Topics related to site security.

learn more… | top users | synonyms

0
votes
1answer
26 views

security report there is no .htaccess file in private:// directory

I have this security report that is constantly saying: Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your >private:// directory which contains the following ...
2
votes
2answers
67 views

Drupal 7, Is there a module that detects file structure changes?

Recently one of my clients sites was hacked and hackers uploaded a few directories and files into the web root folder. I'm looking for a module or a method that has the ability detect file structure ...
0
votes
0answers
6 views

enforce access control in entity view?

Is it a good idea to enforce access control at the entity view level? e.g. I do a check in the view function of the Entity's controller and return my content if it's allowed else return false. I ...
0
votes
1answer
39 views

Making the files directory read only

Is there any way that the "files" directory can be read only to some servers? I have some front server which will be visible to users, and a cms server which only content managers will use. The ...
0
votes
0answers
18 views

How to externally register a new user without accessing /user/register?

I have a (Drupal 7) site which uses LDAP to authenticate logins according to an Active Directory groups only. In the Apache config file, the URLs '/user' and '/admin' are both blocked externally. ...
0
votes
0answers
18 views

$base_url is set in settings.php but Security Review flags it still

I get this message in Security Review report: Base URL is not set in settings.php even though my settings.php code has this: $base_url = 'https://www.mysite.com'; I cleared caches several ...
0
votes
1answer
36 views

settings.php displays in browser

For all the Drupal sites I run except one, requesting /sites/default/settings.php in the browser results in a blank page, which seems right and proper. But for one of my sites (on a different host), ...
2
votes
2answers
52 views

Deleting users who have created content can lead to access bypass?

The statement below appears in several places on the Internet about Drupal security. Is it the case that someone once wrote this and people repeat it in the their '10 Drupal security tips' posts ...
1
vote
2answers
24 views

Drupal 7 Private Files - How to override security in custom module

Is there a hook to override access to images stored in the private file system when theme_image_style is used to output the image?
0
votes
0answers
18 views

Multi-Level Groups and content access management in Organic Groups (or by some other means)

I need to create multiple levels of groups and have a certain level of automated as well as manual management of them. The groups will be structured as follows: Organizations (The top level group) ...
0
votes
0answers
49 views

2-Legged OAuth with HMAC sha256 secrect key encryption client/server implementation with services module

What I am Trying to do Basically what I would like to do is fully encrypt POST and GET request with sha256 encryption from the client side and send them to the drupal server. The Drupal server will ...
0
votes
0answers
62 views

Can a subgroup of a public group be private and hidden?

I'm building my first Drupal Organic Groups site, and running into problems. Problem: My goal is to have top-level Groups that are visible to the public, but only members can participate in them. ...
1
vote
1answer
330 views

Weird activites in my site. Is my site hacked?

Since long time I have been noticing some weird activity going on on my website. For example: The includes folder was deleted CSS files were modified Node edit access was given to anonymous users ...
0
votes
1answer
67 views

Connect to remote DB using global php drupal 7 views

I am using Views PHP module for custom coding in views. I tried using mysql_connect function to connect to a remote database using the "GLOBAL PHP" field and get some data through custom coding. Is ...
1
vote
1answer
55 views

One-time link without valid email address Spam Registrations

I have a D6 site that gets a lot of SPAM account registration and they all follow a pattern, however from different IP addresses (often during the following process): 1) User account is created 2) ...
6
votes
1answer
151 views

Preventing SQL injection

In Drupal 6, queries are issued with db_query(). Using %-modifiers, query arguments are substituted into the query after being filtered. Strings %s (and only strings) are ultimately run through ...
0
votes
1answer
36 views

Secure Pages Domain Access for Drupal 7

I ran into a problem using Secure Pages with multiple subdomains. Secure Pages only seems to allow you to put one domain for SSL and not secure pages. I found the following module in Drupal 6, but I'm ...
0
votes
1answer
40 views

Which folders/files in drupal 6 need not executive permission?

In order to tighten security of D6 against malicious XSS file uploads, I am wondering what files and folders can have go-x permission where the group is webserver.
0
votes
1answer
76 views

Confusion about files permission

Accrding to drupal docs: The following is an example file listing of a safe configuration showing two files in a site where uploaded files are stored in the "files" directory. In order to see the ...
0
votes
1answer
30 views

How to manage multiple Drupal sites

I have several servers each with numerous Drupal sites on. Not all of them are developed by me. How would you keep on top of the sites to make sure they are all up to date security wise. In an ideal ...
1
vote
1answer
56 views

Security testing a new site

I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal ...
0
votes
2answers
80 views

Security considerations for special characters in usernames?

I would like to create some users on a Drupal site where the usernames are actually company names and some of those company names contain ampersands or other non-alphanumeric characters. I have read ...
0
votes
0answers
26 views

Determine the location of the snippet to be removed [duplicate]

I am absolutely unfamiliar with Drupal, but have a task of removing a snippet of code from one of its pages. The snippet in question had been determined by Google Wabmaster tools to be malware, and ...
-1
votes
2answers
34 views

Do third party drupal modules pose a security risk?

This may very well be a stupid question but there is no avoiding it now. Unfortunately myself and many others succumbed to the temptation of skipping learning ubercart in lieu of obtaining a seemingly ...
0
votes
1answer
202 views

What code should .htaccess of files directory hold in drupal 7.25?

The module Security Review gives the report my .htaccess in files directory is a security risk because says it has insufficient code to protect the site from anyone wanting to make php edits. However, ...
1
vote
1answer
44 views

in multi-site do you set base url for each sites settings?

Have just enabled security review module and it's alerting to base url not being uncommented and set. This is a multi-site so do I need to set the base url in each settings file for each site? I set ...
0
votes
1answer
98 views

Sanitized text input for EntityMetadataWrapper set()

Through searching, I've found plenty of examples using the EntityMetadataWrapper set() function to update entity fields, and have implemented it successfully in my module. However, I haven't been able ...
1
vote
1answer
141 views

Prevent site from being indexed by search engines?

I have two requirements for my site I don't want my site to be indexed by search engines Anonymous users should not be able to see any content of the site I would have been satisfied with ip ...
1
vote
2answers
147 views

Protect site from flooding when user login is attacked by brute force

I've been experiencing issues with bots trying to force their way into the website I manage. It seems to be a daily occurrence the the flood system is being triggered (I'm on D7). I'm happy the the ...
0
votes
1answer
48 views

Restrict Users from viewing frontpage

When user enter http://localhost/node then the user will be able to view all the nodes created in the site till date. In the site there are some content type which are viewable to all users on site ...
0
votes
2answers
61 views

hide passwords in drupal module settings

we have a local community site for drupal and site is run by volunteer admins. my question is, is there any way I can 'hide' passwords in module settings? some modules ask for user password of the ...
6
votes
1answer
377 views

How to place Drupal_Security_Do_Not_Remove_See_SA_* into httpd.conf instead of .htaccess

I run several Drupal 7 installations on a dedicated server with CentOS 6.4 and Apache 2 (the package httpd-2.2.15-29.el6.centos.x86_64). I wonder, how to properly configure the ...
0
votes
1answer
54 views

What are common methods of intrusion into a Drupal website?

I am running Drupal 6.28 that was recently hacked and there were scripts being executed out of the /tmp directory, apparently running a bitcoin mining server and other brute force scripts. I would ...
0
votes
1answer
79 views

Can I use Plain PHP functions in tpl file?

I have a tpl.php page for login form in my drupal site in which have 4 images. I need to display only one of these 4 images randomly on each page load. I can easily do this in less than 10 lines of ...
1
vote
1answer
41 views

Is there a recognized practice for keeping security details in files excluded from version control?

As settings.php also contains the database connection details and the site key among others, it is excluded from version control in .gitignore. But there some modules, APC for instance that require ...
2
votes
3answers
108 views

Is Drupal secure?

I am wanting to respond to this: "Drupal is listed as limited use, not generally available because of the licensing and security issues related to various modules that people want to use." I have two ...
2
votes
1answer
105 views

HTTPS and SecurePages Infinite Redirect - How do I reset which pages are always HTTPS?

Using Secure Pages, I checked the option to have the site always be using HTTPS when logged in as an administrator, but now I have an infinite redirection issue, and I cannot log-in and navigate the ...
0
votes
0answers
29 views

How to delete or hide any trace of drupal in source code [duplicate]

Well I'm working on a government website that needs a lot of security insurances! the security thingy guys keep saying that there are couple of Drupal name in the source that shouldn't be there!‌ So ...
1
vote
1answer
144 views

What would cause a duplicate session key?

I occationally recieve the following error resulting in failure of several pieces of code later in the pipeline. PDOException: SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry ...
1
vote
1answer
138 views

What are the alternatives for storing client side encrypted data?

I want to store client side encrypted data in Drupal 7, so that it is encrypted on the client end, and stored and transmitted in encrypted form. The password is never transmitted or stored on the ...
2
votes
2answers
24 views

Avoid username output as a class of an article tag

Drupal 7 generates a username class for the article tag, something like : class="node node-page node-published node-not-promoted node-not-sticky author-username odd clearfix". I'd like to avoid to ...
2
votes
2answers
374 views

Do I need to sanitize a user input textfield used in a mail body?

I have a feature on my site where a user is allowed to edit a textfield is a Drupal form (built using the D7 Form API) and then send the contents of that textfield as (part of) the body of an email to ...
2
votes
2answers
1k views

My drupal 7.22 site got hacked

When I tried logging in to my Drupal site this morning, I got an error. When I took a look at the log files, I found a error about the template.php file used by the theme currently set: [Sat Sep ...
0
votes
3answers
72 views

Does Drupal have any security like Dexterity in Plone?

Is there anything in Drupal's security like Plone's Dexterity where I can wrap content in my webpage and have it displayed or not displayed based upon security roles? EDIT: Thanks. None of these do ...
1
vote
1answer
86 views

How can I securely expose data through Drupal (via REST or something else)

I'm looking to use Drupal to pull in data through forms etc, probably in the form of content types, and then expose these, probably via REST, to other things. I've had a look at the services module, ...
0
votes
0answers
54 views

Need to split up group audience field (Organic Groups) into public and private fields

The group audience field lists all organic groups. I need it to be two separate fields, one listing the public groups and one the private. For the private, I need to have it filter down to only groups ...
3
votes
4answers
669 views

Will the PHP filter prevent SQL injection attacks?

I had trouble getting the form API to work though I am considering re doing all my forms with it. I have some custom html/php forms however I directly insert into the DB using pg_query. I am looking ...
1
vote
1answer
39 views

How I get notified every time their is an *new* update and not every day for the sames updates?

The update module can send you email when a new release is available for a module you installed. The problem is I get a email everyday. Some security update are very minor and unreachable for an ...
5
votes
4answers
559 views

Spambots causing server crashes. How do I block them?

I have a Drupal 7 website on a shared hosting account that uses an Apache server. It is getting continuously battered by spam bots who try to post junk comments and create fake accounts. What methods ...
3
votes
1answer
143 views

un-escaped _server variable in settings.php - bad idea right?

I recently started working for a new company hosting drupal sites that is using a switch statement within the settings.php for multiple environments. I am accustomed to using multi-site and am ...