Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

4
votes
0answers
55 views

How is password hashing/encryption performed?

I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could. The class that performs password hashing in 8 is PhpassHashedPassword, based on https://www....
0
votes
0answers
14 views

Is there a module that compares core files to the repository versions? [on hold]

We need to update a site that may have some edits to core files and contributed modules. Is there a module that compares a site's files to the same versions in the repository? If not, how would you ...
-1
votes
0answers
48 views

SETGID bit gets reset for newly created directories inside sites/default/files

I set the SETGID bit on files directory so that any new directories or files created by drupal/php inside sites/default/files will take the group ownership of parent directory i.e here files. But I ...
5
votes
2answers
121 views

Using modules “not covered by Drupal’s security advisory policy”

I would like to use a Drupal 7 module that is "not covered by Drupal’s security advisory policy", specifically the Conditional Fields module. It would allow me to do exactly what I need. It looks ...
0
votes
2answers
31 views

Security model and menu access

Drupal 8.6.1 I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc. ...
0
votes
0answers
12 views

Drush and Security kit module

Does exists the command in Drush which can setup Security module, something like this command: drush seckit --img-src:self,unsafe-inline? Thanks!
0
votes
2answers
26 views

How to place a role-aware “Add new” link at the top of a Views listing of media

I've created a view that provides a listing of a particular media type on my site. I'd like to place an "Add new" link at the top of this view and have it visible only to users who can actually add ...
0
votes
0answers
15 views

Malware, proper way of dealing [duplicate]

My Drupal 7 site was hacked. The malware, it seems, is based in the file a.jpg that is located in /sites/default/files. The file a.jpg contains this code: <?php error_reporting(0); ...
0
votes
1answer
35 views

Update issue of Drupal 8.34

Currently, there is a security issue of Drupal CMS, I'm using Drupal version 8.3.4, does the version 8.3.9 can solve the security issue released on March 28th, 2018 PSA-2018-001 (core highly critical ...
4
votes
2answers
1k views

How critical is SA-CORE-2018-005?

The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability ...
0
votes
4answers
823 views

How to set up permissions for the private files directory?

I'm trying to set up the private files directory and I'm getting the following error. The backup file could not be saved to 'private://backup_migrate/' because the directory could not be created ...
0
votes
0answers
15 views

public page on password protected site

I have a password protected site where I want unauthenticated users to access a public sign up page. where/how should permissions be provisioned to an anonymous users so that this works?
0
votes
1answer
99 views

Drupal 8 secure session [closed]

In Drupal 8.5.X I see that the session cookie is only HTTPOnly and not secure. Any idea how to enforce the session cookie to be always secured?
3
votes
1answer
164 views

How is user input sanitized?

I had to develop a Drupal 8 based website for a client. This client has a quite strict configuration for its firewall and filters the characters used in POST values. It happens to be a bit too ...
0
votes
0answers
77 views

how to set content-security-policy header

I want to set Content-Security-Policy header in my site. I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.
0
votes
0answers
27 views

What's the best files and directories permission for shared hosting [duplicate]

i'm using a shared hosting for my Drupal Website and I'm having some security troubles especially with folders and files permissions. So after some researches in the official documentation and some ...
2
votes
2answers
24 views

Session API Security Advisory

I'm working on a website that is interested in adding chat features. I did some research, and ended up installing the DrupalChat module, and its dependencies. After configuring the module, I realized ...
0
votes
0answers
26 views

Best way to destroy a password

I am building the following login system in Drupal 8. On register, new user account is created and email is sent. User clicks link in email, and sets their password as normal. But after the password ...
-1
votes
1answer
55 views

Security issues with v7.59 [closed]

I have updated various Drupal 7 sites to version 7.59 (and included all relevant updates) because of the security update. However I've still experienced issues with sites being hacked, there were ...
0
votes
0answers
19 views

drupal 7 malicious users get registered [duplicate]

I have a website in drupal 7, and have upgraded it to 7.59 for drupal security issue SA-CORE-2018-004 but somehow on 3rd may, i observed more than 1000 malicious uses created on site. malicious means ...
0
votes
1answer
72 views

“Some files and directories in your install are writable by the server.”

I’m running a Drupal 8.5.3 site and the module: Security Review. One od the “red” results was: Some files and directories in your install are writable by the server. Details: “It is dangerous to ...
1
vote
2answers
271 views

Automatically block user that access /wp-login.php

Is it possible to block any users IP if they try to access a specific URL such as /wp-login.php page which does not exist on Drupal. Basically to automatically blacklist the user, for days or even ...
0
votes
2answers
30 views

Placing Drupal core/modules code outside public_html

I've been trying to improve my sites security as I build a Drupal 8 update for my page. One thing I've seen recently is keeping your core code outside the web accessible docroot folder. I've also ...
0
votes
1answer
39 views

How to always require email verification before accessing a page?

I have a custom page defined by hook_menu. I want signed in users to be required to verify their email every time they want to access it. The page will have buttons on it that would allow someone to ...
0
votes
1answer
502 views

Sites hacked across login pages [closed]

My Drupal 7 sites were hacked many times, and I find everytime some files created by the hackers. Even though I did the security update, that didn't prevent the hackers to access to the server. ...
0
votes
1answer
81 views

Has my site been compromised? [duplicate]

Edit apparently they belong in the includes folder, were they also are. could it be of any use for a hacker to have these two folders in the root? I've been checking my drupal site and noticed in the ...
1
vote
1answer
95 views

Is media-7.x-1.x vulnerable to SA-CONTRIB-2018-020

The Drupal Media module version 7.x-2.x contains a remote code execution vulnerability which was patched with: https://cgit.drupalcode.org/media/commit/?id=1cd77ffa9c2cf96d80b76d47318179a8a82f0d46 1....
2
votes
1answer
42 views

Is it safe to allow domain.com/username?

Are there any security risks if we create pathauto roule so that the user account pages are at domain.com/username
1
vote
1answer
43 views

Extended Audit logs

I am using Audit log module for Drupal 8.5. But it looks the audits are very limited - i.e it audits only user updates and node updates. Not for creating templates, changing configurations, changing ...
0
votes
1answer
18 views

How to add registry key verification step with the key being stored in another database

I am currently learning how to use Drupal through Udemy classes; I am a complete newbie. I am building a Drupal Website, for my personal development, and when someone wants to register to the ...
1
vote
1answer
55 views

What is the best way to update Drupal periodically using a cron job? [closed]

Previously I periodically updated Drupal sites by using a cron-job with a "drush up -y" script running every Wednesday 15,16,17,18,19,20,21,22 hours UTC. which is when "Security releases happen" ...
0
votes
1answer
479 views

How do I check whether the patch for SA-CORE-2018-002 is applied?

How do I check whether the patch for SA-CORE-2018-002 is applied in a Drupal 7 website? I have applied the patch. How does it secure my Drupal websites?
0
votes
1answer
24 views

Custom Module Remote Fails Checksum with Drush

Background I have several proprietary Drupal modules that my company uses. We want to update these across all our sites. To that end, I've built an endpoint that produces code according to the (ill-...
10
votes
4answers
4k views

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 — 2018 March exploit?

Just released exploit: https://www.drupal.org/sa-core-2018-002 --- Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 How can I tell if someone used this exploit to hack my site?...
0
votes
0answers
33 views

What is the purpose of file_entity_allow_insecure_download variable of “File Entity” project

I found out the variable file_entity_allow_insecure_download in the File Entity (fieldable files) module which is not going to allow downloading a file if you access the /file/[:fid]/download?token=...
0
votes
1answer
23 views

what security measures should be taken when creating/updating/retrieving entities with data from users' form submissions?

We have webforms for authenticated users (anyone can create an account without admin approval) to fill out. With their submission data I'm using the civicrm_api to create contacts and relationships. ...
-2
votes
1answer
75 views

“password reset” links are truncated in plain-text emails [closed]

Password reset links are truncated in plain-text .. Google Adwords in Remarketing List service detect the latter as failing confidentiality of personal information ...
1
vote
2answers
80 views

Drupal 8 password retention

I am currently reviewing Drupal 8's security features and was wondering about how Drupal stores user passwords. I know Drupal uses salted hashes to store the password in the database, but does Drupal ...
0
votes
1answer
182 views

With enabling modsecurity_crs_41_sql_injection_attacks all submit form return forbidden 403

I installed and activated the module mod_security. then I enabled the modsecurity_crs_41_sql_injection_attacks.conf. For each form, when I submit, I have an error 403 forbidden Error log: [Wed Nov ...
1
vote
1answer
61 views

Drupal form_state sanitization

I'm new to Drupal and I am doing some module development for a Drupal 7 install. I've done development outside of Drupal and normally its best to always sanitize user input. I've seen different ...
1
vote
1answer
90 views

security kit module settings are blocking own site jQuery calls

I am using Security kit module to enhance security for my website. In that I have enabled Enable JavaScript + CSS + Noscript protection option. This setting is blocking one of Jquery call that is ....
2
votes
3answers
222 views

How to securely authenticate content embeded in another site?

I need to embed password protected content to a second domain with an iframe. The content itself is a view which will be displayed on a third party site via an iframe and the content is prepared with ...
1
vote
1answer
181 views

How to determine the code for settings.php config override based on .yml?

I am trying to put my API keys in a separate file instead of storing them in config management. For example, I installed the Commerce Stripe module. When I export the config, it looks like this: ...
0
votes
0answers
44 views

(Answered) Ajax link for anonymous users to delete node they created if $_SESSION exists. Is node's created timestamp secure enough in link?

I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away. Instead of forcing them to create an account and take ...
0
votes
0answers
17 views

Drupal Captcha Module Security update Problems [duplicate]

Running Drupal 7.56, PHP 5.6. Got a notice that I should update Captcha module and whenever I try to download it, it throws the error: HTTP error 0 occurred when trying to fetch https://ftp.drupal....
1
vote
1answer
53 views

How sensitive is a site's UUID?

I have set up continuous integration for a Drupal site. After every git push the site is built remotely from scratch in a Docker container. It runs a site install, sets the site's UUID to import the ...
-1
votes
1answer
87 views

How to locate the Entry Points of a Drupal 8 Core module?

I'm to perform a security audit on the Drupal 8 Core modules, and was curious if there were any telltale signs of Entry Points (ie, how a module communicates with an external module and vice-versa). ...
0
votes
1answer
593 views

Is there a risk of having xmlrpc.php on my site?

I recently noticed that all of my sites have the file xmlrpc.php. Searching it led me to "Gain Control of WordPress by Exploiting XML-RPC", and also to "Drupal Core - Critical - Multiple ...
0
votes
2answers
334 views

Unblock an automated blocked user

I used Login Security module to block users after some login failures. It works fine however I need to unblock such users after certain time like after 1 hour/day. How would I do that as it has ...
0
votes
1answer
31 views

How to securise custom modules

I'm trying to understand how to securise my custom modules to avoid php insert into custom inputs and SQL injections in my db_query. For inputs I'm using : $form['custom'] = array( '#type' =&...