Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
0
votes
1answer
27 views

MYSQL injections against Drupal. Are they a threat?

For a while now, all my Drupal 7 and Drupal 8 instances have been under constant attack from South America or Asia, where the attacker is trying to infiltrate Drupal with MySQL injections. The ...
1
vote
1answer
16 views

Drupal 8 correspondence to node_access function on Drupal 7

I feel like asking a silly question, but here it is anyway: I need to test if a given user (in my case, the logged in, current user) has access to a given node for one of the existing operations (view,...
0
votes
1answer
35 views

What is x-speed-cache-key? What is its purpose?

Our drupal site was pentested. The pentest report labeled an action involving the header X-Speed-Cache-Key as a security concern. The finding stated: Arbitrary parameters supplied to the query ...
0
votes
1answer
24 views

The security danger of publicly exposing an upload field

On older drupal 7 websites I once faced security patches for the webform module, because file upload fields were considered insecure. There was en exploit where people could end up uploading .html ...
0
votes
0answers
25 views

Drupal and security hardening - PHP chmod

I am struggling with the following case with Drupal and PHP hardening on an Red Hat Linux infrastructure. For drupal installation a user has been created. All the files and directories are owned by ...
4
votes
1answer
60 views

Drush or Drupal console command to list modules with security updates?

Is there a command for Drupal 8.x that shows available updates? I added forms_steps 1.1 that has and SA and a security update required in the Web UI which is saying to update to 1.2 I tried drush pm:...
0
votes
0answers
35 views

Phar not working in Drupal 8

If I try to use a simple Phar call in my controller: $tar = new \PharData('/path/to/myTar.tar'); I get the error: "Unexpected file extension" This is because Drupal Security checks to see if the ...
-2
votes
1answer
50 views

fix-permissions.sh for Drupal 8

With Drupal 7, when I upload a project from local to server, I usually run fix-permisions shell script to change owner and permissions of folder/files. Is provided in : https://www.drupal.org/node/...
0
votes
1answer
12 views

How can I import a local database remotely without having a local database copy?

I am working on database security and with using Drupal we have daily backups from a cloud server which we access remotely. What I normally do is grab a daily DB copy from the cloud server, move the ...
0
votes
0answers
21 views

How generate a token for consumer with simple_oauth?

I'm searching how to generate a token with simple_oauth but I'm lost due the installation of our drupal. We're using the Headless Lightning distribution with JSON:API, consumers and simple oauth for a ...
0
votes
1answer
57 views

Node field not sanitize on render

I have a form for users who want to add new content on my Drupal 8 website. I render node field on a twig template : {{ node_field_title.value }} But field are not sanitized by Drupal. Is it the ...
0
votes
1answer
20 views

How to generate my own patches to update core for security when fuerstnet.de's “Drupal upgrade the easy way” page is out of date?

For Drupal 7, under the current host I'm using (which doesn't provide things like drush), I've found that patching is the easiest approach to updating core. However, the commonly-referenced page which ...
1
vote
1answer
16 views

Configuring Fail2ban for the r4032login module

Recently, I installed fail2ban on my server to help prevent bots from abusing the site. I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the ...
0
votes
0answers
40 views

Update Symfony before Drupal core?

Right now there are some security updates for Symfony: curl -sS https://get.symfony.com/cli/installer | bash echo y | ~/.symfony/bin/symfony self:update ~/.symfony/bin/symfony security:check Symfony ...
0
votes
0answers
22 views

766 security update database schema errors

After updating to 7.66 and running update.php i get an error: Class name must be a valid object or a string in /home/breastcancertiss/public_html/includes/common.inc on line 8066 I have 6 schema ...
0
votes
1answer
133 views

How to prevent Cross Site Scripting when input using “Full HTML” mode of CKEditor

I am using Drupal version 8.3.7 and ckeditor 4.11.3. I create a basic page contains some scripts as following: In the detail page, I can see that the script in onmouseover="alert('222222')" is ...
0
votes
0answers
20 views

Slideshow: Cgi Generic Command execution (time-based)

One of our customers received a notice from his PCI scan vendor that the requests in the MD_Slider module used by Views are not sanitized. The latest version is two years old and it could be correct. ...
0
votes
2answers
133 views

Where can we store 3rd party application passwords?

I've written a Drupal 8 custom module that communicates with 3rd party APIs which need authentication. I have an application username and password for those APIs which I need to store somewhere. I can ...
-1
votes
2answers
45 views

What does this error message mean?

My website is getting too slow. When I checked the journal entries, I found many errors like the following. What is it? What are they trying to do?
0
votes
1answer
117 views

Ajax form content security policy

Conversation around: how to set content-security-policy header read and noted https://www.drupal.org/project/csp (Drupal 8 only) mentioned unsafe-inline is mandatory for WYSIWYG edits to work. My ...
0
votes
0answers
23 views

Missing config/default directory error after patching the latest critical vulnerability

After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file. drupal/core from 8.5.8 to 8.5.11 drupal/jsonapi from 1.7 to ...
0
votes
0answers
62 views

Proper security for settings.php

I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
0
votes
0answers
69 views

itok triggering modsecurity injection 942100

When identifying false positives with my Drupal 7 site running ModSecurity CRS 3.1, I noticed visitors were getting denied access to a page because that page loaded an image using itok?= which had 2 --...
1
vote
0answers
57 views

Distribution Commerce Kickstart 1.x - is possbile run Drupal Core 7.61 / PHP 7.2 ? And how [closed]

I have small and very simple Drupal 7 site based on Commerce Kickstart 1.x distribution (originally instalation profile, now "distribution"). The version of distribution is 7.x-1.53. It is last ...
0
votes
1answer
57 views

Is it okay to expose .yml or .install files to public?

As per my knowledge the static files like css/js inside core/modules etc should be read by http server user. So normally I give read permission recursively to http user for directories like core, ...
0
votes
1answer
39 views

Is exposing the UID a security issue?

I noticed that the UID of users is exposed in the HTML code of a page on my site that authenticated users can access. Is it a problem if authenticated users with "view user profiles" permission are ...
5
votes
1answer
1k views

How is password hashing/encryption performed?

I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could. The class that performs password hashing in 8 is PhpassHashedPassword, based on https://www....
5
votes
2answers
362 views

Using modules “not covered by Drupal’s security advisory policy”

I would like to use a Drupal 7 module that is "not covered by Drupal’s security advisory policy", specifically the Conditional Fields module. It would allow me to do exactly what I need. It looks ...
0
votes
2answers
86 views

Security model and menu access

Drupal 8.6.1 I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc. ...
1
vote
3answers
85 views

How to place a role-aware “Add new” link at the top of a Views listing of media

I've created a view that provides a listing of a particular media type on my site. I'd like to place an "Add new" link at the top of this view and have it visible only to users who can actually add ...
0
votes
1answer
43 views

Update issue of Drupal 8.34

Currently, there is a security issue of Drupal CMS, I'm using Drupal version 8.3.4, does the version 8.3.9 can solve the security issue released on March 28th, 2018 PSA-2018-001 (core highly critical ...
4
votes
2answers
1k views

How critical is SA-CORE-2018-005?

The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability ...
0
votes
3answers
3k views

How to set up permissions for the private files directory?

I'm trying to set up the private files directory and I'm getting the following error. The backup file could not be saved to 'private://backup_migrate/' because the directory could not be created ...
0
votes
1answer
475 views

Drupal 8 secure session [closed]

In Drupal 8.5.X I see that the session cookie is only HTTPOnly and not secure. Any idea how to enforce the session cookie to be always secured?
3
votes
1answer
554 views

How is user input sanitized?

I had to develop a Drupal 8 based website for a client. This client has a quite strict configuration for its firewall and filters the characters used in POST values. It happens to be a bit too ...
0
votes
1answer
458 views

how to set content-security-policy header

I want to set Content-Security-Policy header in my site. I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.
0
votes
0answers
40 views

What's the best files and directories permission for shared hosting [duplicate]

i'm using a shared hosting for my Drupal Website and I'm having some security troubles especially with folders and files permissions. So after some researches in the official documentation and some ...
2
votes
2answers
30 views

Session API Security Advisory

I'm working on a website that is interested in adding chat features. I did some research, and ended up installing the DrupalChat module, and its dependencies. After configuring the module, I realized ...
-1
votes
1answer
83 views

Security issues with v7.59 [closed]

I have updated various Drupal 7 sites to version 7.59 (and included all relevant updates) because of the security update. However I've still experienced issues with sites being hacked, there were ...
0
votes
1answer
152 views

“Some files and directories in your install are writable by the server.”

I’m running a Drupal 8.5.3 site and the module: Security Review. One od the “red” results was: Some files and directories in your install are writable by the server. Details: “It is dangerous to ...
1
vote
2answers
630 views

Automatically block user that access /wp-login.php

Is it possible to block any users IP if they try to access a specific URL such as /wp-login.php page which does not exist on Drupal. Basically to automatically blacklist the user, for days or even ...
0
votes
2answers
34 views

Placing Drupal core/modules code outside public_html

I've been trying to improve my sites security as I build a Drupal 8 update for my page. One thing I've seen recently is keeping your core code outside the web accessible docroot folder. I've also ...
0
votes
1answer
41 views

How to always require email verification before accessing a page?

I have a custom page defined by hook_menu. I want signed in users to be required to verify their email every time they want to access it. The page will have buttons on it that would allow someone to ...
0
votes
1answer
810 views

Sites hacked across login pages [closed]

My Drupal 7 sites were hacked many times, and I find everytime some files created by the hackers. Even though I did the security update, that didn't prevent the hackers to access to the server. ...
0
votes
1answer
101 views

Has my site been compromised? [duplicate]

Edit apparently they belong in the includes folder, were they also are. could it be of any use for a hacker to have these two folders in the root? I've been checking my drupal site and noticed in the ...
1
vote
1answer
108 views

Is media-7.x-1.x vulnerable to SA-CONTRIB-2018-020

The Drupal Media module version 7.x-2.x contains a remote code execution vulnerability which was patched with: https://cgit.drupalcode.org/media/commit/?id=1cd77ffa9c2cf96d80b76d47318179a8a82f0d46 1....
2
votes
1answer
56 views

Is it safe to allow domain.com/username?

Are there any security risks if we create pathauto roule so that the user account pages are at domain.com/username
1
vote
1answer
157 views

Extended Audit logs

I am using Audit log module for Drupal 8.5. But it looks the audits are very limited - i.e it audits only user updates and node updates. Not for creating templates, changing configurations, changing ...
0
votes
1answer
18 views

How to add registry key verification step with the key being stored in another database

I am currently learning how to use Drupal through Udemy classes; I am a complete newbie. I am building a Drupal Website, for my personal development, and when someone wants to register to the ...
1
vote
1answer
90 views

What is the best way to update Drupal periodically using a cron job? [closed]

Previously I periodically updated Drupal sites by using a cron-job with a "drush up -y" script running every Wednesday 15,16,17,18,19,20,21,22 hours UTC. which is when "Security releases happen" ...