0

Well I'm working on a government website that needs a lot of security insurances! the security thingy guys keep saying that there are couple of Drupal name in the source that shouldn't be there!‌

So far I changed Drupal Meta Generator but still there are some javascript files and Drupal. Settings that still shows up in the source code. Here's what I'm referring to:

jQuery.extend(Drupal.settings, {"basePath":"\/","pathPrefix":"","ajaxPageState":{"theme":"stme","theme_token":"tytMMj0EavWD-6KgUbjQYEmSyk35cF3mwLTcqBKhO5U","js":{"misc\/jquery.js":1,"misc\/jquery.once.js":1,"misc\/drupal.js":1,"misc\/ui\/jquery.ui.core.min.js":1,"misc\/ui\/jquery.ui.widget.min.js":1,"misc\/ui\/jquery.ui.button.min.js":1,

this is just a part of the code between tag, What I need is to change jQuery.extend(Drupal.settings to something else and also change the name of drupal.js .

I have no idea that could it have any side effects if I manage to make it? and before all how am I be able to do these changes?

Improve this question
6
  • 2
    No offence to your security guys, but that's absolute nonsense - security through obscurity is a waste of time, and changing the name of a couple of JS variables will get you nothing. There are many more ways than seeing the word "Drupal" in the source code that will give away the fact a site is using Drupal. To directly answer your question - yes, there will be many, many side-effects if you change the name of the global Drupal JS object. You'll also need to edit every single other Javascript file in the system, including all custom/contrib JS files.
    – Clive ♦
    Oct 23, 2013 at 8:17
  • 2
    @Clive And don't forget about javascript codes added with drupal_add_js as strings, saved only in .module and .inc files - there is a pretty significant amount of them in some modules, too.
    – Mołot
    Oct 23, 2013 at 8:20
  • 1
    @Mołot Oh yeah, didn't even think about those. Suffice to say it would be a massive undertaking, and would need major patching every time a new version of Drupal/contrib modules are released. All in all, a rather ridiculous workflow to want to introduce for zero real-world benefit
    – Clive ♦
    Oct 23, 2013 at 8:24
  • 1
    @Clive I'm quite agree with you about being a waste of time, but we have to get the verification from them and that's what they asked, even though it seems quite stupid. but thanks for the hint guys
    – Sohail
    Oct 23, 2013 at 10:32
  • 1
    @Sohail I feel your pain, I've been at the mercy of corporate madness before now too ;)
    – Clive ♦
    Oct 23, 2013 at 10:40

0

Reset to default

Browse other questions tagged or ask your own question.