Аккаунт в General iT
Войдите или создайте аккаунт для управления услугами в панели.
MODULE FOR 1C-BITRIX
Digital Element
Web application vulnerabilities are architectural flaws that allow attackers to disrupt service operations or access users' personal data. A primary category of such vulnerabilities is Cross-Site Request Forgery (CSRF).
Web application vulnerabilities are architectural flaws that allow attackers to disrupt service operations or access users' personal data.
A primary category of such vulnerabilities is Cross-Site Request Forgery (CSRF). This attack exploits specific characteristics of the HTTP protocol: if a user's browser is induced to send a request to a vulnerable server, it will automatically include the user's current cookies in that request.
In a successful CSRF attack, a victim visiting a malicious site unknowingly triggers harmful actions on another server, such as transferring funds to an attacker's account. For this to occur, the user must be authenticated on the target server, and the request must not require any user confirmation that cannot be bypassed or forged by the attacking script.
The delement.csrf module enhances form protection across all editions of 1C-Bitrix. A short-lived CSRF token is generated for each form and verified upon submission. Unlike the standard bx_sessid check, this token is bound to a specific form and has a limited validity period, minimizing risks even if the token is intercepted.
The solution protects against cross-site request forgery. Even if an attacker uses the user's current cookies, they cannot access the required token to submit forms on the user's behalf.
Connecting a form from the Web Forms module
Enable form validation in the module settings.
Set a unique secret for code generation.
Specify the desired token lifetime in seconds.
Select the required form from the list.
Add an input field with the token to the form template using the DelementCsrfHelper::getCsrfInput method, passing the WEB_FORM_ID parameter.
Connecting to custom forms
Insert an input field with the token into your form. Generate the token using the DelementCsrfHelper::getCsrf method by passing a unique form identifier.
Add token validation in the form processing script using the DelementCsrfHelper::validateCsrf method, passing the same unique form identifier.
If “Form Protection” is required, General iT can help with installation, configuration and a technical check after integration.
UPDATE HISTORY
Fixed work with composite site
USER EXPERIENCE
How does this solution work in a real project? Share your experience and help others choose.
There are no reviews of this solution on git.ru yet. Tell us what worked well and what could be improved.
Verified purchaseAdd a key if you wish. A verified review gets a badge, priority placement and more rating weight.
Open to every clientJust sign in to your account. A key is optional; all reviews are moderated.
YOUR PROJECT INFRASTRUCTURE
FROM THE SAME DEVELOPER
Digital Element
The module replaces the standard CAPTCHA of the 1C-Bitrix platform and the 1C-Bitrix24 Corporate Portal (Online Store + CRM) with Yandex SmartCaptcha. This protects site forms from automated submissions, spam, and bot actions.
The Visually Impaired Version module provides a comprehensive solution for creating and managing an adapted site version without duplicating content. It operates as an overlay on existing pages, eliminating the need to create a separate site or maintain two sets of materials. The solution features an intuitive control panel and dynamic interface adaptation.
The 'Intelligent Search' module extends the capabilities of the standard 1C-Bitrix search mechanism. It is designed for websites with large product catalogs, blogs, and news sections, ensuring accurate retrieval of information even when input errors or incorrect keyboard layouts occur.
MORE FOR YOUR WEBSITE
The CleanTalk anti-spam module provides multi-level website security without the need for CAPTCHA. The system automatically blocks bot registrations, spam comments in forums and blogs, and spam in Progressive Media tree comments. Protection extends to private user messages, product reviews in 1C-Bitrix modern online stores, order forms, and any custom forms.
The 'Agents on Cron' module accelerates site performance by shifting agent execution from user visits to the server-side cron scheduler. In Bitrix, agents are scheduled background tasks. By default, they run whenever a user accesses the site, creating server load. This module moves these tasks to a background mode independent of visitor activity.
The module allows you to quickly add a New Year atmosphere to your website. The package includes falling snow effects and interactive Christmas ornaments positioned at the top of the page.
BEFORE YOU ORDER