Topics related to site security. In particular topics focuded on protecting a Drupal site from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms

0
votes
0answers
21 views

How to automatically put your site into maintenance mode if at least a critical security update is available?

I think I'm craving for this functionality. What I want is, if after a CRON run, Drupal detects that such a security update is available, the site would be taken down for maintenance mode to avoid ...
0
votes
0answers
13 views

Drupal 7 multisite password protect single site

I am running a Drupal 7 multisite platform in which sites will be added at a later date to a live version of the website. During the testing process I need the new sites to be on their final live ...
2
votes
1answer
89 views

Remove XMLRPC to avoid vulnerability exploit

How is xmlrpc.php from Drupal core affecting functionality? Given the fact that a vulnerability was discovered for it, details in this article is it safe to remove xmlrpc.php file? Is it bad ...
0
votes
0answers
16 views

Drupal site blocked by Windows defender

Visiting my Drupal 7 site just now with IE 11, I get this message: Windows Defender blocked content on this website lx7pyv.dofeqilr.com Hosted by: mysite.com Recommended icon Go to ...
0
votes
0answers
15 views

What are the appropriate file security settings and Apache settings for Drupal sites running on a VPS?

I would be grateful for some help on this one - I have looked at the other posts on this subject with interest, but they don't seem quite to fit my situation. I'm not a great Unix expert, but there ...
1
vote
1answer
54 views

Where does field help text get filtered?

Drupal 7 fields, by default, have a nice text box beneath them for Help Text. This is set up with field_ui_field_edit_form(): $form['instance']['description'] = array( '#type' => 'textarea', ...
1
vote
1answer
53 views

Is someone trying to hack my site?

I was looking at my drupal site log messages and I´ve been having very weird ones as the ones attached. I was wondering if someone is trying to hack my site, if so, how can I prevent that? I have all ...
4
votes
3answers
210 views

Encrypting db password stored in settings.php

The db password in settings.php is stored as plain text. Is there any way to encrypt that password? My client says its a security risk even though the file permissions is as should.
0
votes
0answers
12 views

Sub-folders in Private folder created by private_download module

I want to have sub-folders in my Private folder. I am using the Private Download module. These sub-folders should be accessible as per role. For example I have Advanced and Basic as 2 separate roles ...
0
votes
1answer
49 views

Secure pages and installing new modules (AJAX error)

I've just configured my website to work with secure pages and everything seems to be working fine except for the ability to install a new module. Whenever I try, I get this error: An AJAX HTTP ...
0
votes
1answer
29 views

Change in core drupal module regex security risk

As interim solution to an issue in javascript I changed in Core Drupal user.module file line, to disallow single quotation mark: if (preg_match('/[^\x{80}-\x{F7} a-z0-9@_.\'-]/i', $name)) { to if ...
0
votes
0answers
39 views

Time analysis and security issues with Drupal bootstrap from external script

I have some external php scripts that query mysql and return data to javascript through xmlhttprequests. But the problem is that when I type the url of the .php on my browser address bar, these data ...
1
vote
0answers
25 views

base_url for both http and https?

I have a site that is accessible both through http and https. I see the security review complains that base_url is not defined in settings.php. However when I define it as http://mysite.com, and ...
0
votes
1answer
169 views

rule to remove “Public files directory Not fully protected” in nginx?

I use D7 with nginx and php5-fpm on Linux and get this security warning: Public files directory Not fully protected I see here that one needs to use this snippet in Apache's htaccess to resolve ...
0
votes
1answer
39 views

$drupal_hash_salt is empty in my installations

This is the code in settings.php $drupal_hash_salt = ''; From what I know it should be a random string and I shouldn't change it at all and it has a direct effect on the website security. But why ...
1
vote
1answer
66 views

How and when to use filter_xss() and check_plain()?

There are lots of template files like this one views-view-fields--magazine--magazine.tpl.php in my website. how and when I should use the filter_xss() and check_plain() to improve security? for ...
0
votes
1answer
25 views

How to block the user after a few failed logins

modules like login security deny the user IP after afew failed logins. there are softwares that randomly generate new IP for user so it makes such modules useless. sending cookie to the user browser ...
3
votes
1answer
339 views

How safely allow untrusted users to use img tag?

Following this question, I'm wondering how can I allow users of a social site (which obviously are not all trusted) to upload images while avoiding XSS threats?
0
votes
1answer
56 views

How allowing img tag in formats can be dangerous?

I get this recommendation form Security review module: It is recommended you remove the following tags from roles accessible by untrusted users: img I am wondering what real world threats can ...
0
votes
1answer
106 views

Security issues while using external javascript and php files to access mysql database in drupal nodes

I have created a search_interface node which asks for filters and onClick event of the submit button, I have called an external search.js script. My search_interface node is of a custom content type ...
2
votes
1answer
311 views

What are the 'todos' when your database is hacked?

I want to plan for the terrible nightmare of my database being stolen. I feel I am secure, and I am not holding much actual data, but... if it does get taken - what do we do, is there a standard way ...
0
votes
2answers
35 views

Encrypt entire site - request access [closed]

How can I encrypt my entire site? I also need to require password and username to access site. When visitors are accessing site, they will be redirected to a login page where they can also request ...
0
votes
1answer
60 views

How to save database connection easy and safe?

I'm trying to let Drupal7 connect to several databases(pgsql) and update data automatically. So I use Database::addConnectionInfo($name,'default',$connString) And db_set_active($name). It works ...
0
votes
1answer
137 views

security report there is no .htaccess file in private:// directory

I have this security report that is constantly saying: Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your >private:// directory which contains the following ...
2
votes
2answers
75 views

Drupal 7, Is there a module that detects file structure changes?

Recently one of my clients sites was hacked and hackers uploaded a few directories and files into the web root folder. I'm looking for a module or a method that has the ability detect file structure ...
0
votes
0answers
20 views

enforce access control in entity view?

Is it a good idea to enforce access control at the entity view level? e.g. I do a check in the view function of the Entity's controller and return my content if it's allowed else return false. I ...
0
votes
1answer
56 views

Making the files directory read only [closed]

Is there any way that the "files" directory can be read only to some servers? I have some front server which will be visible to users, and a cms server which only content managers will use. The ...
0
votes
0answers
24 views

How to externally register a new user without accessing /user/register?

I have a (Drupal 7) site which uses LDAP to authenticate logins according to an Active Directory groups only. In the Apache config file, the URLs '/user' and '/admin' are both blocked externally. ...
0
votes
0answers
42 views

$base_url is set in settings.php but Security Review flags it still

I get this message in Security Review report: Base URL is not set in settings.php even though my settings.php code has this: $base_url = 'https://www.mysite.com'; I cleared caches several ...
0
votes
1answer
45 views

settings.php displays in browser

For all the Drupal sites I run except one, requesting /sites/default/settings.php in the browser results in a blank page, which seems right and proper. But for one of my sites (on a different host), ...
2
votes
2answers
59 views

Deleting users who have created content can lead to access bypass?

The statement below appears in several places on the Internet about Drupal security. Is it the case that someone once wrote this and people repeat it in the their '10 Drupal security tips' posts ...
1
vote
2answers
42 views

Drupal 7 Private Files - How to override security in custom module

Is there a hook to override access to images stored in the private file system when theme_image_style is used to output the image?
0
votes
0answers
51 views

Multi-Level Groups and content access management in Organic Groups (or by some other means)

I need to create multiple levels of groups and have a certain level of automated as well as manual management of them. The groups will be structured as follows: Organizations (The top level group) ...
0
votes
0answers
105 views

2-Legged OAuth with HMAC sha256 secrect key encryption client/server implementation with services module

What I am Trying to do Basically what I would like to do is fully encrypt POST and GET request with sha256 encryption from the client side and send them to the drupal server. The Drupal server will ...
0
votes
1answer
147 views

Can a subgroup of a public group be private and hidden?

I'm building my first Drupal Organic Groups site, and running into problems. Problem: My goal is to have top-level Groups that are visible to the public, but only members can participate in them. ...
1
vote
1answer
349 views

Weird activites in my site. Is my site hacked?

Since long time I have been noticing some weird activity going on on my website. For example: The includes folder was deleted CSS files were modified Node edit access was given to anonymous users ...
0
votes
1answer
286 views

Connect to remote DB using global php drupal 7 views

I am using Views PHP module for custom coding in views. I tried using mysql_connect function to connect to a remote database using the "GLOBAL PHP" field and get some data through custom coding. Is ...
1
vote
1answer
94 views

One-time link without valid email address Spam Registrations

I have a D6 site that gets a lot of SPAM account registration and they all follow a pattern, however from different IP addresses (often during the following process): 1) User account is created 2) ...
6
votes
1answer
328 views

Preventing SQL injection

In Drupal 6, queries are issued with db_query(). Using %-modifiers, query arguments are substituted into the query after being filtered. Strings %s (and only strings) are ultimately run through ...
0
votes
1answer
77 views

Secure Pages Domain Access for Drupal 7

I ran into a problem using Secure Pages with multiple subdomains. Secure Pages only seems to allow you to put one domain for SSL and not secure pages. I found the following module in Drupal 6, but I'm ...
0
votes
1answer
52 views

Which folders/files in drupal 6 need not executive permission?

In order to tighten security of D6 against malicious XSS file uploads, I am wondering what files and folders can have go-x permission where the group is webserver.
0
votes
1answer
118 views

Confusion about files permission

Accrding to drupal docs: The following is an example file listing of a safe configuration showing two files in a site where uploaded files are stored in the "files" directory. In order to see the ...
0
votes
1answer
47 views

How to manage multiple Drupal sites

I have several servers each with numerous Drupal sites on. Not all of them are developed by me. How would you keep on top of the sites to make sure they are all up to date security wise. In an ideal ...
1
vote
1answer
154 views

Security testing a new site

I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal ...
0
votes
2answers
164 views

Security considerations for special characters in usernames?

I would like to create some users on a Drupal site where the usernames are actually company names and some of those company names contain ampersands or other non-alphanumeric characters. I have read ...
0
votes
0answers
26 views

Determine the location of the snippet to be removed [duplicate]

I am absolutely unfamiliar with Drupal, but have a task of removing a snippet of code from one of its pages. The snippet in question had been determined by Google Wabmaster tools to be malware, and ...
-1
votes
2answers
39 views

Do third party drupal modules pose a security risk?

This may very well be a stupid question but there is no avoiding it now. Unfortunately myself and many others succumbed to the temptation of skipping learning ubercart in lieu of obtaining a seemingly ...
0
votes
1answer
725 views

What code should .htaccess of files directory hold in drupal 7.25?

The module Security Review gives the report my .htaccess in files directory is a security risk because says it has insufficient code to protect the site from anyone wanting to make php edits. However, ...
1
vote
1answer
71 views

in multi-site do you set base url for each sites settings?

Have just enabled security review module and it's alerting to base url not being uncommented and set. This is a multi-site so do I need to set the base url in each settings file for each site? I set ...
1
vote
1answer
303 views

Sanitized text input for EntityMetadataWrapper set()

Through searching, I've found plenty of examples using the EntityMetadataWrapper set() function to update entity fields, and have implemented it successfully in my module. However, I haven't been able ...