Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

-1
votes
0answers
28 views

How to identify vulnerabilities? [on hold]

I work for Global Pepsico IT and we are trying to add CMS vulnerability detection to our arsenal of vulnerability testing. So far, we haven't been able to find a way to do this detection for drupal ...
5
votes
5answers
4k views

Remove the X-generator header from the response

I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header. I am using the following code, but it removes the x-...
2
votes
2answers
2k views

Drupal Database Encryption

I am seriously looking for a solution to encrypt at least some of the tables in my Drupal 7 database. I'm totally suspicious about my hosting providers, I really don't want my user's data and also my ...
-1
votes
0answers
7 views

Installing security updates on Drupal 7.3.4 hosted on Windows 2012 R2 IIS 8.0

I am brand new to Drupal. I have noticed that there are security updates avaialble for my version. When I select the first item requiring an update and select download I get the following error HTTP ...
2
votes
1answer
376 views

Is there any security consideration with webform and Salesforce API?

We are implementing the Salesforce webform module for our client and they are asking us if there are any security issues to consider by having SOAP installed on their server. (The Salesforce API ...
0
votes
1answer
12 views

How to generate my own patches to update core for security when fuerstnet.de's “Drupal upgrade the easy way” page is out of date?

For Drupal 7, under the current host I'm using (which doesn't provide things like drush), I've found that patching is the easiest approach to updating core. However, the commonly-referenced page which ...
1
vote
1answer
10 views

Configuring Fail2ban for the r4032login module

Recently, I installed fail2ban on my server to help prevent bots from abusing the site. I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the ...
1
vote
3answers
51 views

How to place a role-aware “Add new” link at the top of a Views listing of media

I've created a view that provides a listing of a particular media type on my site. I'd like to place an "Add new" link at the top of this view and have it visible only to users who can actually add ...
0
votes
0answers
28 views

Update Symfony before Drupal core?

Right now there are some security updates for Symfony: curl -sS https://get.symfony.com/cli/installer | bash echo y | ~/.symfony/bin/symfony self:update ~/.symfony/bin/symfony security:check Symfony ...
0
votes
0answers
20 views

766 security update database schema errors

After updating to 7.66 and running update.php i get an error: Class name must be a valid object or a string in /home/breastcancertiss/public_html/includes/common.inc on line 8066 I have 6 schema ...
0
votes
1answer
107 views

How to prevent Cross Site Scripting when input using “Full HTML” mode of CKEditor

I am using Drupal version 8.3.7 and ckeditor 4.11.3. I create a basic page contains some scripts as following: In the detail page, I can see that the script in onmouseover="alert('222222')" is ...
0
votes
3answers
384 views

How to automatically put your site into maintenance mode if at least a critical security update is available?

I think I'm craving for this functionality. What I want is, if after a CRON run, Drupal detects that such a security update is available, the site would be taken down for maintenance mode to avoid ...
0
votes
0answers
17 views

Slideshow: Cgi Generic Command execution (time-based)

One of our customers received a notice from his PCI scan vendor that the requests in the MD_Slider module used by Views are not sanitized. The latest version is two years old and it could be correct. ...
0
votes
2answers
62 views

Where can we store 3rd party application passwords?

I've written a Drupal 8 custom module that communicates with 3rd party APIs which need authentication. I have an application username and password for those APIs which I need to store somewhere. I can ...
0
votes
1answer
37 views

Ajax form content security policy

Conversation around: how to set content-security-policy header read and noted https://www.drupal.org/project/csp (Drupal 8 only) mentioned unsafe-inline is mandatory for WYSIWYG edits to work. My ...
1
vote
1answer
364 views

What to do for “Login attempt failed for admin.” and “Access denied” to path admin?

In Watchdog, I started seeing several entries like this: Login attempt failed for admin. And access denied 2016/04/04 - 15:06 admin These are generating a fair number of log entries. The IP ...
-1
votes
2answers
44 views

What does this error message mean?

My website is getting too slow. When I checked the journal entries, I found many errors like the following. What is it? What are they trying to do?
1
vote
1answer
373 views

Security issues while using external javascript and php files to access mysql database in drupal nodes

I have created a search_interface node which asks for filters and onClick event of the submit button, I have called an external search.js script. My search_interface node is of a custom content type ...
0
votes
1answer
34 views

Is exposing the UID a security issue?

I noticed that the UID of users is exposed in the HTML code of a page on my site that authenticated users can access. Is it a problem if authenticated users with "view user profiles" permission are ...
0
votes
1answer
425 views

Drupal & Wordpress User Integration

I know I might be asking a really dumb and likely complex matter, but it's the only remotely easy option I have at the moment. Due to what is set up on two systems by my predecessor, wordpress and ...
0
votes
3answers
1k views

How can I break into my own Drupal site?

I was doing a Media module tutorial. Half way through it I decided to install the tutorial companion files and foolishly replaced my files. In the companions readme it says the admin login is username ...
5
votes
1answer
524 views

How is password hashing/encryption performed?

I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could. The class that performs password hashing in 8 is PhpassHashedPassword, based on https://www....
2
votes
3answers
1k views

How to remove malicious scripts from admin pages after being hacked?

The site running Drupal 7 was hacked and every administration page, e.g. http://www.anysite.com/en/admin/dashboard contains script tag in head section with malicious src attribute, e.g. <head>...
2
votes
2answers
2k views

How do I set the private file system path's permissions?

There is an option in Configuration > File system which let you define a path for private files. After setting a path in this field, the access for all users is restricted (including admin). I need ...
0
votes
0answers
21 views

Missing config/default directory error after patching the latest critical vulnerability

After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file. drupal/core from 8.5.8 to 8.5.11 drupal/jsonapi from 1.7 to ...
1
vote
7answers
7k views

Insecure content warning with D7 and SSL

I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome ...
0
votes
1answer
1k views

Is there a risk of having xmlrpc.php on my site?

I recently noticed that all of my sites have the file xmlrpc.php. Searching it led me to "Gain Control of WordPress by Exploiting XML-RPC", and also to "Drupal Core - Critical - Multiple ...
1
vote
1answer
102 views

Extended Audit logs

I am using Audit log module for Drupal 8.5. But it looks the audits are very limited - i.e it audits only user updates and node updates. Not for creating templates, changing configurations, changing ...
4
votes
3answers
635 views

How can I stop Drupal from tracking or collecting IP addresses?

Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (...
5
votes
1answer
578 views

What should I set my Content-Security-Policy to?

I'm using Drupal 8, and I currently use Header always set Content-Security-Policy "default-src 'self'; nosniff" However, this causes bugs, such as Google Analytics not working and the textbox ...
0
votes
1answer
219 views

how to set content-security-policy header

I want to set Content-Security-Policy header in my site. I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.
0
votes
2answers
53 views

Is it okay to expose .yml or .install files to public?

As per my knowledge the static files like css/js inside core/modules etc should be read by http server user. So normally I give read permission recursively to http user for directories like core, ...
0
votes
0answers
48 views

Proper security for settings.php

I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
0
votes
0answers
51 views

itok triggering modsecurity injection 942100

When identifying false positives with my Drupal 7 site running ModSecurity CRS 3.1, I noticed visitors were getting denied access to a page because that page loaded an image using itok?= which had 2 --...
1
vote
0answers
47 views

Distribution Commerce Kickstart 1.x - is possbile run Drupal Core 7.61 / PHP 7.2 ? And how [closed]

I have small and very simple Drupal 7 site based on Commerce Kickstart 1.x distribution (originally instalation profile, now "distribution"). The version of distribution is 7.x-1.53. It is last ...
0
votes
1answer
291 views

Drupal 8 secure session [closed]

In Drupal 8.5.X I see that the session cookie is only HTTPOnly and not secure. Any idea how to enforce the session cookie to be always secured?
5
votes
2answers
246 views

Using modules “not covered by Drupal’s security advisory policy”

I would like to use a Drupal 7 module that is "not covered by Drupal’s security advisory policy", specifically the Conditional Fields module. It would allow me to do exactly what I need. It looks ...
0
votes
2answers
61 views

Security model and menu access

Drupal 8.6.1 I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc. ...
0
votes
1answer
1k views

How to prevent applications from uncovering the technologies used on the website [closed]

Here is a super hard question, probably for the most experienced people: Can we prevent applications from uncovering the technologies we are using. We all know that making sure to keep the core and ...
1
vote
1answer
68 views

What is the best way to update Drupal periodically using a cron job? [closed]

Previously I periodically updated Drupal sites by using a cron-job with a "drush up -y" script running every Wednesday 15,16,17,18,19,20,21,22 hours UTC. which is when "Security releases happen" ...
1
vote
1answer
183 views

security kit module settings are blocking own site jQuery calls

I am using Security kit module to enhance security for my website. In that I have enabled Enable JavaScript + CSS + Noscript protection option. This setting is blocking one of Jquery call that is ....
0
votes
1answer
42 views

Update issue of Drupal 8.34

Currently, there is a security issue of Drupal CMS, I'm using Drupal version 8.3.4, does the version 8.3.9 can solve the security issue released on March 28th, 2018 PSA-2018-001 (core highly critical ...
4
votes
2answers
1k views

How critical is SA-CORE-2018-005?

The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability ...
0
votes
4answers
2k views

How to set up permissions for the private files directory?

I'm trying to set up the private files directory and I'm getting the following error. The backup file could not be saved to 'private://backup_migrate/' because the directory could not be created ...
0
votes
0answers
334 views

Basic authentication for external application making requests to Drupal instance

I have a external application that makes requests for content in my Drupal 8 instance. What I want to do is to make sure Drupal is only talking go my external application to stop traffic being spoofed....
0
votes
0answers
16 views

public page on password protected site

I have a password protected site where I want unauthenticated users to access a public sign up page. where/how should permissions be provisioned to an anonymous users so that this works?
3
votes
5answers
3k views

How secure are variable_get and variable_set?

I have a custom module that saves variables with FTP usernames and passwords. Is variable_get secure? Ie. Can it be accessed outside of the module. Is variable_set equally secure? Obviously they are ...
3
votes
1answer
383 views

How is user input sanitized?

I had to develop a Drupal 8 based website for a client. This client has a quite strict configuration for its firewall and filters the characters used in POST values. It happens to be a bit too ...
6
votes
1answer
6k views

Recommendations for security testing a Drupal site? [closed]

I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal ...
10
votes
4answers
5k views

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 — 2018 March exploit?

Just released exploit: https://www.drupal.org/sa-core-2018-002 --- Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 How can I tell if someone used this exploit to hack my site?...