Encryption key is invalid, Please check site_config.json on restore

[clarkej]

@MartinHBramwell

It’s also bizarre that the site_config.json file and the private folder have rw-r--r-- permissions. Private directory is readable by anyone! Seriously?

You are not alone @James_Robertson advocated for attention to that here Files Handling Security Issue

Also on the security topic (that I know of) these may interest you -

Beginning thoughts on the Agenda for Conference 2018

Thanks & Kudos to @MichaelPinkowski for putting these thoughts together. I agree to the most part of it and this may set the tone of the Conference 2018. Some comments from me: This is critical importance and must be talked about. Maybe everyone here including the stalwarts who worked on patching it up can suggest/discuss the way around making it systematic and formalized. Something like a team of dedicated rescuer to assist in case of such incidences. GDPR being a specialized topic. Someon…

Security Breach on erpnext.com

There was recent post on the discuss forum indicating that some of our customers on the Frappe Cloud were getting spam emails from an entity claiming to be a verified ERPNext vendor. Now this seemed to be a very weird issue since neither Frappe, nor the Foundation shares or sells email ids to 3rd parties. Neither is any information collected if you use the easy install script or the official VM. This led us to believe there could’ve been a breach on eprnext.com. To our dismay this turned out t…

REST API security problem

Hi, why permissions level settings not working in rest api? Is there any reason for that ? I think that, this is really security bug! Anybody with little bit knowledge can access to all fields. Steps to reproduce: Set permission level for some fields to 2 in any DocType Give access to this DocType on level 0 for some user role Try access api/resource/Doctype/?fields[“*”] in browser with user which has this role You can see that all of fields are there Any help with that? Thanks ERPnext 10…