This may very well be a stupid question but there is no avoiding it now. Unfortunately myself and many others succumbed to the temptation of skipping learning ubercart in lieu of obtaining a seemingly quick and easy 3rd party module for commerce.

Today drupal alerted me to an update for this 3rd party module but deleting it is not picked up by the refreshed module list, it simply vanishes and then when you try installing new version it remains stuck in checked position so that no new version can be installed and no uninstall can ever take place.

Of course the creator of this module has disappeared off the planet leaving myself and many others with less money in our pockets and red faced and some very angry with no support.

All of us say it is the first paid drupal module we've ever acquired because it did seem such a very good idea and easy to implement and the young man who made it was extremely helpful and professional at first.

It is still working on my site albeit unable to be updated but strange companies like soso.com in China have infiltrated this creator's site and are being listed in user's list of domains including mine so is this not a most terrible security risk for anyone using it with rest of the well maintained open source drupal?

update: the owner of these modules has actually returned and is back to usual professional good self. :) all's well that ends well.


Well, have you deleted that module without disabling & uninstalling it first? Some of your effects seems to be that way. Anyway, automatically updating a module from 3rd-party server is only as secure as his server. If you did it, and source server was compromised, you should consider yours compromised, too. Only safe way? Revert from backups to the last snapshot you are reasonably sure to be safe, and then do not update that module (possibly uninstalling it as soon as feasible).

  • It is impossible to uninstall. It will not be unchecked so only option is to remove it. – cea Jan 8 '14 at 12:56
  • @CharlieBunt if module has safeguards against disabling, then you can disable it directly in database. I'm sure there was already a question about it - if you can't find it, feel free to ask new one. – Mołot Jan 8 '14 at 12:57
  • @CharlieBunt Go into the module's .info file, there's probably a 'required' property in there which you can just remove. But do so with caution, there may be a good reason it won't let you uninstall it (i.e. it might kill your site) – Clive Jan 8 '14 at 12:58
  • disable it directly in database, can you please point me in right direction for that? – cea Jan 8 '14 at 12:58
  • 1
    @CharlieBunt It is documented on Drupal.org, here is the link: Disabling or Enabling modules manually in the database. But as Clive said, check what requires your module before disabling it. And make backups. A lot. – Mołot Jan 8 '14 at 13:00

Do third party drupal modules pose a security risk?

Well if you use them, then yes, of course. You're inviting unknown code in to your codebase.

If you haven't sought contractual guarantees from the author of the module as to its fit-for-purpose and security, then it's your responsibility to perform the necessary security reviews, and declare it ready or not for a production site.

Broadly speaking, any piece of code, whether it be custom, contrib or from core itself, potentially introduces risk to your application. The difference with contrib/core code is that you can make some assumptions as to the level of security testing that has taken place, and perhaps view those as less of a risk because of that testing.

But there have been plenty of security holes found in core and contrib modules (some pretty major ones) in the last couple of years, so you need to be on the ball with your own security testing and standards.

None of this is really specific to Drupal by the way; auditing foreign code in any project, in any language/framework, is an absolute must.

  • Agreed, this is not specifically drupal this is on my part specifically stupid and i will never ever trust such a thing again. – cea Jan 8 '14 at 12:57
  • @CharlieBunt We've all done the same thing - usually only once, as in your case. And mine ;) – Clive Jan 8 '14 at 12:59
  • shaking my head in disbelief at myself but thanks. :) – cea Jan 8 '14 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.