<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p> </p>
<p><span>Generally all mechanisms that allow external access should be default disabled.<br />We created this file: </span><a href="https://github.com/YetiForceCompany/YetiForceCRM/blob/stable/config/api.php" target="_blank" rel="noreferrer"><span><span><span>https://github.com/YetiForceCompany/YetiForceCRM/blob/stable/config/api.php</span></span></span></a><span><span><span> , there you can easily disable/enable services. Webservice enabled by default, together with available access keys for the users, is not a good practice [I'd even say that the permissions control is fictional, if it can be bypassed]. It's even worse with the mobile module in modules/Mobile. This module should be disabled by default [and eventually removed or written from scratch] because it's full of holes - it's enough to run a scanner, such as Acunetix, or perform an audit, to see how dangerous this module is.</span></span></span></p>
<div>---<br />
<div>Z poważaniem / Regards</div>
<div> </div>
<div><strong>Błażej Pabiszczak</strong></div>
<div><em>Chief Executive Officer</em></div>
<div>M: +48.884999123<br />E: <a title="Mail do Błażej Pabiszczak" href="mailto:b.pabiszczak@yetiforce.com">b.pabiszczak@yetiforce.com</a></div>
</div>
<p> </p>
<p>W dniu 2015-09-09 13:51, Ranieri napisał(a):</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div dir="ltr">You blocked only file webservices.php ? is enough?</div>
<div class="gmail_extra"><br />
<div class="gmail_quote">2015-09-09 1:31 GMT-03:00 Preexo <span><<a href="mailto:preexo@googlemail.com">preexo@googlemail.com</a>></span>:<br />
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">I use apaches Allow from 123.123.123.13 for that.<br /><a href="http://httpd.apache.org/docs/2.2/howto/access.html">http://httpd.apache.org/docs/2.2/howto/access.html</a><br /><br /><br /><br /> --<br /> View this message in context: <a href="http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-Restrict-access-thru-Webservices-tp17267p17274.html">http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-Restrict-access-thru-Webservices-tp17267p17274.html</a><br /> Sent from the vtigercrm-developers mailing list archive at Nabble.com.<br /> _______________________________________________<br /><a href="http://www.vtiger.com/">http://www.vtiger.com/</a></blockquote>
</div>
</div>
<br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">_______________________________________________<br /><a href="http://www.vtiger.com/">http://www.vtiger.com/</a></div>
</blockquote>
</body></html>