Topics related to site security. In particular topics focused on protecting a Drupal site from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms

0
votes
0answers
2 views

Remove script from admin pages after being hacked

The site running Drupal 7 was hacked and every administration page, e.g. http://www.anysite.com/en/admin/dashboard contains script tag in head section with malicious src attribute, e.g. ...
0
votes
0answers
22 views

Update database/dom after dialog button submitted with jQuery

Clicking a dialog button I want to update Drupal database using jQuery .ajax() function! I want to know if in first place is secure to do so or is another method to handle the synchronous requests? ...
0
votes
1answer
13 views

warning message after uprgraded to drupal 6.38

I upgraded drupal 6.2 to drupal 6.38 to apply the security patch to ignore the vulnerabilities as mentioned in https://www.drupal.org/drupal-6.38-release-notes . But after updating to 6.38 when i ...
1
vote
0answers
16 views

How do I secure pages and related media files?

I would like to password protect Drupal pages (solved) and media files related to these pages (solved, but not optimally). Currently the Drupal pages are secured via Drupal and the media files via ...
0
votes
1answer
34 views

How do I handle third-party API credentials in settings? [closed]

I am building a module that will need to integrate credentials for the 3rd party service in Drupal 8. The module's admin panel should remember the credentials and use them to interact with the ...
0
votes
0answers
12 views

site hacked: ctolls cercoincontri [duplicate]

one of the web site (in Drupal 7.43) I am looking after (apparently not that well, although updates have always been applied) has been hacked. There's now extra text in the footer pointing to an ...
3
votes
2answers
92 views

How can I ensure I retain access to a Drupal site after handing it over to a client?

Does Drupal have a mechanism which will allow me to keep control over a site after handing it over to a client? If things go wrong with the client relationship, I need to be sure I still have control ...
0
votes
2answers
36 views

Update to Search API 1.18 causes HTML to be displayed as plaintext

A security update to Search API (7.x-1.18) adds new sanitation as a security measure. Great! ..Except it now causes my custom field to be displayed as plaintext instead of HTML. Here is the ...
0
votes
0answers
13 views

How to add a form_token to Views exposed filters?

As per the Acunetix scan report, I need to add form_token for drupal views exposed filter. How could I achieve this?
0
votes
0answers
26 views

How good is the default encryption method provided by the Encrypt module?

I want to encrypt certain field values from webform submissions and will use webform_encrypt module to achieve this. This is dependant on encrypt module. I am interested to know how satisfactory are ...
0
votes
0answers
12 views

mixed mode without sharing session cookies

We have a site which anon users access through http, authenticated users through https. We needed to add conf[https] = TRUE; to automatically create redirects(in http) when URL aliases are changed ...
0
votes
1answer
15 views

Delete cookie just before render

I am trying to hide the fact that I have a Drupal site (as much as possible). The idea is that if a would be hacker (I am not talking about some ninja that could break into the pentagon) looks at ...
0
votes
1answer
18 views

How does Drupal ensures that the one time unique URL used to reset user password does not get transferred away inside the http_referer header?

For example in case the site relies on and loads some external JS (such as jQuery via CDN). Quite technical but any insights are highly appreciated. Thanks.
0
votes
1answer
31 views

What to do for “Login attempt failed for admin.” and “Access denied” to path admin?

In Watchdog, I started seeing several entries like this: Login attempt failed for admin. And access denied 2016/04/04 - 15:06 admin These are generating a fair number of log entries. The ...
0
votes
1answer
97 views

How did the ransomware get in? [closed]

A site where the site owner put off having updates done has been compromised with ransomware. This situation brings up a lot of questions. A Google search has not produced any answers. The server is ...
0
votes
1answer
20 views

Permanent Cookie Contains Sensitive Session Information [closed]

I have a cookie question in regards to a security scan (via IBM Rational AppScan) conducted on a drupal(7.43) site. The security scan failed with the following error: (Permanent Cookie Contains ...
0
votes
0answers
13 views

Why settings.php does not redirect to homepage so it betrays that the file is in that exact location even if moved by security reasons? [duplicate]

I have checked that www.example.com/sites/default/settings.php is reachable via web browser, even if it returns an empty page. What is more strange, in Drupal org webpage, ...
0
votes
1answer
22 views

Looking for informaton on Drupal core security process, audits and benchmarking

I'm looking for information on Drupal's security processes, any audits carried out, benchmarking against securty standards, what happens security-wise before a new Drupal release etc... The most ...
2
votes
0answers
24 views

How to handle user 1 with PCI compliance [closed]

PCI compliance states there can be no shared accounts. Typically between developers user 1 is shared and utilized for things that require user 1, but that would violate the PCI rules. Is there a way ...
1
vote
1answer
28 views

Increase security on logon

I am using Logintoboggan module but by chance by playing around with Wireshark packet sniffing tools I can see all login details and passwords when users login/register on my site! Is there a way to ...
3
votes
1answer
23 views

Add Encryption to Images

Is there a way to add encryption to images once they are uploaded on the website and stored on the server?
1
vote
1answer
20 views

Secure file download from other server

This is an unusual one. Let's say I have two web servers A and B. How would I go about making a link to a file from a Drupal website on server A to a file on server B such that the link is secure (the ...
1
vote
1answer
25 views

How can I exclude API keys, passwords, and so on from configuration management?

I am using Drupal 8 and drush cex to commit my configuration to my repository. However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive ...
0
votes
0answers
18 views

Adding Encryption to a Specific Field in an Existing Product Form

I'd like to add encryption to one of the fields in a product form on my site. I want to do this because my hosting provider doesn't send outbound email using TLS and users receive emails with this ...
2
votes
2answers
55 views

Is this a possible attack on database?

In the logs (Drupal 7), I have seen the next entry (I have edited some compromised info). It seems a failed (only I hope it actually failed) attempt to access the login account. I have tried to ...
0
votes
0answers
15 views

How to check for drupal page routine, no form submit working

On my drupal website, I suddenly can't submit any form successfully. The page appears to reload but does not go anywhere, stays exactly where any form is. Using drush uli, I can get in as admin but ...
2
votes
1answer
59 views

Multiple login attempts from different IP Addresses

My website has been getting about 25 login attempts per hour for the past few days for usernames admin, administrator and our website name. The attacker seems to be using differing IP addresses and ...
1
vote
1answer
67 views

Delete all nodes of a user using flags and rules

I want to delete all nodes for a user whoes any one node has been flagged as spam. For example: If user has created 3 nodes of same/different content types, then If admin flag any one content as ...
7
votes
2answers
327 views

Why is settings.php in the web folder?

In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a ...
2
votes
1answer
28 views

Can I temporarily stop update notifications for one project only? [duplicate]

Is there a way I can tell Drupal not to notify me about a particular version of a module? For example, if it isn't security related and I choose not to update one module but would like to receive ...
-1
votes
1answer
24 views

code change alert/email [closed]

Is there a module to help me receive email for any change in drupal site ? https://www.drupal.org/project/logging_alerts this module help a lot in log in / log out and add content .. but I need to ...
1
vote
1answer
70 views

How to prevent applications from uncovering the technologies used on the website

Here is a super hard question, probably for the most experienced people: Can we prevent applications from uncovering the technologies we are using. We all know that making sure to keep the core and ...
3
votes
1answer
101 views

Installation error in Ubuntu - The settings.php file does not exist

I've installed Drupal 6\7\8 in WAMP environments for about a hundred times, but I don't recall ever having the following instllation error, which I encountered only in Ubuntu desktop 15.10, Apache2 ...
0
votes
0answers
19 views

Which is best spam comments preventing module in drupal 7 [duplicate]

I want to enable user comments form, registration and login forms. For those forms I want to increase security things to avoid hackers attack. I have tried Mollom and AntiSpam but those do not work ...
0
votes
0answers
26 views

code automatically changing on me - iframe not working consistently - IE11 cross-site scripting error

I have created a Basic Page and put code in the body for an iframe so we can connect to our university library publication system. I'm doing this for all our users with publications. I had about 20 ...
2
votes
3answers
115 views

Favicon not loading from https

I have enabled https for my site. All images and files are served with https url, but favicon it is serving from http://example.com/sites/default/files/favicon.ico instead it should show as ...
0
votes
0answers
25 views

Front page full of invisible spam links [duplicate]

This morning i noticed that wherever i want to click on menu and above menu i have invisible links leading to spam websites. It looks to me that they are hard coded but i have no idea where to delete ...
-1
votes
2answers
57 views

Hardening Drupal server running the Update Manager

We are going to do the hardening on one of our Linux server running SELinux and Drupal 7 with firewall; on the Drupal Update Manager, if we want only to get periodic emails / notifications on modules ...
1
vote
1answer
57 views

Services CSRF Token request security

A Drupal website that my company is maintaining has a REST endpoint, using Drupal Services (likely not that relevant). One of the systems that I'm writing has to write changes in the system to that ...
0
votes
1answer
37 views

SQL injection and lot of database updates are visible [closed]

My Drupal Website is possibly compromised through a SQL injection and lot of database updates are visible. How to avoid further SQL injection?
0
votes
2answers
58 views

Drush error on core update “corrupt (wrong md5 checksum)”

I'm getting this error when I try to update core with Drush: File drupal-7.41.tar.gz is corrupt (wrong md5 checksum). [error] Updating project drupal failed. Attempting to roll back to previously ...
1
vote
1answer
49 views

Using the back button after logging out shows you pages from the authenticated user's session

Using the back button after logging out shows you pages from the authenticated user's session. I found a solution for this, need to set the header like this to fix this issue- ...
5
votes
1answer
436 views

What do blocked IP addresses see?

I have been getting a lot of failed attacks targeting my server in the last few months. I have been using the Drupal IP block to block IPs that where sniffing for vulnerabilities. I would like to know ...
1
vote
2answers
33 views

Is it safe to send the unencoded JSON output?

The mobile app developers wants an api to get a list of articles from our Drupal site. It should have these fields in the output: nid title field_teaser_body The api resonse has to be in JSON ...
0
votes
1answer
47 views

Getting password hashes and salts from Drupal 7

I need to get user accounts' password hashes and salts from a Drupal 7 app, so as to migrate these accounts into Stormpath. Could you please help me to figure out where this data is stored and how to ...
3
votes
1answer
129 views

Is uploading/download executable files harmful in drupal? [closed]

In my site design, I have a field that is designed to hold an executable file (.exe, .bat, etc), for users to upload and download. I took pause as I was typing these extensions into the Allowed file ...
0
votes
1answer
34 views

Can a disabled module pose a security risk?

Is it possible for a module that is installed but not enabled to pose a security risk? Corollary question: Is it a recommended practice to update disabled modules when security updates become ...
1
vote
1answer
50 views

Mixed content issue while running updates.php in Drupal 6.37

We are facing this issue again for Drupal version 6.37. We do not have jquery update module installed. In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...
-2
votes
1answer
85 views

Is this way safe to bootstrap Drupal from an external PHP script? [duplicate]

I want to bootstrap Drupal from an external PHP file located in Drupal's root directory. The following code will do the job. error_reporting(E_ALL); ini_set("display_errors", 1); ...
0
votes
1answer
23 views

How to apply node access rules when querying menu_links table

I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way ...