Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
0 votes
1 answer
42 views

SQL injection POST attacks

Just found hundreds of POST requests to user registration pages on Drupal site. No users are being registered but these requests are still getting 200 status from Drupal. Are these requests doing any ...
JM John's user avatar
0 votes
1 answer
45 views

Modules are not updating to the latest version

I have some websites in the drupal. I need to update the security modules in the old version to the latest version. The list of security modules I tried to attempt is as below 1)colorbox (current - v2....
jayaprakash R's user avatar
2 votes
1 answer
45 views

After any Composer command, does Composer or core set (or harden) the file permissions?

After any Composer command (for example, composer create-project, composer require, and composer update), does Composer or Drupal set (or harden) the file permissions?
tahaniau's user avatar
1 vote
2 answers
46 views

How can I prevent a page with PHP content getting flagged in Security Review "Dangerous tags in content" check?

I am using Drupal 7. I have a page that has a PHP body that I know does not have any dangerous tags. According to the README.txt file in Security Review I need to add this to the "...
MrSnrub's user avatar
  • 291
1 vote
2 answers
155 views

How can I control node access based on entity reference to multiple users

I have multiple uses for this functionality now but mainly for a private message system. What I want to do: Configure a content type with an entity reference to users Create nodes of that type and ...
aharown07's user avatar
  • 323
0 votes
1 answer
108 views

Getting error "PHP files in the Drupal files directory can be executed." in Security Review v.7.x-1.3

I am on Drupal 7.92. When I run Security Review I get the error "PHP files in the Drupal files directory can be executed." in Security Review v.7.x-1.3. The sites/default/files directory is ...
MrSnrub's user avatar
  • 291
1 vote
2 answers
224 views

refresh form_token with refresh page

Unfortunately, the form_token does not change when I refresh the form pages. Doesn't this cause abuse and security risks? Can anyone explain what Drupal does for CSRF in all its forms? Thanks
reza's user avatar
  • 61
1 vote
2 answers
164 views

How can I encrypt user-submitted content per user for a content type?

Let's say I have a website where people keep a personal diary (diary content type). I have configured permissions so that each user can only read, write, and view his/her own diary. Users can create ...
Patrick Kenny's user avatar
1 vote
2 answers
85 views

security updates reported but not actually available (recommended==installed)

I installed Drupal 9.3.6. At /admin/reports/status, I see the error: There are security updates available for one or more of your modules or themes and at /admin/modules/update, two modules are ...
jhnc's user avatar
  • 149
1 vote
1 answer
122 views

Drupal Commerce Product Variation SQL Injection Vulnerability

A PCI scan on my site is saying that there is a SQL Injection vulnerability. But where it seems to be indicating it is on pretty basic Commerce functionality. When visiting a product variation page ...
Delford Chaffin's user avatar
1 vote
0 answers
98 views

How can I allow users to change their email addresses without a password with JSON:API?

I have an Ionic React app and I want to allow users to change their email addresses. However, when I try to change the email address in a PATCH request, I get the following error: { "jsonapi&...
Patrick Kenny's user avatar
1 vote
1 answer
393 views

Is it a valid approach to have a different CSP based on login state and browser?

I'm currently working on improving the security of a Drupal 8 site by implementing a Content Security Policy. As this is still new to me, I would like to get some input on my strategy. Relevant base ...
berliner's user avatar
  • 2,810
2 votes
2 answers
204 views

Do I need the trusted host setting?

Do I need the trusted host setting for a Drupal 7 site? If so how do I configure it? I noticed that Backdrop CMS has it in their settings file.
trazom's user avatar
  • 31
1 vote
0 answers
68 views

For which tables should the MariaDB user have CRUD permissions for browsing the site?

I'm trying to lock down the database on my Drupal 9 install so that people can browse the website, but can't write to it. I have 2 users in MariaDB with access to the database. I want to set one ...
blur's user avatar
  • 57
1 vote
1 answer
104 views

Do I need to set up public files directory for multi-sites differently?

I had some Drupal installations which I merged into a multi-site installation. When they were single installations, I created a files in the root directory and set the system permissions for the ...
Berry Dingle's user avatar
1 vote
0 answers
25 views

What is the specific security implication with the permission "Select method for cancelling account"

Below the permission "Select method for cancelling account" there is the following hint: Warning: Give to trusted roles only; this permission has security implications. I understand that ...
Philipp Zedler's user avatar
0 votes
1 answer
245 views

Does the login-link users receive upon registration actually expire?

I'm trying to expand the duration for the expiration of the one-time-login for the initial registration process: the user clicks on "create new account" after filling name and email and ...
Volker's user avatar
  • 1,360
0 votes
3 answers
248 views

Use read-only database user to minimize security risks

I want to phase out an old, unmaintained Drupal 6 page. The website should still stay online, but should be read-only. I want to change the database user so that it only has read privileges. I don't ...
Harold L. Brown's user avatar
0 votes
1 answer
320 views

How to restrict access to specific php file to only athenticated users

I manually made a php file that has the ability to connect to the database and create table entries, it works fine, but now the problem is that if I leave it there, anyone will be able to access it to ...
julianx2rl's user avatar
0 votes
1 answer
318 views

403 Error - Unable to create Paragraphs via REST with ?_format=hal_json

Trying to add paragraphs via REST to the earlier created node. I've installed the Paragraphs Type Permissions module, enabled the following permissions for my REST user's role Text: Create content ...
Vladimir P.'s user avatar
1 vote
0 answers
88 views

Database password revealed in PHP error_log?

Noticed some errors while updating to Drupal 8.9.11. As I'm reviewing I come across the following. Replaced the actual password with PASSWORD below. Is this intentional or a bug? I can't see why the ...
Jeff's user avatar
  • 93
1 vote
2 answers
1k views

How do I hide the core version to the outside world?

I was bothered in knowing with whatcms.org a version can be given for drupal 8, even a minor version - no minor version, instead, when I tried with a drupal 7. Curiously enough in my case, I got a ...
AppLEaDaY's user avatar
0 votes
1 answer
332 views

Why am I getting an error message in my dashboard for unprotected private files?

I have a site with Drupal 8.9 Why am I getting an error message in my dashboard for unprotected private files ? When I go to the link it says this is for Drupal 6 and 7. PRIVATE FILES DIRECTORY Not ...
sdfff's user avatar
  • 61
0 votes
2 answers
456 views

Sanitization of the q parameter

I'm using Drupal 7. My question regards the sanitization of the "q" parameter. We know about SQL injection, so I was wondering if this parameter may be a vector for this kind of security ...
lastYorsh's user avatar
  • 201
0 votes
1 answer
73 views

What's The Security Implications for "Send arbitrary files" in Permissions

For my webforms, I want to receive attachments, when I receive an email. I had issues receiving them until I set the permissions for Anonymous User to allow them to use "Send arbitrary files"...
MetalBearSolid's user avatar
1 vote
0 answers
55 views

Decoupled Drupal - Security [closed]

I am running a Drupal 8.9.2 site as a content repository accessed via an Angular 8 app. So there is one administrator who uses the Drupal interface to write content / upload files eccc.... and ...
elenat82's user avatar
1 vote
2 answers
1k views

Error: Private files directory not fully protected

I received the following error in my Drupal 8 status report: PRIVATE FILES DIRECTORY Not fully protected See https://www.drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess ...
glenviewjeff's user avatar
0 votes
1 answer
354 views

Understanding the Basic Context of Trusted Hosts [duplicate]

I got the trusted host settings error. The trusted_host_patterns setting is not configured in settings.php. This can lead to security vulnerabilities. It is highly recommended that you configure ...
glenviewjeff's user avatar
1 vote
1 answer
43 views

How do I implement access checks based on referring nodes in the grants system?

Following a suggestion in another thread here I'm trying to rewrite the access restrictions that I developed using hook_node_access (and that are working well, so far) in Drupal's grant system (i.e. ...
Marcus C.'s user avatar
  • 279
0 votes
0 answers
64 views

Error when updating 8.7.12 to 8.8.5 [duplicate]

When I update my 8.7.12 site to 8.8.5 I get the following error: Fatal error: Uncaught Error: Call to undefined method Drupal\Core\Installer\InstallerKernel::installationAttempted() in /usr/www/...
Libby's user avatar
  • 1
0 votes
0 answers
66 views

Security review: Some files and directories in your install are writable by the server

I am running Drupal 8 on a vps running latest ispconfig/apache fastCGI. Security review module reports: "Some files and directories in your install are writable by the server." and basically lists ...
Morten's user avatar
  • 91
2 votes
1 answer
175 views

Is 8.6.18 insecure? Will there be 8.6.19 etc.?

I have a custom module that I think requires Drupal 8.6.x. Is Drupal core 8.6.18 insecure? Will more 8.6.x versions be released?
qräbnö's user avatar
  • 141
1 vote
1 answer
67 views

MYSQL injections: Are they a threat?

For a while now, all my Drupal 7 and Drupal 8 instances have been under constant attack from South America or Asia, where the attacker is trying to infiltrate Drupal with MySQL injections. The ...
user5950's user avatar
  • 2,008
0 votes
1 answer
50 views

Make a password security check for the register form

I have a register form that is output in a controller using the following code. $form = $this->getUserProfileForm(); return [ '#theme' => 'maubl_user_inscription', '#form' =&...
StefanYYC's user avatar
0 votes
1 answer
116 views

What is x-speed-cache-key? What is its purpose?

Our drupal site was pentested. The pentest report labeled an action involving the header X-Speed-Cache-Key as a security concern. The finding stated: Arbitrary parameters supplied to the query ...
Paul's user avatar
  • 11
0 votes
1 answer
419 views

The security danger of publicly exposing an upload field

On older drupal 7 websites I once faced security patches for the webform module, because file upload fields were considered insecure. There was en exploit where people could end up uploading .html ...
Stef Van Looveren's user avatar
0 votes
0 answers
61 views

Drupal and security hardening - PHP chmod

I am struggling with the following case with Drupal and PHP hardening on an Red Hat Linux infrastructure. For drupal installation a user has been created. All the files and directories are owned by ...
GeralexGR's user avatar
  • 101
4 votes
1 answer
440 views

Drush or Drupal console command to list modules with security updates?

Is there a command for Drupal 8.x that shows available updates? I added forms_steps 1.1 that has an SA and a security update required in the Web UI, which is saying to update to 1.2 I tried drush pm:...
Eric B.'s user avatar
  • 193
0 votes
1 answer
2k views

fix-permissions.sh for Drupal 8

With Drupal 7, when I upload a project from local to server, I usually run fix-permisions shell script to change owner and permissions of folder/files. Is provided in : https://www.drupal.org/node/...
maiky_forrester's user avatar
0 votes
1 answer
29 views

How can I import a local database remotely without having a local database copy?

I am working on database security and with using Drupal we have daily backups from a cloud server which we access remotely. What I normally do is grab a daily DB copy from the cloud server, move the ...
Shawn's user avatar
  • 397
0 votes
1 answer
81 views

Node field not sanitize on render

I have a form for users who want to add new content on my Drupal 8 website. I render node field on a twig template : {{ node_field_title.value }} But field are not sanitized by Drupal. Is it the ...
Romain's user avatar
  • 3
0 votes
1 answer
56 views

How to generate my own patches to update core for security when fuerstnet.de's "Drupal upgrade the easy way" page is out of date?

For Drupal 7, under the current host I'm using (which doesn't provide things like drush), I've found that patching is the easiest approach to updating core. However, the commonly-referenced page which ...
koyae's user avatar
  • 181
1 vote
1 answer
26 views

Configuring Fail2ban for the r4032login module

Recently, I installed fail2ban on my server to help prevent bots from abusing the site. I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the ...
pmagunia's user avatar
  • 637
0 votes
1 answer
649 views

How to prevent Cross Site Scripting when input using "Full HTML" mode of CKEditor

I am using Drupal version 8.3.7 and ckeditor 4.11.3. I create a basic page contains some scripts as following: In the detail page, I can see that the script in onmouseover="alert('222222')" is ...
Tai Nguyen's user avatar
1 vote
2 answers
796 views

Where can we store 3rd party application passwords?

I've written a Drupal 8 custom module that communicates with 3rd party APIs which need authentication. I have an application username and password for those APIs which I need to store somewhere. I can ...
Martin Borugadda's user avatar
-1 votes
2 answers
53 views

What does this error message mean?

My website is getting too slow. When I checked the journal entries, I found many errors like the following. What is it? What are they trying to do?
mohammed amine bourkadi's user avatar
0 votes
1 answer
702 views

Ajax form content security policy

Conversation around: how to set content-security-policy header read and noted https://www.drupal.org/project/csp (Drupal 8 only) mentioned unsafe-inline is mandatory for WYSIWYG edits to work. My ...
JohnFF's user avatar
  • 53
0 votes
0 answers
52 views

Missing config/default directory error after patching the latest critical vulnerability

After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file. drupal/core from 8.5.8 to 8.5.11 drupal/jsonapi from 1.7 to ...
The Unknown Dev's user avatar
0 votes
0 answers
285 views

Proper security for settings.php

I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
GraphicsMuncher's user avatar
1 vote
0 answers
77 views

Distribution Commerce Kickstart 1.x - is possbile run Drupal Core 7.61 / PHP 7.2 ? And how [closed]

I have small and very simple Drupal 7 site based on Commerce Kickstart 1.x distribution (originally instalation profile, now "distribution"). The version of distribution is 7.x-1.53. It is last ...
Jii's user avatar
  • 11

1
2 3 4 5
9