magento / community-features

Magento Features Development is an Initiative to Allows Community Memebers Join to Development of Magento Features
46 stars 18 forks source link

Magento 2 does not adhere to Redis security protocols. Urgent! #163

Open muckee opened 5 years ago

muckee commented 5 years ago

Preconditions (*)

  1. Magento 2 - all versions
  2. Any distribution which utilises Redis

Steps to reproduce (*)

  1. Install redis-server and rename dangerous commands
  2. Install magento

Expected result (*)

  1. Some configuration option should be available to assign custom command names to redis commands.

Actual result (*)

  1. Cache management is not properly functional due to Magento's inability to recognise custom commands.

It is noted in the redis documentation that altering dangerous command names is absolutely vital, but magento offers no out-of-the-box option to do this. Although technically not a bug, the magento software lacks vital functionality and therefore is not fit for purpose.

How can I reconfigure magento to use renamed redis commands?

NOTE: I originally raised this as a bug report, because the inability of magento to adhere to the standard security protocols defined by the caching software it most commonly utilises is a massive security flaw and not just a missing feature... but the issue was closed and I was told to raise it here.

Hopefully now that Adobe are in charge I will see some kind of progress here before M3 launches...