Topics related to site security. In particular topics focused on protecting a Drupal site from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms

0
votes
1answer
18 views

Trying to make my entire site https

I am trying to make an entire Drupal site https. I tried enabling secure pages, and this seems to work for every authenticated user. However any anonymous user either gets only http, or possibly an ...
1
vote
1answer
14 views

Is json_decode parse-ability proof of a safe string?

Do I need to use check_plain (or something else) when displaying a user supplied JSON string, when I have previously checked it successfully parses with json_decode?
0
votes
1answer
26 views

Should user input be able to cause an unhandled exception?

Drupal 7's user login form (and I dare say others) can be tampered with client-side, to cause Drupal to throw an unhandled exception. All you need to do is change the input fields, appending [] to ...
0
votes
1answer
18 views

Annoying Drupal Hack keeps changing bootstrap.inc and writes cryptic files to sites/default/files/styles

I'm having huge issues with a massive hack of our website. It was running Drupal 7.32 last year, when a big security issue was announced. Unfortunately we came too late and the site was hacked. For ...
1
vote
1answer
31 views

What is good way to hide update.php file?

I will like to know what is the correct/better way to hide update.php file on the production server. Currently when you try to access update.php file, Drupal shows default access denied page with ...
4
votes
1answer
50 views

Running Drupal 6 with PHP 5.3 and Maintaining Security [on hold]

I have a number of Drupal 6 sites that I can't upgrade at this time due to sheer lack of time to do so (it would be a major overhaul). Therefore, I am required to continue running PHP 5.3 on my ...
0
votes
1answer
17 views

Two concerns: Available for security updates / Image captions

I am looking at revamping a set of sites from ASP to Drupal. I like a lot of what I see in Drupal, but have two concerns: In reading about Drupalgeddon, it seems that the problem was that many ...
0
votes
0answers
18 views

How to scan static copy of website for evidence of being hacked [duplicate]

I need to review a Drupal site in order to determine if it has been potentially been compromised as a result of SA-CORE-2014-005 (Drupageddon) vulnerability. I have a set of procedures I plan to ...
1
vote
0answers
24 views

Maintaining Old Drupal Versions

Is there a list of best practices (or a document on d.o) for maintaining Drupal versions after end-of-life, specifically, when upgrading isn't an option? The best solution, of course, is to upgrade, ...
5
votes
1answer
57 views

Will changing the value of $drupal_hash_salt in settings.php file break site

I was looking through a list of steps to take when there is a risk that your site has been hacked. It recommends changing the value of $drupal_hash_salt in settings.php. According to the inline ...
1
vote
4answers
99 views

How to recover content/configuration from a hacked site

I have a situation where I am faced with two sites which were vulnerable to the Drupageddon SQL injection exploit. I am looking at what is the best strategy for recovering these websites. Given that ...
0
votes
1answer
97 views

Updating from 7.34 to 7.35 after successfull update, drush status shows version 7.34?

Recently i tried to upgrade my site from 7.34 to 7.35 everything when successfully but when i go to status report or executing drush status command it shows that im still on drupal 7.34. These are ...
0
votes
0answers
20 views

Prevent image uploads with embedded code

I have a site which allows anonymous users to create a node with an image (the site allows people to submit images with quote memes so that the authenticity of the quote can be verified, ...
1
vote
1answer
38 views

Is there any sensitive data in the Configuration Management Export?

I noticed in default.settings.php this comment: Location of the site configuration files. The $config_directories array specifies the location of file system directories used for ...
0
votes
1answer
27 views

How to edit module file to make layout changes?

I have installed module Security Questions to allow users to answer security question while retrieving the password. It works fine. But I'm facing layout issue with it. How can I edit this module ...
0
votes
0answers
28 views

post request via services using access token form oauth2 server

I have installed and configured oauth2_server module to be used as authetication server for services. I successfully get the access_token and refresh_token form /oauth2/token the request $user_data ...
0
votes
1answer
60 views

how to set Private file system path permission in drupal

there is an option in configuration>file system which let you define a path for private files. after setting a path in this field access for all users is restricted (including admin). I need to give ...
0
votes
0answers
10 views

Panopoly WYSIWYG exclude buttons configurations

Can anyone tell me if it's possible to configure the Panopoly wysiwyg to we can have different buttons available to different roles? At the moment, without have to create a module, I can't find a ...
1
vote
1answer
63 views

Should you use check_plain() prior to inserting into database?

I am currently using check_plain() etc on displaying user entered data in HTML, and I am also using check_plain() etc prior to inserting the user data into my custom tables. When inserting or ...
4
votes
2answers
234 views

Why did Views just jump from 3.8 to 3.10 (what happened to 3.9)?

There was a security advisory issued for Views yesterday, but the new version is two ahead of the last (3.10 to 3.8). What happened to 3.9? The Views release page doesn't list a 3.9, or a reason why ...
0
votes
0answers
15 views

is it safe to chmod -R 777 ~/www/sites/default/files? [duplicate]

Since drupal 7.34 drupal doesn't display images anymore. I tried editing .htaccess and other things. The only thing that seems to work is to change permissions of the files folder and its subfolders ...
1
vote
0answers
30 views

Drupal update system not detecting latest (security) releases

This morning I got e-mails about security updates and I know one of the modules, path_breadcrumb is installed on some of my sites. So I ssh into these sites, do drush pm-update --security-only and it ...
1
vote
1answer
36 views

Why does default.settings.php suggest writing the value of the hash salt in an external file?

The default.settings.php file contains the following comment: For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that ...
0
votes
1answer
19 views

Boost Security_review compatibility

I had security_review warning for boost cache folder. I've changed cache folder location to "sites/default/files/cache" And now I have no warning. Is this solution correct and safe?
1
vote
2answers
36 views

Removing potentially malicious code from template

Our drupal site was hacked at some point recently, and I've been tasked to clean it up because nobody knows much about drupal here. I think I've taken care of most of the glaring security holes, and ...
0
votes
2answers
42 views

Malicious Code - Website Disable

I'm new to Drupal. My website has been disable due to malicious code found in /var/www/vhosts/domain.com/httpdocs/sites/all/themes/tao/tao/css.php What should I remove in this file? ...
0
votes
0answers
20 views

Cannnot turn off aggregation. Could it be due to server settings?

I am working on a site and two days ago I saw some of the styles on the site disappear. I check the Performance settings in Configuration, CSS and JS aggregation were off. I asked the server ...
1
vote
2answers
43 views

Is this block safe from code injection exploit?

Thanks good people here, I have create a simple module which generate two blocks as follows: function myblockmodule_block_info(){ $block['myadblocks'] = array( 'info' => t('My first ...
0
votes
1answer
20 views

admin only can log from a certain country

I want that the admin user to only be able to log in from a certain country, and that the other users that are not administrators will be able to log in from every country.
0
votes
0answers
21 views

How to find request to unwanted website?

I have noticed that certain pages on my website launch a series GET request to a 3rd party site, probably to attack it. So I guess some DOS code has been injected to the drupal site make the bad ...
0
votes
1answer
27 views

Is there a possible/safe way to do a sub-request in Drupal 7

In Drupal 8 the Symfony HttpKernel Component offers a nice way to make an internal sub-request (forward a request to another page without changing the URL). I'm wondering if there is an ad hoc way to ...
0
votes
1answer
63 views

How to save POST variables securely using entity api

I am creating a module that connects Drupal Commerce to Shipworks (a shipping management system). They communicate with each other using HTTP POSTs via a single endpoint URL on Drupal. One aspect I am ...
1
vote
1answer
115 views

Temporary files directory not fully protected .htaccess

I've been getting this error on my status page since I updated to 7.24 (I'm on 7.34 now). I do have my other files directories protected. I just am having a real hard time figuring how to shut this ...
0
votes
1answer
35 views

How Encrypt module actually works?

I installed the Drupal Encrypt module and enabled it. However, I wonder how this module actually works. Does it encrypt all the submissions from the browser that the user/admin key in like 1) Login ...
1
vote
1answer
18 views

Securing folder in Custom Module for Drupal 6

I wrote a custom module, which logs errors to an external text file. The files are kept in /sites/all/modules/custom/my_module/logging/ The problem is, if the user know the name of the file, they ...
0
votes
1answer
40 views

Ambiguity of using '.' as a separator in the site directory name might have security implications?

In a Drupal installation, which is served through the web server's default server config (i.e. it gets any request for an otherwise unknown domain) I have a settings file at ...
0
votes
2answers
29 views

Safety of letting user define javascript paths in fields

I have a module that uses the Fields API to insert a HTML5 canvas element and allows users to define paths to user scripts to be loaded with the page: The scripts are relative to a hard-coded path ...
0
votes
1answer
39 views

Security concerns with cache_get() and cache_set()

are there any security concerns with Drupal's cache_set() and cache_get() functions? I mean, I receive some values through an Ajax-GET-request. Can I pass them to the two functions with the following ...
0
votes
1answer
36 views
0
votes
1answer
51 views

Odd log entries: is it indicative of an attack?, is there anything other than IP blocking that I should do?

So I've been getting some odd log entries in my Drupal 7 install: Here's two: As far as I can see they haven't done anything and I've blocked the IP addresses but they keep coming with different IP ...
0
votes
0answers
26 views

Is my Drupal website hacked? [duplicate]

So I am running this Drupal 7 website, I just checked users list and got surprised with this: As you can see the usernames are spam and their emails are also spam. But I do not get it how they did ...
1
vote
1answer
53 views

Just found a code.php file in ctools/plugins/argument/, is that a hack? [closed]

While duplicating a site, during files upload I notice a failed transfered file named code.php in the the folder ctools/plugins/argument/ I download and check the original module, and there isn't ...
1
vote
1answer
37 views

Site affected by PSA-2014-003, revoke all public keys?

I didn't patch my website right after PSA-2014-003, it run about one week unpatched. Now, I'm moving my website to a new server, using an old database backup. In my old server, I used an passphrase ...
0
votes
1answer
58 views

Can't access my website

I can't access my website. I guess it has been hacked. Some drupaldev user is already been created and is in admin list. I have blocked that user multiple times, but it reappears again and again in my ...
2
votes
1answer
164 views

Drupal reuses its hash salt

The instructions in default.settings.php say This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if ...
4
votes
2answers
381 views

After Drupal 7.32 should sql injection attempts create PDOExceptions?

I have the Logging and Alerts module installed on a few of my sites. Yesterday I noticed a series of notification emails with the following data. These produced PDOException exceptions and so far as I ...
4
votes
3answers
277 views

Is CiviCRM data vulnerable to the Drupageddon bug?

Would CiviCRM data have been exposed to a Drupageddon exploit if it happened before I updated the site to Drupal 7.32? CiviCRM is in a separate MySQL database. However, the site uses Views/CiviCRM ...
1
vote
0answers
11 views

Auditing my D7 Site after upgrade to 7.32 w/ Zen [duplicate]

As a security nut case, I should have taken the last Drupal Core security update seriously. I did not, as we're in the process of building a brand new version of the website, and were planning on ...
2
votes
1answer
97 views

Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?

I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
1
vote
0answers
85 views

Aegir and SA-CORE-2014-005

Case: - Aegir server 2.1 on Drupal 6.31 -- Platform Hostmaster: Drupal 6.31 --- Hostmaster: ? -- Platform 1: Drupal 7.31 --- Site 1: HACKED --- Site 2: HACKED -- Platform 2: Drupal 7.32 --- Site 3: ? ...