Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
0
votes
3answers
35 views

Use read-only database user to minimize security risks

I want to phase out an old, unmaintained Drupal 6 page. The website should still stay online, but should be read-only. I want to change the database user so that it only has read privileges. I don't ...
0
votes
1answer
25 views

How to restrict access to specific php file to only athenticated users

I manually made a php file that has the ability to connect to the database and create table entries, it works fine, but now the problem is that if I leave it there, anyone will be able to access it to ...
0
votes
1answer
36 views

403 Error - Unable to create Paragraphs via REST with ?_format=hal_json

Trying to add paragraphs via REST to the earlier created node. I've installed the Paragraphs Type Permissions module, enabled the following permissions for my REST user's role Text: Create content ...
1
vote
0answers
31 views

Database password revealed in PHP error_log?

Noticed some errors while updating to Drupal 8.9.11. As I'm reviewing I come across the following. Replaced the actual password with PASSWORD below. Is this intentional or a bug? I can't see why the ...
0
votes
0answers
33 views

SharePoint online search query in logged-in user context, which is connected through SIMPLESAML SSO (Azure AD IDP) with Drupal application

Below is problem description - I have sharepoint online and its URL is like - https://abc.sharepoint.com Above sharepoint is connected through SSO (Office 365 Azure AD IDP and SAML) I have another ...
1
vote
1answer
102 views

How do I hide the core version to the outside world?

I was bothered in knowing with whatcms.org a version can be given for drupal 8, even a minor version - no minor version, instead, when I tried with a drupal 7. Curiously enough in my case, I got a ...
0
votes
1answer
35 views

Why am I getting an error message in my dashboard for unprotected private files?

I have a site with Drupal 8.9 Why am I getting an error message in my dashboard for unprotected private files ? When I go to the link it says this is for Drupal 6 and 7. PRIVATE FILES DIRECTORY Not ...
0
votes
2answers
89 views

Sanitization of the q parameter

I'm using Drupal 7. My question regards the sanitization of the "q" parameter. We know about SQL injection, so I was wondering if this parameter may be a vector for this kind of security ...
0
votes
1answer
49 views

What's The Security Implications for “Send arbitrary files” in Permissions

For my webforms, I want to receive attachments, when I receive an email. I had issues receiving them until I set the permissions for Anonymous User to allow them to use "Send arbitrary files"...
1
vote
0answers
39 views

Decoupled Drupal - Security [closed]

I am running a Drupal 8.9.2 site as a content repository accessed via an Angular 8 app. So there is one administrator who uses the Drupal interface to write content / upload files eccc.... and ...
0
votes
2answers
214 views

Error: Private files directory not fully protected

I received the following error in my Drupal 8 status report: PRIVATE FILES DIRECTORY Not fully protected See https://www.drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess ...
0
votes
1answer
96 views

Understanding the Basic Context of Trusted Hosts [duplicate]

I got the trusted host settings error. The trusted_host_patterns setting is not configured in settings.php. This can lead to security vulnerabilities. It is highly recommended that you configure ...
-2
votes
1answer
51 views

Are user passwords encrypted upon login form submission? [closed]

A simple question: If we are in the user.login page with http:// (not https://) is the password encrypted or not?
1
vote
1answer
34 views

How do I implement access checks based on referring nodes in the grants system?

Following a suggestion in another thread here I'm trying to rewrite the access restrictions that I developed using hook_node_access (and that are working well, so far) in Drupal's grant system (i.e. ...
0
votes
0answers
46 views

Error when updating 8.7.12 to 8.8.5 [duplicate]

When I update my 8.7.12 site to 8.8.5 I get the following error: Fatal error: Uncaught Error: Call to undefined method Drupal\Core\Installer\InstallerKernel::installationAttempted() in /usr/www/...
0
votes
0answers
26 views

Security review: Some files and directories in your install are writable by the server

I am running Drupal 8 on a vps running latest ispconfig/apache fastCGI. Security review module reports: "Some files and directories in your install are writable by the server." and basically lists ...
2
votes
1answer
160 views

Is 8.6.18 insecure? Will there be 8.6.19 etc.?

I have a custom module that I think requires Drupal 8.6.x. Is Drupal core 8.6.18 insecure? Will more 8.6.x versions be released?
1
vote
1answer
57 views

MYSQL injections: Are they a threat?

For a while now, all my Drupal 7 and Drupal 8 instances have been under constant attack from South America or Asia, where the attacker is trying to infiltrate Drupal with MySQL injections. The ...
0
votes
1answer
35 views

Make a password security check for the register form

I have a register form that is output in a controller using the following code. $form = $this->getUserProfileForm(); return [ '#theme' => 'maubl_user_inscription', '#form' =&...
1
vote
1answer
83 views

Drupal 8 correspondence to node_access function on Drupal 7

I feel like asking a silly question, but here it is anyway: I need to test if a given user (in my case, the logged in, current user) has access to a given node for one of the existing operations (view,...
0
votes
1answer
92 views

What is x-speed-cache-key? What is its purpose?

Our drupal site was pentested. The pentest report labeled an action involving the header X-Speed-Cache-Key as a security concern. The finding stated: Arbitrary parameters supplied to the query ...
0
votes
1answer
210 views

The security danger of publicly exposing an upload field

On older drupal 7 websites I once faced security patches for the webform module, because file upload fields were considered insecure. There was en exploit where people could end up uploading .html ...
0
votes
0answers
44 views

Drupal and security hardening - PHP chmod

I am struggling with the following case with Drupal and PHP hardening on an Red Hat Linux infrastructure. For drupal installation a user has been created. All the files and directories are owned by ...
4
votes
1answer
216 views

Drush or Drupal console command to list modules with security updates?

Is there a command for Drupal 8.x that shows available updates? I added forms_steps 1.1 that has an SA and a security update required in the Web UI, which is saying to update to 1.2 I tried drush pm:...
-1
votes
1answer
384 views

fix-permissions.sh for Drupal 8

With Drupal 7, when I upload a project from local to server, I usually run fix-permisions shell script to change owner and permissions of folder/files. Is provided in : https://www.drupal.org/node/...
0
votes
1answer
16 views

How can I import a local database remotely without having a local database copy?

I am working on database security and with using Drupal we have daily backups from a cloud server which we access remotely. What I normally do is grab a daily DB copy from the cloud server, move the ...
0
votes
1answer
63 views

Node field not sanitize on render

I have a form for users who want to add new content on my Drupal 8 website. I render node field on a twig template : {{ node_field_title.value }} But field are not sanitized by Drupal. Is it the ...
0
votes
1answer
47 views

How to generate my own patches to update core for security when fuerstnet.de's “Drupal upgrade the easy way” page is out of date?

For Drupal 7, under the current host I'm using (which doesn't provide things like drush), I've found that patching is the easiest approach to updating core. However, the commonly-referenced page which ...
1
vote
1answer
21 views

Configuring Fail2ban for the r4032login module

Recently, I installed fail2ban on my server to help prevent bots from abusing the site. I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the ...
0
votes
0answers
45 views

Update Symfony before Drupal core?

Right now there are some security updates for Symfony: curl -sS https://get.symfony.com/cli/installer | bash echo y | ~/.symfony/bin/symfony self:update ~/.symfony/bin/symfony security:check Symfony ...
0
votes
1answer
347 views

How to prevent Cross Site Scripting when input using “Full HTML” mode of CKEditor

I am using Drupal version 8.3.7 and ckeditor 4.11.3. I create a basic page contains some scripts as following: In the detail page, I can see that the script in onmouseover="alert('222222')" is ...
1
vote
2answers
483 views

Where can we store 3rd party application passwords?

I've written a Drupal 8 custom module that communicates with 3rd party APIs which need authentication. I have an application username and password for those APIs which I need to store somewhere. I can ...
-1
votes
2answers
49 views

What does this error message mean?

My website is getting too slow. When I checked the journal entries, I found many errors like the following. What is it? What are they trying to do?
0
votes
1answer
408 views

Ajax form content security policy

Conversation around: how to set content-security-policy header read and noted https://www.drupal.org/project/csp (Drupal 8 only) mentioned unsafe-inline is mandatory for WYSIWYG edits to work. My ...
0
votes
0answers
34 views

Missing config/default directory error after patching the latest critical vulnerability

After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file. drupal/core from 8.5.8 to 8.5.11 drupal/jsonapi from 1.7 to ...
0
votes
0answers
124 views

Proper security for settings.php

I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
1
vote
0answers
72 views

Distribution Commerce Kickstart 1.x - is possbile run Drupal Core 7.61 / PHP 7.2 ? And how [closed]

I have small and very simple Drupal 7 site based on Commerce Kickstart 1.x distribution (originally instalation profile, now "distribution"). The version of distribution is 7.x-1.53. It is last ...
0
votes
1answer
77 views

Is it okay to expose .yml or .install files to public?

As per my knowledge the static files like css/js inside core/modules etc should be read by http server user. So normally I give read permission recursively to http user for directories like core, ...
0
votes
1answer
77 views

Is exposing the UID a security issue?

I noticed that the UID of users is exposed in the HTML code of a page on my site that authenticated users can access. Is it a problem if authenticated users with "view user profiles" permission are ...
5
votes
1answer
3k views

How is password hashing/encryption performed?

I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could. The class that performs password hashing in 8 is PhpassHashedPassword, based on https://www....
4
votes
2answers
540 views

Using modules “not covered by Drupal’s security advisory policy”

I would like to use a Drupal 7 module that is "not covered by Drupal’s security advisory policy", specifically the Conditional Fields module. It would allow me to do exactly what I need. It looks ...
0
votes
2answers
114 views

Security model and menu access

Drupal 8.6.1 I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc. ...
1
vote
3answers
198 views

How to place a role-aware “Add new” link at the top of a Views listing of media

I've created a view that provides a listing of a particular media type on my site. I'd like to place an "Add new" link at the top of this view and have it visible only to users who can actually add ...
0
votes
1answer
47 views

Update issue of Drupal 8.34

Currently, there is a security issue of Drupal CMS, I'm using Drupal version 8.3.4, does the version 8.3.9 can solve the security issue released on March 28th, 2018 PSA-2018-001 (core highly critical ...
4
votes
2answers
2k views

How critical is SA-CORE-2018-005?

The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability ...
0
votes
3answers
6k views

How to set up permissions for the private files directory?

I'm trying to set up the private files directory and I'm getting the following error. The backup file could not be saved to 'private://backup_migrate/' because the directory could not be created ...
0
votes
1answer
809 views

Drupal 8 secure session [closed]

In Drupal 8.5.X I see that the session cookie is only HTTPOnly and not secure. Any idea how to enforce the session cookie to be always secured?
3
votes
1answer
1k views

How is user input sanitized?

I had to develop a Drupal 8 based website for a client. This client has a quite strict configuration for its firewall and filters the characters used in POST values. It happens to be a bit too ...
2
votes
1answer
1k views

How to set content-security-policy header?

I want to set Content-Security-Policy header in my site. I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.
0
votes
0answers
46 views

What's the best files and directories permission for shared hosting [duplicate]

i'm using a shared hosting for my Drupal Website and I'm having some security troubles especially with folders and files permissions. So after some researches in the official documentation and some ...

1
2 3 4 5
9