Topics related to site security. In particular topics focused on protecting a Drupal site from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms

1
vote
1answer
22 views

Is this a possible attack on database?

In the logs (Drupal 7), I have seen the next entry (I have edited some compromised info). It seems a failed (only I hope it actually failed) attempt to access the login account. I have tried to ...
0
votes
0answers
13 views

How to check for drupal page routine, no form submit working

On my drupal website, I suddenly can't submit any form successfully. The page appears to reload but does not go anywhere, stays exactly where any form is. Using drush uli, I can get in as admin but ...
2
votes
1answer
23 views

Multiple login attempts from different IP Addresses

My website has been getting about 25 login attempts per hour for the past few days for usernames admin, administrator and our website name. The attacker seems to be using differing IP addresses and ...
1
vote
1answer
54 views

Delete all nodes of a user using flags and rules

I want to delete all nodes for a user whoes any one node has been flagged as spam. For example: If user has created 3 nodes of same/different content types, then If admin flag any one content as ...
7
votes
2answers
307 views

Why is settings.php in the web folder?

In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a ...
2
votes
1answer
27 views

Can I temporarily stop update notifications for one project only? [duplicate]

Is there a way I can tell Drupal not to notify me about a particular version of a module? For example, if it isn't security related and I choose not to update one module but would like to receive ...
-1
votes
1answer
20 views

code change alert/email [closed]

Is there a module to help me receive email for any change in drupal site ? https://www.drupal.org/project/logging_alerts this module help a lot in log in / log out and add content .. but I need to ...
1
vote
1answer
56 views

How to prevent applications from uncovering the technologies used on the website

Here is a super hard question, probably for the most experienced people: Can we prevent applications from uncovering the technologies we are using. We all know that making sure to keep the core and ...
3
votes
1answer
60 views

Installation error in Ubuntu - The settings.php file does not exist

I've installed Drupal 6\7\8 in WAMP environments for about a hundred times, but I don't recall ever having the following instllation error, which I encountered only in Ubuntu desktop 15.10, Apache2 ...
0
votes
0answers
19 views

Which is best spam comments preventing module in drupal 7 [duplicate]

I want to enable user comments form, registration and login forms. For those forms I want to increase security things to avoid hackers attack. I have tried Mollom and AntiSpam but those do not work ...
0
votes
0answers
20 views

code automatically changing on me - iframe not working consistently - IE11 cross-site scripting error

I have created a Basic Page and put code in the body for an iframe so we can connect to our university library publication system. I'm doing this for all our users with publications. I had about 20 ...
2
votes
3answers
54 views

Favicon not loading from https

I have enabled https for my site. All images and files are served with https url, but favicon it is serving from http://example.com/sites/default/files/favicon.ico instead it should show as ...
1
vote
0answers
24 views

Front page full of invisible spam links [duplicate]

This morning i noticed that wherever i want to click on menu and above menu i have invisible links leading to spam websites. It looks to me that they are hard coded but i have no idea where to delete ...
-1
votes
2answers
41 views

Hardening Drupal server running the Update Manager

We are going to do the hardening on one of our Linux server running SELinux and Drupal 7 with firewall; on the Drupal Update Manager, if we want only to get periodic emails / notifications on modules ...
1
vote
1answer
46 views

Services CSRF Token request security

A Drupal website that my company is maintaining has a REST endpoint, using Drupal Services (likely not that relevant). One of the systems that I'm writing has to write changes in the system to that ...
0
votes
1answer
35 views

SQL injection and lot of database updates are visible [closed]

My Drupal Website is possibly compromised through a SQL injection and lot of database updates are visible. How to avoid further SQL injection?
0
votes
2answers
41 views

Drush error on core update “corrupt (wrong md5 checksum)”

I'm getting this error when I try to update core with Drush: File drupal-7.41.tar.gz is corrupt (wrong md5 checksum). [error] Updating project drupal failed. Attempting to roll back to previously ...
0
votes
1answer
36 views

Using the back button after logging out shows you pages from the authenticated user's session

Using the back button after logging out shows you pages from the authenticated user's session. I found a solution for this, need to set the header like this to fix this issue- ...
4
votes
1answer
414 views

What do blocked IP addresses see?

I have been getting a lot of failed attacks targeting my server in the last few months. I have been using the Drupal IP block to block IPs that where sniffing for vulnerabilities. I would like to know ...
1
vote
2answers
32 views

Is it safe to send the unencoded JSON output?

The mobile app developers wants an api to get a list of articles from our Drupal site. It should have these fields in the output: nid title field_teaser_body The api resonse has to be in JSON ...
0
votes
1answer
43 views

Getting password hashes and salts from Drupal 7

I need to get user accounts' password hashes and salts from a Drupal 7 app, so as to migrate these accounts into Stormpath. Could you please help me to figure out where this data is stored and how to ...
3
votes
1answer
123 views

Is uploading/download executable files harmful in drupal? [closed]

In my site design, I have a field that is designed to hold an executable file (.exe, .bat, etc), for users to upload and download. I took pause as I was typing these extensions into the Allowed file ...
0
votes
1answer
33 views

Can a disabled module pose a security risk?

Is it possible for a module that is installed but not enabled to pose a security risk? Corollary question: Is it a recommended practice to update disabled modules when security updates become ...
1
vote
1answer
40 views

Mixed content issue while running updates.php in Drupal 6.37

We are facing this issue again for Drupal version 6.37. We do not have jquery update module installed. In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...
-2
votes
1answer
75 views

Is this way safe to bootstrap Drupal from an external PHP script? [duplicate]

I want to bootstrap Drupal from an external PHP file located in Drupal's root directory. The following code will do the job. error_reporting(E_ALL); ini_set("display_errors", 1); ...
0
votes
1answer
20 views

How to apply node access rules when querying menu_links table

I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way ...
0
votes
1answer
31 views

how to provide security to user Profile?

I want to provide security to user profile, so that purpose am adding two check boxes Account Settings List item Make my profile only visible to members of my website members only. Make my profile ...
0
votes
1answer
37 views

Users with no roles are getting onto my system

I am having an issue with my site, there are users accessing it and creating accounts without having a role. Here we can see user roles is blank. From my understanding someone has found a weakness ...
0
votes
1answer
47 views

How to extend flood control in a custom module?

I would like to use Drupal's flood control capability in another module. I have a resource I'm protecting with a password. Can I simply call flood_register_event() and otherwise use the variables as ...
1
vote
1answer
42 views

How can I evaluate the security of a contrib module?

Are there security standards for each stage of a module on Drupal.org? Create sandbox project > full project with dev version only > official release What is the process for the security of ...
2
votes
1answer
80 views

My Drupal site is hacked [duplicate]

It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code: ...
2
votes
1answer
65 views

What is the best way to restrict website's direct access through node urls? [duplicate]

How can I prevent a node from being accessible on its own page, through node/xxx, but still be accessible through node description eg: /homepage? I tried using the Rabbit Hole module, which ...
1
vote
1answer
97 views

Two Factor Authentication for admin/OAuth2 for REST API

I am building a "headless" Drupal application. The front-end is in AngularJS using OAuth2 to authenticate to the REST API that I have built. A client did a security audit and wanted additional ...
0
votes
1answer
96 views

Why does Drupal have both “sid” and “ssid” field in the session?

Learning more about Drupal core so I can be a better contributor, understand security better, etc. I noticed that on creating a session Drupal uses both an "sid" and "ssid" field. The code seems to ...
0
votes
1answer
11 views

Is necessary any sanitization functions if I use the database layer correctly

In Writing secure code said: Use the database abstraction layer to avoid SQL injection attacks Then, my question: When I get value for a user form is necessary pass to check_plain() or others ...
1
vote
1answer
57 views

Updating drupal commons issue [duplicate]

Security Update for drupal All other updates are being done smoothly thorugh drush I have a multi site installation if drupal so i worried to remove the sites folder and update that the general way. ...
0
votes
0answers
25 views

Blocking IP address after specific number of page views in specific period of time / flooding

My website is getting hammered by an IP address overseas. I have blocked such IP addresses via htaccess in the past, but I am looking for a more permanent solution. Is there a way to automatically ...
1
vote
0answers
28 views

Is Commerce Stripe any more or less secure than Commerce Paypal?

The very first thing the Commerce Stripe module states is this: As of the implementation of PCI-DSS 3.0 (January 2015), this module is intended to work within the requirements of the Self ...
0
votes
1answer
23 views

Are spam registrations a threat to a Drupal 7 site

Yesterday, as I was explaining to a client that someone would need to remove spam registrations, the client asked me what difference it made if they are in the system because we can just turn off all ...
1
vote
1answer
8 views

How can I monitor for bot accounts accessing drupal paths without permission?

On my site, users do not have permission to create content. However, looking through the watchdog logs, I found several accounts that were attempting to access node/add/article node/add/page and ...
0
votes
0answers
17 views

The block CiviCRM Create New Record was assigned to the invalid region left and has been disabled

I am applying security upgrades for the instance drupal-2.8. Security upgrades also needed for few contrib modules Chaos tools, Devel, FileField, Printer-friendly pages, Simplenews, Views, Webform. My ...
1
vote
0answers
41 views

Using captcha in varnish setup

Captcha and any form of page caching don't get along. I understand why this is, but i'm wondering if there might be a certain setup to use captcha even in cached environments. Post requests for ...
0
votes
0answers
20 views

Script injected into varibale table?

In search for delays in page rendering have noticed some "script" that seems to be injected to rendered templates, and caused a lot of delays: ...
0
votes
1answer
93 views

This image has been removed. For security reasons, only images from the local domain are allowed

I'm using Drupal core 8.0.0-beta10. I just tried to add new basic page content that contains image to external website and while it's showing up in preview, image isn't showing up once page is ...
0
votes
1answer
117 views

How to add 'style=“width:100px”' in Global Custom Text field in a view?

It seems that the Global Custom Text field in a view delete part of my text. I write this: <div class="my-class" style="width:100px">Hello</div> but get this: <div ...
1
vote
1answer
53 views

New server runs with https

I have a Drupal site that I am currently developing on a local environment. Recently I uploaded my site to a "live" environment and everything seems to load fine except for all admin functionality. My ...
1
vote
0answers
37 views

Does Drupal validate HTTP headers and cookies?

I'm developing a Drupal site for a government organisation and am required to fill in a security assessment form. The form asks for confirmation that the "application" (Drupal in this case) takes ...
0
votes
1answer
27 views

Is there any other way to create more secure link in a drupal_set_message?

Is there any other way to create more secure link in a drupal_set_message?? $loglink = l("bla bla", 'admin/config/services/blabla'); drupal_set_message(t("You should not have empty or the default ...
2
votes
2answers
192 views

OWASP security and drupal

Recently, To improve our site security we implemented and enabled OWASP security in our server using mod_security. After we enabled the OWASP security, whenever I try to create or edit contents in my ...
0
votes
1answer
118 views

Another question on Drupal files folder permissions and security

So there are the following two posts (among others) that say 755 is okay for the sites/default/files directory: What are the recommended directory permissions? Confusion about files permission I ...