包简介

Magento 2 security modules for Qoliber open source patches and fixes.

README 文档

README

Security hardening package for Magento Open Source and Adobe Commerce.

This package contains two Magento 2 modules:

Qoliber_PolyshellPatch
Qoliber_SessionReaperFix

Both modules are intended as defensive mitigations. They deliberately disable specific upload flows that can be abused.

What It Fixes

PolyShell

Qoliber_PolyshellPatch blocks file-type custom option uploads through the Web API product option flow.

This is intended as a mitigation for the vulnerability commonly referred to as PolyShell and associated with Adobe bulletin APSB25-94.

Security tradeoff:

file-type custom option uploads through this API path are disabled
integrations relying on that upload behavior will stop working until a vendor patch or a different safe implementation is used

SessionReaper

Qoliber_SessionReaperFix overrides the frontend customer address file upload controller and returns 404 Not Found.

This closes unauthorized uploads to the customer address media directory.

Important note:

the original SessionReaper issue is already addressed by released Adobe / Magento patches
however, those patches still allow unauthorized upload attempts to the customer_address media directory
this module hard-disables that upload endpoint as an additional security measure

Security tradeoff:

customer address file uploads are disabled
any storefront functionality depending on customer address file attachments will no longer work

Installation

Install the package with Composer in your Magento project:

composer require qoliber/magento-open-source-security

Then apply Magento setup changes:

bin/magento setup:upgrade
bin/magento cache:flush

Warnings

This package is intentionally restrictive.
It is designed to reduce attack surface, not to preserve all original upload features.
Review business flows and third-party integrations before enabling it in production.
If you depend on file uploads in custom options or customer address flows, test those paths explicitly after installation.

Package Contents

src/polyshell-patch-module provides Qoliber_PolyshellPatch
src/session-reaper-fix-module provides Qoliber_SessionReaperFix

License

MIT

qoliber/magento-open-source-security 适用场景与选型建议

qoliber/magento-open-source-security 是一款基于 PHP 开发的 Composer 扩展包，目前已累计 49 次下载、GitHub Stars 达 0，最近一次更新时间为 2026 年 04 月 03 日，在 PHP 生态内属于活跃度较高的组件。

它主要适用于以下技术方向：「security」「module」「magento」「patch」「magento2」「hotfix」等业务场景。在实际项目中，围绕这些方向常见需要落地的问题包括：接口对接、性能调优、并发安全、与既有框架（Laravel / ThinkPHP / Yii / Webman 等）的兼容适配，以及生产环境的日志埋点与稳定性保障。

我们在过去多个企业项目中使用过 qoliber/magento-open-source-security 或与其功能相近的方案，如果你在选型或落地过程中遇到问题，例如 版本兼容、二次改造、私有化封装、与内部系统对接、生产 BUG 排查，欢迎联系我们协助评估。

围绕 qoliber/magento-open-source-security 我们能提供哪些服务？

定制开发 / 二次开发

基于 qoliber/magento-open-source-security 在你已有业务上做功能扩展、字段裁剪、UI 适配、与内部账号 / 权限 / 日志系统的深度对接。

BUG 修复 & 性能优化

线上偶发问题、内存泄漏、慢查询、并发异常等排查修复；针对高流量场景做缓存、队列、索引层面的调优。

项目外包 & 长期维护

承接完整的项目从需求 → 设计 → 开发 → 上线 → 长期运维；也可按月提供技术保姆服务。

yvsm@zunyunkeji.com QQ：316430983 微信：yvsm316 西安尊云信息科技 · 专注 PHP / Go / 分布式系统研发