Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
0
votes
1answer
23 views

The security danger of publicly exposing an upload field

On older drupal 7 websites I once faced security patches for the webform module, because file upload fields were considered insecure. There was en exploit where people could end up uploading .html ...
4
votes
1answer
56 views

Drush or Drupal console command to list modules with security updates?

Is there a command for Drupal 8.x that shows available updates? I added forms_steps 1.1 that has and SA and a security update required in the Web UI which is saying to update to 1.2 I tried drush pm:...
0
votes
0answers
25 views

Drupal and security hardening - PHP chmod

I am struggling with the following case with Drupal and PHP hardening on an Red Hat Linux infrastructure. For drupal installation a user has been created. All the files and directories are owned by ...
0
votes
0answers
33 views

Phar not working in Drupal 8

If I try to use a simple Phar call in my controller: $tar = new \PharData('/path/to/myTar.tar'); I get the error: "Unexpected file extension" This is because Drupal Security checks to see if the ...
-2
votes
1answer
47 views

fix-permissions.sh for Drupal 8

With Drupal 7, when I upload a project from local to server, I usually run fix-permisions shell script to change owner and permissions of folder/files. Is provided in : https://www.drupal.org/node/...
96
votes
7answers
14k views

What are the downsides of using PHP Filter code in blocks, nodes, views-args, etc?

I have seen many times people saying not to use custom PHP/PHP filter (from the Drupal UI) in blocks, nodes, views-args, rules, etc. I have searched around a bit and haven't found much, it seems like ...
0
votes
1answer
12 views

How can I import a local database remotely without having a local database copy?

I am working on database security and with using Drupal we have daily backups from a cloud server which we access remotely. What I normally do is grab a daily DB copy from the cloud server, move the ...
0
votes
3answers
400 views

How to automatically put your site into maintenance mode if at least a critical security update is available?

I think I'm craving for this functionality. What I want is, if after a CRON run, Drupal detects that such a security update is available, the site would be taken down for maintenance mode to avoid ...
0
votes
0answers
49 views

What are the appropriate file security settings and Apache settings for Drupal sites running on a VPS?

I would be grateful for some help on this one - I have looked at the other posts on this subject with interest, but they don't seem quite to fit my situation. I'm not a great Unix expert, but there ...
0
votes
1answer
351 views

SA-CORE-2013-003 - Files directory Not fully protected

I'm using Pressflow 6.38 and I'm trying to implement SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities | Drupal.org inside of /etc/httpd/conf.d/pressflow.conf configuration file, like ...
0
votes
0answers
21 views

How generate a token for consumer with simple_oauth?

I'm searching how to generate a token with simple_oauth but I'm lost due the installation of our drupal. We're using the Headless Lightning distribution with JSON:API, consumers and simple oauth for a ...
1
vote
1answer
401 views

What to do for “Login attempt failed for admin.” and “Access denied” to path admin?

In Watchdog, I started seeing several entries like this: Login attempt failed for admin. And access denied 2016/04/04 - 15:06 admin These are generating a fair number of log entries. The IP ...
0
votes
1answer
467 views

Permanent Cookie Contains Sensitive Session Information [closed]

I have a cookie question in regards to a security scan (via IBM Rational AppScan) conducted on a drupal(7.43) site. The security scan failed with the following error: (Permanent Cookie Contains ...
1
vote
0answers
21 views

Any security issues accessing $_POST and returning values from it in AJAX commands?

Just wondering if there needs to be any sanitization here: /** * Implements hook_ajax_render_alter(). */ function my_module_ajax_render_alter(&$commands) { if (isset($_POST['...
145
votes
11answers
186k views

What are the recommended directory permissions?

I'm gearing up to deploy a Drupal 7 site and I can't find any documentation about what the recommended security-conscious file and directory permissions should be set to. Specifically default/files/ (...
1
vote
1answer
16 views

Configuring Fail2ban for the r4032login module

Recently, I installed fail2ban on my server to help prevent bots from abusing the site. I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the ...
0
votes
1answer
55 views

Node field not sanitize on render

I have a form for users who want to add new content on my Drupal 8 website. I render node field on a twig template : {{ node_field_title.value }} But field are not sanitized by Drupal. Is it the ...
2
votes
2answers
2k views

Drupal Database Encryption

I am seriously looking for a solution to encrypt at least some of the tables in my Drupal 7 database. I'm totally suspicious about my hosting providers, I really don't want my user's data and also my ...
5
votes
5answers
5k views

Remove the X-generator header from the response

I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header. I am using the following code, but it removes the x-...
2
votes
1answer
376 views

Is there any security consideration with webform and Salesforce API?

We are implementing the Salesforce webform module for our client and they are asking us if there are any security issues to consider by having SOAP installed on their server. (The Salesforce API ...
0
votes
1answer
18 views

How to generate my own patches to update core for security when fuerstnet.de's “Drupal upgrade the easy way” page is out of date?

For Drupal 7, under the current host I'm using (which doesn't provide things like drush), I've found that patching is the easiest approach to updating core. However, the commonly-referenced page which ...
1
vote
3answers
82 views

How to place a role-aware “Add new” link at the top of a Views listing of media

I've created a view that provides a listing of a particular media type on my site. I'd like to place an "Add new" link at the top of this view and have it visible only to users who can actually add ...
0
votes
0answers
40 views

Update Symfony before Drupal core?

Right now there are some security updates for Symfony: curl -sS https://get.symfony.com/cli/installer | bash echo y | ~/.symfony/bin/symfony self:update ~/.symfony/bin/symfony security:check Symfony ...
0
votes
0answers
22 views

766 security update database schema errors

After updating to 7.66 and running update.php i get an error: Class name must be a valid object or a string in /home/breastcancertiss/public_html/includes/common.inc on line 8066 I have 6 schema ...
0
votes
1answer
123 views

How to prevent Cross Site Scripting when input using “Full HTML” mode of CKEditor

I am using Drupal version 8.3.7 and ckeditor 4.11.3. I create a basic page contains some scripts as following: In the detail page, I can see that the script in onmouseover="alert('222222')" is ...
0
votes
0answers
20 views

Slideshow: Cgi Generic Command execution (time-based)

One of our customers received a notice from his PCI scan vendor that the requests in the MD_Slider module used by Views are not sanitized. The latest version is two years old and it could be correct. ...
0
votes
2answers
123 views

Where can we store 3rd party application passwords?

I've written a Drupal 8 custom module that communicates with 3rd party APIs which need authentication. I have an application username and password for those APIs which I need to store somewhere. I can ...
0
votes
1answer
99 views

Ajax form content security policy

Conversation around: how to set content-security-policy header read and noted https://www.drupal.org/project/csp (Drupal 8 only) mentioned unsafe-inline is mandatory for WYSIWYG edits to work. My ...
-1
votes
2answers
44 views

What does this error message mean?

My website is getting too slow. When I checked the journal entries, I found many errors like the following. What is it? What are they trying to do?
1
vote
1answer
375 views

Security issues while using external javascript and php files to access mysql database in drupal nodes

I have created a search_interface node which asks for filters and onClick event of the submit button, I have called an external search.js script. My search_interface node is of a custom content type ...
0
votes
1answer
38 views

Is exposing the UID a security issue?

I noticed that the UID of users is exposed in the HTML code of a page on my site that authenticated users can access. Is it a problem if authenticated users with "view user profiles" permission are ...
0
votes
1answer
460 views

Drupal & Wordpress User Integration

I know I might be asking a really dumb and likely complex matter, but it's the only remotely easy option I have at the moment. Due to what is set up on two systems by my predecessor, wordpress and ...
0
votes
3answers
1k views

How can I break into my own Drupal site?

I was doing a Media module tutorial. Half way through it I decided to install the tutorial companion files and foolishly replaced my files. In the companions readme it says the admin login is username ...
5
votes
1answer
1k views

How is password hashing/encryption performed?

I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could. The class that performs password hashing in 8 is PhpassHashedPassword, based on https://www....
2
votes
3answers
1k views

How to remove malicious scripts from admin pages after being hacked?

The site running Drupal 7 was hacked and every administration page, e.g. http://www.anysite.com/en/admin/dashboard contains script tag in head section with malicious src attribute, e.g. <head>...
2
votes
2answers
2k views

How do I set the private file system path's permissions?

There is an option in Configuration > File system which let you define a path for private files. After setting a path in this field, the access for all users is restricted (including admin). I need ...
0
votes
0answers
23 views

Missing config/default directory error after patching the latest critical vulnerability

After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file. drupal/core from 8.5.8 to 8.5.11 drupal/jsonapi from 1.7 to ...
1
vote
7answers
8k views

Insecure content warning with D7 and SSL

I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome ...
0
votes
1answer
1k views

Is there a risk of having xmlrpc.php on my site?

I recently noticed that all of my sites have the file xmlrpc.php. Searching it led me to "Gain Control of WordPress by Exploiting XML-RPC", and also to "Drupal Core - Critical - Multiple ...
1
vote
1answer
148 views

Extended Audit logs

I am using Audit log module for Drupal 8.5. But it looks the audits are very limited - i.e it audits only user updates and node updates. Not for creating templates, changing configurations, changing ...
4
votes
3answers
689 views

How can I stop Drupal from tracking or collecting IP addresses?

Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (...
0
votes
1answer
425 views

how to set content-security-policy header

I want to set Content-Security-Policy header in my site. I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.
0
votes
1answer
57 views

Is it okay to expose .yml or .install files to public?

As per my knowledge the static files like css/js inside core/modules etc should be read by http server user. So normally I give read permission recursively to http user for directories like core, ...
0
votes
0answers
59 views

Proper security for settings.php

I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
0
votes
0answers
66 views

itok triggering modsecurity injection 942100

When identifying false positives with my Drupal 7 site running ModSecurity CRS 3.1, I noticed visitors were getting denied access to a page because that page loaded an image using itok?= which had 2 --...
1
vote
0answers
56 views

Distribution Commerce Kickstart 1.x - is possbile run Drupal Core 7.61 / PHP 7.2 ? And how [closed]

I have small and very simple Drupal 7 site based on Commerce Kickstart 1.x distribution (originally instalation profile, now "distribution"). The version of distribution is 7.x-1.53. It is last ...
0
votes
1answer
454 views

Drupal 8 secure session [closed]

In Drupal 8.5.X I see that the session cookie is only HTTPOnly and not secure. Any idea how to enforce the session cookie to be always secured?
5
votes
2answers
346 views

Using modules “not covered by Drupal’s security advisory policy”

I would like to use a Drupal 7 module that is "not covered by Drupal’s security advisory policy", specifically the Conditional Fields module. It would allow me to do exactly what I need. It looks ...
0
votes
2answers
85 views

Security model and menu access

Drupal 8.6.1 I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc. ...
0
votes
1answer
2k views

How to prevent applications from uncovering the technologies used on the website [closed]

Here is a super hard question, probably for the most experienced people: Can we prevent applications from uncovering the technologies we are using. We all know that making sure to keep the core and ...