as well as this Stored XSS:
https://developers.oxwall.com/forum/topic/55761
Hope this helps! :-)
i working on SEO now very hard. when i feel SEO start bee good my next step will bee fix security issues.
is there not one people that have any good advice how to protect oxwall software?
I think many is skilled developers here that have server skills too not only code skills?
There are several things you can do to help secure your server even if Oxwall is not perfect yet.
If you have a dedicated server and running cpanel and apache:
1. Install configserver firewall configserver.com/ its free
2. Install kernel care (if i remember its less than $5 per month) - its a hassle free option to keep your kernel updated. But remember if you update the kernel you might break Oxwall.
3. Be sure you have cpHulk set up and running.
4. Set ServerTokens Prod - this is a main server config file option only, it cannot be done in htaccess. ServerTokens Prod
Some other things you can do shared or dedi server:
A. Set ServerSignature Off via htaccess or main config file: ServerSignaturre Off
B. Dont use the same password for all your emails or all your important logins, and make your passwords 13+ chars long.
For Oxwall:
Move your template_c folder above your public html.
https://developers.oxwall.com/forum/topic/64738