Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

-1
votes
0answers
18 views

One user account stuck on www.example.com/user [closed]

I have a problem where my admin account is stuck on our website "www.example.com/user" Any computer we use, it stills shows my admin account. I am on drupal 7.44. How can I log out from all access so ...
-2
votes
0answers
43 views

Why does Drupal keep saying security update needed after updating? [on hold]

I upgraded Drupal from 7.60 to 7.62, after the security announcement. After upgrading I ran drush cc all; drush rf to clear caches and refresh the update info. A couple of hours after doing that all ...
-2
votes
0answers
18 views

Can anyone please suggest any drupal contrib modules or suggest any custom hooks to implement the below password policies in drupal 8? [closed]

1.Apply a password dictionary and/or other checks to prevent users from selecting passwords that can be easily guessed. 2.Password change to be enforced or a reminder sent after 90 to 100 days, or ...
0
votes
0answers
17 views

itok triggering modsecurity injection 942100

When identifying false positives with my Drupal 7 site running ModSecurity CRS 3.1, I noticed visitors were getting denied access to a page because that page loaded an image using itok?= which had 2 --...
1
vote
0answers
26 views

Distribution Commerce Kickstart 1.x - is possbile run Drupal Core 7.61 / PHP 7.2 ? And how

I have small and very simple Drupal 7 site based on Commerce Kickstart 1.x distribution (originally instalation profile, now "distribution"). The version of distribution is 7.x-1.53. It is last ...
-3
votes
0answers
24 views

Why do I need any write permissions to modules and themes on production site?

I'm hosting several Drupal 7 Production sites on WHM\cPanel server. In Production I mean there is only content updates, no modules \ themes \ code get updates on this server. Occasionally some of ...
0
votes
2answers
35 views

Is it okay to expose .yml or .install files to public?

As per my knowledge the static files like css/js inside core/modules etc should be read by http server user. So normally I give read permission recursively to http user for directories like core, ...
0
votes
0answers
25 views

Is exposing the UID a security issue?

I noticed that the UID of users is exposed in the HTML code of a page on my site that authenticated users can access. Is it a problem if authenticated users with "view user profiles" permission are ...
4
votes
0answers
100 views

How is password hashing/encryption performed?

I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could. The class that performs password hashing in 8 is PhpassHashedPassword, based on https://www....
5
votes
2answers
161 views

Using modules “not covered by Drupal’s security advisory policy”

I would like to use a Drupal 7 module that is "not covered by Drupal’s security advisory policy", specifically the Conditional Fields module. It would allow me to do exactly what I need. It looks ...
0
votes
2answers
35 views

Security model and menu access

Drupal 8.6.1 I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc. ...
0
votes
0answers
15 views

Drush and Security kit module

Does exists the command in Drush which can setup Security module, something like this command: drush seckit --img-src:self,unsafe-inline? Thanks!
0
votes
2answers
27 views

How to place a role-aware “Add new” link at the top of a Views listing of media

I've created a view that provides a listing of a particular media type on my site. I'd like to place an "Add new" link at the top of this view and have it visible only to users who can actually add ...
0
votes
0answers
15 views

Malware, proper way of dealing [duplicate]

My Drupal 7 site was hacked. The malware, it seems, is based in the file a.jpg that is located in /sites/default/files. The file a.jpg contains this code: <?php error_reporting(0); ...
0
votes
1answer
37 views

Update issue of Drupal 8.34

Currently, there is a security issue of Drupal CMS, I'm using Drupal version 8.3.4, does the version 8.3.9 can solve the security issue released on March 28th, 2018 PSA-2018-001 (core highly critical ...
4
votes
2answers
1k views

How critical is SA-CORE-2018-005?

The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability ...
0
votes
4answers
1k views

How to set up permissions for the private files directory?

I'm trying to set up the private files directory and I'm getting the following error. The backup file could not be saved to 'private://backup_migrate/' because the directory could not be created ...
0
votes
0answers
15 views

public page on password protected site

I have a password protected site where I want unauthenticated users to access a public sign up page. where/how should permissions be provisioned to an anonymous users so that this works?
0
votes
1answer
148 views

Drupal 8 secure session [closed]

In Drupal 8.5.X I see that the session cookie is only HTTPOnly and not secure. Any idea how to enforce the session cookie to be always secured?
3
votes
1answer
213 views

How is user input sanitized?

I had to develop a Drupal 8 based website for a client. This client has a quite strict configuration for its firewall and filters the characters used in POST values. It happens to be a bit too ...
0
votes
0answers
100 views

how to set content-security-policy header

I want to set Content-Security-Policy header in my site. I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.
0
votes
0answers
31 views

What's the best files and directories permission for shared hosting [duplicate]

i'm using a shared hosting for my Drupal Website and I'm having some security troubles especially with folders and files permissions. So after some researches in the official documentation and some ...
2
votes
2answers
26 views

Session API Security Advisory

I'm working on a website that is interested in adding chat features. I did some research, and ended up installing the DrupalChat module, and its dependencies. After configuring the module, I realized ...
0
votes
0answers
26 views

Best way to destroy a password

I am building the following login system in Drupal 8. On register, new user account is created and email is sent. User clicks link in email, and sets their password as normal. But after the password ...
-1
votes
1answer
63 views

Security issues with v7.59 [closed]

I have updated various Drupal 7 sites to version 7.59 (and included all relevant updates) because of the security update. However I've still experienced issues with sites being hacked, there were ...
0
votes
0answers
19 views

drupal 7 malicious users get registered [duplicate]

I have a website in drupal 7, and have upgraded it to 7.59 for drupal security issue SA-CORE-2018-004 but somehow on 3rd may, i observed more than 1000 malicious uses created on site. malicious means ...
0
votes
1answer
77 views

“Some files and directories in your install are writable by the server.”

I’m running a Drupal 8.5.3 site and the module: Security Review. One od the “red” results was: Some files and directories in your install are writable by the server. Details: “It is dangerous to ...
1
vote
2answers
350 views

Automatically block user that access /wp-login.php

Is it possible to block any users IP if they try to access a specific URL such as /wp-login.php page which does not exist on Drupal. Basically to automatically blacklist the user, for days or even ...
0
votes
2answers
31 views

Placing Drupal core/modules code outside public_html

I've been trying to improve my sites security as I build a Drupal 8 update for my page. One thing I've seen recently is keeping your core code outside the web accessible docroot folder. I've also ...
0
votes
1answer
39 views

How to always require email verification before accessing a page?

I have a custom page defined by hook_menu. I want signed in users to be required to verify their email every time they want to access it. The page will have buttons on it that would allow someone to ...
0
votes
1answer
563 views

Sites hacked across login pages [closed]

My Drupal 7 sites were hacked many times, and I find everytime some files created by the hackers. Even though I did the security update, that didn't prevent the hackers to access to the server. ...
0
votes
1answer
86 views

Has my site been compromised? [duplicate]

Edit apparently they belong in the includes folder, were they also are. could it be of any use for a hacker to have these two folders in the root? I've been checking my drupal site and noticed in the ...
1
vote
1answer
98 views

Is media-7.x-1.x vulnerable to SA-CONTRIB-2018-020

The Drupal Media module version 7.x-2.x contains a remote code execution vulnerability which was patched with: https://cgit.drupalcode.org/media/commit/?id=1cd77ffa9c2cf96d80b76d47318179a8a82f0d46 1....
2
votes
1answer
44 views

Is it safe to allow domain.com/username?

Are there any security risks if we create pathauto roule so that the user account pages are at domain.com/username
1
vote
1answer
57 views

Extended Audit logs

I am using Audit log module for Drupal 8.5. But it looks the audits are very limited - i.e it audits only user updates and node updates. Not for creating templates, changing configurations, changing ...
0
votes
1answer
18 views

How to add registry key verification step with the key being stored in another database

I am currently learning how to use Drupal through Udemy classes; I am a complete newbie. I am building a Drupal Website, for my personal development, and when someone wants to register to the ...
1
vote
1answer
56 views

What is the best way to update Drupal periodically using a cron job? [closed]

Previously I periodically updated Drupal sites by using a cron-job with a "drush up -y" script running every Wednesday 15,16,17,18,19,20,21,22 hours UTC. which is when "Security releases happen" ...
0
votes
1answer
494 views

How do I check whether the patch for SA-CORE-2018-002 is applied?

How do I check whether the patch for SA-CORE-2018-002 is applied in a Drupal 7 website? I have applied the patch. How does it secure my Drupal websites?
0
votes
1answer
24 views

Custom Module Remote Fails Checksum with Drush

Background I have several proprietary Drupal modules that my company uses. We want to update these across all our sites. To that end, I've built an endpoint that produces code according to the (ill-...
10
votes
4answers
5k views

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 — 2018 March exploit?

Just released exploit: https://www.drupal.org/sa-core-2018-002 --- Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 How can I tell if someone used this exploit to hack my site?...
0
votes
0answers
42 views

What is the purpose of file_entity_allow_insecure_download variable of “File Entity” project

I found out the variable file_entity_allow_insecure_download in the File Entity (fieldable files) module which is not going to allow downloading a file if you access the /file/[:fid]/download?token=...
0
votes
1answer
24 views

what security measures should be taken when creating/updating/retrieving entities with data from users' form submissions?

We have webforms for authenticated users (anyone can create an account without admin approval) to fill out. With their submission data I'm using the civicrm_api to create contacts and relationships. ...
1
vote
2answers
103 views

Drupal 8 password retention

I am currently reviewing Drupal 8's security features and was wondering about how Drupal stores user passwords. I know Drupal uses salted hashes to store the password in the database, but does Drupal ...
0
votes
1answer
214 views

With enabling modsecurity_crs_41_sql_injection_attacks all submit form return forbidden 403

I installed and activated the module mod_security. then I enabled the modsecurity_crs_41_sql_injection_attacks.conf. For each form, when I submit, I have an error 403 forbidden Error log: [Wed Nov ...
1
vote
1answer
75 views

Drupal form_state sanitization

I'm new to Drupal and I am doing some module development for a Drupal 7 install. I've done development outside of Drupal and normally its best to always sanitize user input. I've seen different ...
1
vote
1answer
113 views

security kit module settings are blocking own site jQuery calls

I am using Security kit module to enhance security for my website. In that I have enabled Enable JavaScript + CSS + Noscript protection option. This setting is blocking one of Jquery call that is ....
2
votes
3answers
270 views

How to securely authenticate content embeded in another site?

I need to embed password protected content to a second domain with an iframe. The content itself is a view which will be displayed on a third party site via an iframe and the content is prepared with ...
1
vote
1answer
215 views

How to determine the code for settings.php config override based on .yml?

I am trying to put my API keys in a separate file instead of storing them in config management. For example, I installed the Commerce Stripe module. When I export the config, it looks like this: ...
0
votes
0answers
51 views

(Answered) Ajax link for anonymous users to delete node they created if $_SESSION exists. Is node's created timestamp secure enough in link?

I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away. Instead of forcing them to create an account and take ...
0
votes
0answers
17 views

Drupal Captcha Module Security update Problems [duplicate]

Running Drupal 7.56, PHP 5.6. Got a notice that I should update Captcha module and whenever I try to download it, it throws the error: HTTP error 0 occurred when trying to fetch https://ftp.drupal....