Topics related to site security. In particular topics focused on protecting a Drupal site from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms

0
votes
0answers
8 views

post request via services using access token form oauth2 server

I have installed and configured oauth2_server module to be used as authetication server for services. I successfully get the access_token and refresh_token form /oauth2/token the request $user_data ...
0
votes
1answer
18 views

how to set Private file system path permission in drupal

there is an option in configuration>file system which let you define a path for private files. after setting a path in this field access for all users is restricted (including admin). I need to give ...
0
votes
0answers
6 views

Panopoly WYSIWYG exclude buttons configurations

Can anyone tell me if it's possible to configure the Panopoly wysiwyg to we can have different buttons available to different roles? At the moment, without have to create a module, I can't find a ...
1
vote
1answer
57 views

Should you use check_plain() prior to inserting into database?

I am currently using check_plain() etc on displaying user entered data in HTML, and I am also using check_plain() etc prior to inserting the user data into my custom tables. When inserting or ...
0
votes
0answers
14 views

Tor hiddens service question about clearnet links [closed]

How do you only allow .onion domains on your site only so people can't post clearnet images or your site can't fetch any thing like that?
4
votes
2answers
230 views

Why did Views just jump from 3.8 to 3.10 (what happened to 3.9)?

There was a security advisory issued for Views yesterday, but the new version is two ahead of the last (3.10 to 3.8). What happened to 3.9? The Views release page doesn't list a 3.9, or a reason why ...
0
votes
0answers
14 views

is it safe to chmod -R 777 ~/www/sites/default/files? [duplicate]

Since drupal 7.34 drupal doesn't display images anymore. I tried editing .htaccess and other things. The only thing that seems to work is to change permissions of the files folder and its subfolders ...
0
votes
0answers
21 views

Drupal update system not detecting latest (security) releases

This morning I got e-mails about security updates and I know one of the modules, path_breadcrumb is installed on some of my sites. So I ssh into these sites, do drush pm-update --security-only and it ...
1
vote
1answer
32 views

Why does default.settings.php suggest writing the value of the hash salt in an external file?

The default.settings.php file contains the following comment: For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that ...
0
votes
0answers
12 views

Boost Security_review compatibility

I had security_review warning for boost cache folder. I've changed cache folder location to "sites/default/files/cache" And now I have no warning. Is this solution correct and safe?
1
vote
2answers
27 views

Removing potentially malicious code from template

Our drupal site was hacked at some point recently, and I've been tasked to clean it up because nobody knows much about drupal here. I think I've taken care of most of the glaring security holes, and ...
0
votes
2answers
35 views

Malicious Code - Website Disable

I'm new to Drupal. My website has been disable due to malicious code found in /var/www/vhosts/domain.com/httpdocs/sites/all/themes/tao/tao/css.php What should I remove in this file? ...
0
votes
0answers
16 views

Cannnot turn off aggregation. Could it be due to server settings?

I am working on a site and two days ago I saw some of the styles on the site disappear. I check the Performance settings in Configuration, CSS and JS aggregation were off. I asked the server ...
1
vote
2answers
33 views

Is this block safe from code injection exploit?

Thanks good people here, I have create a simple module which generate two blocks as follows: function myblockmodule_block_info(){ $block['myadblocks'] = array( 'info' => t('My first ...
0
votes
1answer
20 views

admin only can log from a certain country

I want that the admin user to only be able to log in from a certain country, and that the other users that are not administrators will be able to log in from every country.
0
votes
0answers
20 views

How to find request to unwanted website?

I have noticed that certain pages on my website launch a series GET request to a 3rd party site, probably to attack it. So I guess some DOS code has been injected to the drupal site make the bad ...
0
votes
1answer
25 views

Is there a possible/safe way to do a sub-request in Drupal 7

In Drupal 8 the Symfony HttpKernel Component offers a nice way to make an internal sub-request (forward a request to another page without changing the URL). I'm wondering if there is an ad hoc way to ...
0
votes
1answer
55 views

How to save POST variables securely using entity api

I am creating a module that connects Drupal Commerce to Shipworks (a shipping management system). They communicate with each other using HTTP POSTs via a single endpoint URL on Drupal. One aspect I am ...
1
vote
1answer
74 views

Temporary files directory not fully protected .htaccess

I've been getting this error on my status page since I updated to 7.24 (I'm on 7.34 now). I do have my other files directories protected. I just am having a real hard time figuring how to shut this ...
0
votes
1answer
33 views

How Encrypt module actually works?

I installed the Drupal Encrypt module and enabled it. However, I wonder how this module actually works. Does it encrypt all the submissions from the browser that the user/admin key in like 1) Login ...
1
vote
1answer
16 views

Securing folder in Custom Module for Drupal 6

I wrote a custom module, which logs errors to an external text file. The files are kept in /sites/all/modules/custom/my_module/logging/ The problem is, if the user know the name of the file, they ...
0
votes
1answer
39 views

Ambiguity of using '.' as a separator in the site directory name might have security implications?

In a Drupal installation, which is served through the web server's default server config (i.e. it gets any request for an otherwise unknown domain) I have a settings file at ...
0
votes
2answers
29 views

Safety of letting user define javascript paths in fields

I have a module that uses the Fields API to insert a HTML5 canvas element and allows users to define paths to user scripts to be loaded with the page: The scripts are relative to a hard-coded path ...
0
votes
1answer
37 views

Security concerns with cache_get() and cache_set()

are there any security concerns with Drupal's cache_set() and cache_get() functions? I mean, I receive some values through an Ajax-GET-request. Can I pass them to the two functions with the following ...
0
votes
1answer
32 views

Is it safe and fine to block external access to sites/all/modules folder and all its subfolders and files? [closed]

That's to say block all except 127.0.0.1? Thanks.
0
votes
1answer
51 views

Odd log entries: is it indicative of an attack?, is there anything other than IP blocking that I should do?

So I've been getting some odd log entries in my Drupal 7 install: Here's two: As far as I can see they haven't done anything and I've blocked the IP addresses but they keep coming with different IP ...
0
votes
0answers
25 views

Is my Drupal website hacked? [duplicate]

So I am running this Drupal 7 website, I just checked users list and got surprised with this: As you can see the usernames are spam and their emails are also spam. But I do not get it how they did ...
1
vote
1answer
46 views

Just found a code.php file in ctools/plugins/argument/, is that a hack? [closed]

While duplicating a site, during files upload I notice a failed transfered file named code.php in the the folder ctools/plugins/argument/ I download and check the original module, and there isn't ...
1
vote
1answer
36 views

Site affected by PSA-2014-003, revoke all public keys?

I didn't patch my website right after PSA-2014-003, it run about one week unpatched. Now, I'm moving my website to a new server, using an old database backup. In my old server, I used an passphrase ...
0
votes
1answer
53 views

Can't access my website

I can't access my website. I guess it has been hacked. Some drupaldev user is already been created and is in admin list. I have blocked that user multiple times, but it reappears again and again in my ...
2
votes
1answer
109 views

Drupal reuses its hash salt

The instructions in default.settings.php say This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if ...
4
votes
2answers
285 views

After Drupal 7.32 should sql injection attempts create PDOExceptions?

I have the Logging and Alerts module installed on a few of my sites. Yesterday I noticed a series of notification emails with the following data. These produced PDOException exceptions and so far as I ...
4
votes
3answers
270 views

Is CiviCRM data vulnerable to the Drupageddon bug?

Would CiviCRM data have been exposed to a Drupageddon exploit if it happened before I updated the site to Drupal 7.32? CiviCRM is in a separate MySQL database. However, the site uses Views/CiviCRM ...
1
vote
0answers
11 views

Auditing my D7 Site after upgrade to 7.32 w/ Zen [duplicate]

As a security nut case, I should have taken the last Drupal Core security update seriously. I did not, as we're in the process of building a brand new version of the website, and were planning on ...
2
votes
1answer
94 views

Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?

I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
1
vote
0answers
83 views

Aegir and SA-CORE-2014-005

Case: - Aegir server 2.1 on Drupal 6.31 -- Platform Hostmaster: Drupal 6.31 --- Hostmaster: ? -- Platform 1: Drupal 7.31 --- Site 1: HACKED --- Site 2: HACKED -- Platform 2: Drupal 7.32 --- Site 3: ? ...
0
votes
0answers
56 views

How to block IP/user of failed login when user account is not active?

There are several topic for this issues and lot of module out there to control this scenario but my concern is only about non-authenticated user who are registered but not verified their email. By ...
1
vote
2answers
193 views

Unattended automatic security updates / upgrades [duplicate]

What is the best way to get Drupal to automatically perform security updates? And are people commonly employing such a method? For motivation, consider this: Drupal just released a PSA about a ...
1
vote
1answer
102 views

Drupal Commerce Authorize.net gateway and POODLE

I got a notice today that Authorize.net is going to shut off their SSLv3 protocol on November 4 (7 days from today) in response to the POODLE threat. I'm using Drupal Commerce's commerce_authnet ...
0
votes
2answers
69 views

how can i break into my own drupal site?

I’ve been a drupalize.me member for months now and was doing the Media module tutorial. half way through it i decided to install the tutorial companion files and foolishly replaced my files. in the ...
24
votes
7answers
7k views

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

I just updated all my sites using the patch method of resolving the Drupal SA-CORE-2014-005 exploit. I just read reports that just yesterday there is someone from a Russian IP infiltrating drupal ...
1
vote
1answer
62 views

Is it possible to use Google to find Drupal with a specific version of Drupal?

Ideally it wouldn't be possible to use Google or another search engine to find many Drupal installations with e.g. Drupal core 7.31. But I'm not sure if it's not. So I would like to know: is it in ...
0
votes
1answer
41 views

How to skip “Checked available update data for” all modules when I just want to update core or a specific module?

I'm upgrading a lot of my Drupal sites to 7.32. Unfortunately it takes a lot of time for each site because of some update check that I don't need. On How to upgrade only core with drush? I learned I ...
9
votes
3answers
2k views

How to upgrade only core with drush?

There's a huge security leak in <7.32. So I want to upgrade all my Drupal sites asap without too much worrying about breaking stuff. But... $ drush dl drupal-7.32 It's forbidden to download ...
27
votes
6answers
7k views

What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?

Reading up on https://www.drupal.org/node/2357241 and the technical details at https://www.drupal.org/SA-CORE-2014-005, as well as the actual patch which is simply: diff --git ...
1
vote
1answer
61 views

How to hide username displayed in code with Omega 3 theme

Drupal 7 with Omega version 3 theme generates a username class for the article tag in the HTML code, something like : class="node node-page node-published node-not-promoted node-not-sticky ...
0
votes
1answer
297 views

Migrate user passwords salted and hashed with md5

I have quite complex migration for some legacy non drupal site to migrate it into D7. The whole migration works fine but it turned out that source user passwords are salted and hashed with MD5. ...
0
votes
1answer
65 views

How to automatically put your site into maintenance mode if at least a critical security update is available?

I think I'm craving for this functionality. What I want is, if after a CRON run, Drupal detects that such a security update is available, the site would be taken down for maintenance mode to avoid ...
0
votes
0answers
25 views

Drupal 7 multisite password protect single site

I am running a Drupal 7 multisite platform in which sites will be added at a later date to a live version of the website. During the testing process I need the new sites to be on their final live ...
3
votes
1answer
374 views

Remove XMLRPC to avoid vulnerability exploit

How is xmlrpc.php from Drupal core affecting functionality? Given the fact that a vulnerability was discovered for it, details in this article is it safe to remove xmlrpc.php file? Is it bad ...