# \#Security **URL:** https://www.dolibarr.org/forum/tag/security/45.md [Latest](https://www.dolibarr.org/forum/latest.md) · [Categories](https://www.dolibarr.org/forum/categories.md) · [Tags](https://www.dolibarr.org/forum/tags.md) --- ## [Howto change Dolibarr database password](https://www.dolibarr.org/forum/t/howto-change-dolibarr-database-password/30101)
**Author:** [@jonbendtsen](https://www.dolibarr.org/forum/u/jonbendtsen)\ **Replies:** 0\ **Last updated:** [March 16, 2025, 8:31pm UTC](https://www.dolibarr.org/forum/t/howto-change-dolibarr-database-password/30101 "2025-03-16T20:31:53Z")
In case anyone ever needs to change the contents of conf.php and especially the passwords here’s how I did it and upgraded from v20.0.2 to v20.0.4 stop and remove dolibarr container enter mariadb container and connect … --- ## [SECURITY: bug in PHP/GLIBC that impacts any Dolibarr installation](https://www.dolibarr.org/forum/t/security-bug-in-php-glibc-that-impacts-any-dolibarr-installation/25252)
**Author:** [@jonbendtsen](https://www.dolibarr.org/forum/u/jonbendtsen)\ **Replies:** 2\ **Last updated:** [April 24, 2024, 8:56am UTC](https://www.dolibarr.org/forum/t/security-bug-in-php-glibc-that-impacts-any-dolibarr-installation/25252 "2024-04-24T08:56:14Z")
Hey Allegedly there is a bug in GLIBC that impacts PHP which impacts any Dolibarr installation on Linux, and there are hints that it might be remotely exploitable just by sending an HTTP header which you can do even bef… --- ## [Is there sql injection in DoliDBMysqli](https://www.dolibarr.org/forum/t/is-there-sql-injection-in-dolidbmysqli/24841)
**Author:** [@g.levoux](https://www.dolibarr.org/forum/u/g.levoux)\ **Replies:** 1\ **Last updated:** [January 23, 2024, 10:26am UTC](https://www.dolibarr.org/forum/t/is-there-sql-injection-in-dolidbmysqli/24841 "2024-01-23T10:26:34Z")
Hi everyone, I am creating a new PDF template and need to access the database to retrieve a value. Here’s my code: $propal\_extrafields = $this-\>db-\>query("SELECT \* FROM \`llx\_propal\_extrafields\` WHERE \`fk\_object\`=".$obj… --- ## [Easily manage your IT assets and those of your customers](https://www.dolibarr.org/forum/t/easily-manage-your-it-assets-and-those-of-your-customers/24472)
**Author:** [@dolibarr\_code42](https://www.dolibarr.org/forum/u/dolibarr_code42)\ **Replies:** 1\ **Last updated:** [December 14, 2023, 8:46am UTC](https://www.dolibarr.org/forum/t/easily-manage-your-it-assets-and-those-of-your-customers/24472 "2023-12-14T08:46:34Z")
Hello, We would like to introduce you to our company’s code42 module “Gestion de Parc”, which may be of use to you. Effective management of IT and industrial equipment is crucial to the success of modern businesses. Ou… --- ## [Dolibarr .deb package: Whole installation writable for web server user reduces security](https://www.dolibarr.org/forum/t/dolibarr-deb-package-whole-installation-writable-for-web-server-user-reduces-security/24586)
**Author:** [@intern23](https://www.dolibarr.org/forum/u/intern23)\ **Replies:** 1\ **Last updated:** [November 21, 2023, 9:56pm UTC](https://www.dolibarr.org/forum/t/dolibarr-deb-package-whole-installation-writable-for-web-server-user-reduces-security/24586 "2023-11-21T21:56:31Z")
I already made a related post with background information here: However, I want to clarify the root issue and would love to hear feedback from the developers. The issue is that dolibarr.postinst assigns the entire usr/… --- ## [TWO-FACTOR AUTHENTICATION](https://www.dolibarr.org/forum/t/two-factor-authentication/17749)
**Author:** [@saikatkoley](https://www.dolibarr.org/forum/u/saikatkoley)\ **Replies:** 15\ **Last updated:** [April 7, 2023, 1:07am UTC](https://www.dolibarr.org/forum/t/two-factor-authentication/17749 "2023-04-07T01:07:37Z")
Is there any opensource module for google TWO-FACTOR AUTHENTICATION in Dolibarr? --- ## [Dolibarr security : Without install.lock file, Dolibarr is vunerable](https://www.dolibarr.org/forum/t/dolibarr-security-without-install-lock-file-dolibarr-is-vunerable/23061)
**Author:** [@ksar](https://www.dolibarr.org/forum/u/ksar)\ **Replies:** 4\ **Last updated:** [January 31, 2023, 8:45pm UTC](https://www.dolibarr.org/forum/t/dolibarr-security-without-install-lock-file-dolibarr-is-vunerable/23061 "2023-01-31T20:45:45Z")
Hello all, To all integrators, developers (or even self-hosted installation users) who have Dolibarr accessible from the internet, be sure to put/create an install.lock file in your document folder. (Where is this fold… --- ## [Access by POST method refused by CSRF protection in main.inc.php](https://www.dolibarr.org/forum/t/access-by-post-method-refused-by-csrf-protection-in-main-inc-php/18466)
**Author:** [@nikolay86](https://www.dolibarr.org/forum/u/nikolay86)\ **Replies:** 7\ **Last updated:** [April 6, 2022, 7:16am UTC](https://www.dolibarr.org/forum/t/access-by-post-method-refused-by-csrf-protection-in-main-inc-php/18466 "2022-04-06T07:16:04Z")
Hi all, we have just updated the script from 10.0.6 to 11.0 and there is one bug that we have noticed. When we are trying to see what are the margins for a specific period of time, the following error occur on a white p… --- ## [Security threats](https://www.dolibarr.org/forum/t/security-threats/21774)
**Author:** [@steph\_inventv](https://www.dolibarr.org/forum/u/steph_inventv)\ **Replies:** 3\ **Last updated:** [February 4, 2022, 12:13pm UTC](https://www.dolibarr.org/forum/t/security-threats/21774 "2022-02-04T12:13:46Z")
Hi, I am using a premium version of jetpack and 2 threaths have been detected in dolibarr: Threat number 1: File contains malicious code: card.php Threat found (php\_suspicious\_variable\_function\_009) Concerned file:… --- ## [Critical vulnerability in log4j - CVE-2021-44228](https://www.dolibarr.org/forum/t/critical-vulnerability-in-log4j-cve-2021-44228/21590)
**Author:** [@glu](https://www.dolibarr.org/forum/u/glu)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 3:44pm UTC](https://www.dolibarr.org/forum/t/critical-vulnerability-in-log4j-cve-2021-44228/21590 "2021-12-22T15:44:23Z")
I think Dolibarr is NOT affected by this vulnerability. As this topic gets a lot of public attention it would be helpful to get an official statement from one of the core-developers (eg @eldy) Thanks Guenter --- ## [Is Dolibarr protected against SQL injection?](https://www.dolibarr.org/forum/t/is-dolibarr-protected-against-sql-injection/20142)
**Author:** [@sac](https://www.dolibarr.org/forum/u/sac)\ **Replies:** 1\ **Last updated:** [September 4, 2021, 9:01am UTC](https://www.dolibarr.org/forum/t/is-dolibarr-protected-against-sql-injection/20142 "2021-09-04T09:01:08Z")
Is Dolibarr 12.0.4 protected against SQL injection attacks?