your plugin .
Finally, I would like to mention that we really take bugs seriously and put a lot of effort into developing high quality plugins. So far we have received a lot of good feedback regarding this. No software ever gets a 100% bug free, but relies on community support such as yours to get close to that.
So again, thank you for bringing this bug to our attention and I’ll make sure it is fixed and released asap.
Cheers,
StefanForum: Plugins
In reply to: [MVIS Security Center] Permission recommendations break my siteSure thing 🙂
Forum: Plugins
In reply to: [MVIS Security Center] Permission recommendations break my siteHello, you can contact me again if there are any further questions. I’m closing the topic.
Forum: Plugins
In reply to: [MVIS Security Center] Permission recommendations break my siteThat is weird, because this would indicate that only the file owner has read permissions on the e.g wp-config.php file, which would also mean that the file owner is the web server. Otherwise the setup would not work, because the web server would not be able to read the config file. That in turn could mean that you could easily upload a php file that reads all other directories on the shared host. Regarding your permission problem, it seems like you can’t fix it due to the Linux user setup for the virtual hosts. I am speculating a bit here and I would have to take a closer look to be sure about that.
Are you using HTTPS to connect to the wp-admin interface?
Do you store the WP admin password in the FTP application on your computer?Having a shared host can be quite dangerous, because if one other customer on the same server is hacked, attackers can potentially spread to all other sites, even though you would have done everything right and secured the site properly.
Forum: Plugins
In reply to: [MVIS Security Center] Permission recommendations break my siteHello mosheeshel,
Do you have ftp/sftp access to the system, then you should be able to see what the owner name and group name of specific files/directories are, which should help us determine how your file permissions can be secured without breaking the site.
In the meantime, please share the default file permissions that are set on /wp-config.php and /index.php, because these are some of the most important files to secure in a shared hosting environment.
Forum: Plugins
In reply to: [MVIS Security Center] Permission recommendations break my siteHello again, were you able to solve the problem with your site?
Forum: Plugins
In reply to: [MVIS Security Center] Permission recommendations break my siteHello Mosheeshel,
Are you hosting the WordPress on your own server?
If not then the issue is likely to be in the setup of your hosting provider.
Could you share which users own the files and which group user is set for your directories? Additionally, we would need to find out which user your webserver runs as (e.g www-data) and if it is part of the group.If you don’t want to share the information publicly, you can also send me an e-mail using the “Feedback, Bugs or Feature Requests?” link in the top right corner.
Cheers,
StefanForum: Installing WordPress
In reply to: PErmissions 777 vs 755Glad I could help!
Have a good one.
Forum: Installing WordPress
In reply to: PErmissions 777 vs 755Hello Jesper,
in an ideal world file/directory permissions would be set to 750. So only your user can write them, the group (e.g webserver) can read them and nobody else can do anything with the resources.
Of course sometimes it depends on whether you want to be able to change files from within the WordPress admin interface in which case you could need 770 permissions.
But, depending on the way user/groups are configured on your server this might not be possible and that’s when suddenly 775 is needed, because e.g the webserver is not in the group and can’t access the files unless everybody gets read access to it.
So the next question would be, do you own the server and are able to make arbitrary changes, or is this a precondition that you can’t change?
Another thing to consider is whether the server is shared, or if it is a server that only you have access to. Obviously on shared servers giving everybody read rights to your wp-content folder could have severe security implications.
Either way check out what WordPress has to say regarding file permissions at the WordPress Security Codex.
Forum: Plugins
In reply to: [MVIS Security Center] Can't Use: Maximum execution time exceededHello Justin,
I will put this ticket to solved now. Please let me know if there is anything else I can support you with.
Cheers,
StefanForum: Plugins
In reply to: [MVIS Security Center] Can't Use: Maximum execution time exceededHello Justin,
I have tried to reproduce the error you are getting on XAMPP 1.8.1 for Mac and for Linux and was not able to produce any errors after the installation of the plugin.
This might sound exotic, but did you use the same password for your testsetup and the production system?
Other than that unfortunately I have no further ideas than the already proposed fix.
Please let me know.
Forum: Plugins
In reply to: [MVIS Security Center] Can't Use: Maximum execution time exceededOk, I’ll give it another try today and will let you know the results later.
Forum: Plugins
In reply to: [MVIS Security Center] Can't Use: Maximum execution time exceededAlright, so if I download and install the latest XAMPP (1.8.1) I should be able to reproduce the issue, right?