Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
96
votes
7answers
14k views

What are the downsides of using PHP Filter code in blocks, nodes, views-args, etc?

I have seen many times people saying not to use custom PHP/PHP filter (from the Drupal UI) in blocks, nodes, views-args, rules, etc. I have searched around a bit and haven't found much, it seems like ...
145
votes
11answers
186k views

What are the recommended directory permissions?

I'm gearing up to deploy a Drupal 7 site and I can't find any documentation about what the recommended security-conscious file and directory permissions should be set to. Specifically default/files/ (...
40
votes
7answers
13k views

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

I just updated all my sites using the patch method of resolving the Drupal SA-CORE-2014-005 exploit. I just read reports that just yesterday there is someone from a Russian IP infiltrating drupal ...
52
votes
3answers
33k views

How to upgrade only core with drush?

There's a huge security leak in <7.32. So I want to upgrade all my Drupal sites asap without too much worrying about breaking stuff. But... $ drush dl drupal-7.32 It's forbidden to download ...
33
votes
6answers
9k views

What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?

Reading up on https://www.drupal.org/node/2357241 and the technical details at https://www.drupal.org/SA-CORE-2014-005, as well as the actual patch which is simply: diff --git a/includes/database/...
4
votes
3answers
1k views

PHP in database: bad practice but

Lots of times here I've been told that using views custom php fields, filters or others is a bad practice, because putting php in the sql is dangerous. My question is, if you only call to a function, ...
2
votes
1answer
569 views

How can I exclude API keys, passwords, and so on from configuration management?

I am using Drupal 8 and drush cex to commit my configuration to my repository. However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive ...
2
votes
3answers
1k views

How to remove malicious scripts from admin pages after being hacked?

The site running Drupal 7 was hacked and every administration page, e.g. http://www.anysite.com/en/admin/dashboard contains script tag in head section with malicious src attribute, e.g. <head>...
31
votes
3answers
12k views

Differences between value and safe_value

What are the differences between ['value'] and ['safe_value']?
16
votes
1answer
7k views

Is check_plain() enough?

Is check_plain() enough for re-displaying the text entered by users in the browser, or should I still filter with filter_xss()?
8
votes
2answers
390 views

Why is settings.php in the web folder?

In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a ...
6
votes
5answers
3k views

Spambots causing server crashes. How do I block them?

I have a Drupal 7 website on a shared hosting account that uses an Apache server. It is getting continuously battered by spam bots who try to post junk comments and create fake accounts. What methods ...
2
votes
2answers
76 views

Is there a way to send emails when someone logs in?

Logins on my sites are very infrequent and are normally done by myself. I would like a way of getting email notification when someone logs in. This way I might be able to spot someone hacking into the ...
2
votes
2answers
2k views

Protect site from flooding when user login is attacked by brute force

I've been experiencing issues with bots trying to force their way into the website I manage. It seems to be a daily occurrence the the flood system is being triggered (I'm on D7). I'm happy the the ...
10
votes
1answer
7k views

How and when to use filter_xss() and check_plain()?

There are lots of template files like this one views-view-fields--magazine--magazine.tpl.php in my website. how and when I should use the filter_xss() and check_plain() to improve security? for ...
6
votes
1answer
2k views

How to place Drupal_Security_Do_Not_Remove_See_SA_* into httpd.conf instead of .htaccess

I run several Drupal 7 installations on a dedicated server with CentOS 6.4 and Apache 2 (the package httpd-2.2.15-29.el6.centos.x86_64). I wonder, how to properly configure the ...
4
votes
5answers
769 views

What are the ways/strategies to maintain Drupal sites a over period of 10-15 years?

We have started using Drupal as a PHP programming framework (and not just as a CMS). As result, we have many projects running on Drupal (6 or 7). Typically, after 2-3 years a project gets over and no ...
7
votes
3answers
4k views

Prevent Cross-site scripting

One of the security principles is sanitizing strings and variables passed from client to server. In plain PHP there are some functions to prevent XSS (Cross-site Scripting) vulnerabilities: ...
3
votes
1answer
107 views

Trying to make my entire site https

I am trying to make an entire Drupal site https. I tried enabling secure pages, and this seems to work for every authenticated user. However any anonymous user either gets only http, or possibly an ...
6
votes
2answers
775 views

Why has my security shield for my new module on Drupal.org been removed?

I have recently managed to create a module on drupal.org, by following the entire process from Sandbox->Project Application->Module Publish. However after few weeks my module lost the security ...
4
votes
3answers
689 views

How can I stop Drupal from tracking or collecting IP addresses?

Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (...
4
votes
2answers
2k views

Is allowing Full HTML (HTML filter on) input for all user roles safe?

Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?
4
votes
1answer
556 views

How to get accurate information about available security updates after End-of-Life?

For a Drupal 6 site that use the update module, the "Available updates" report no longer shows accurate information about available security updates. Of course, this is because after Drupal 6's End-...
3
votes
2answers
517 views

Should Drupal 6 be considered insecure?

After reading the post about linkedin on IT security and this issue I would think that having a default Drupal 6 installation without, for example, the phpass module should be considered quite ...
3
votes
1answer
199 views

What is the best way to restrict website's direct access through node urls? [duplicate]

How can I prevent a node from being accessible on its own page, through node/xxx, but still be accessible through node description eg: /homepage? I tried using the Rabbit Hole module, which ...
3
votes
2answers
565 views

What are the alternatives for storing client side encrypted data?

I want to store client side encrypted data in Drupal 7, so that it is encrypted on the client end, and stored and transmitted in encrypted form. The password is never transmitted or stored on the ...
3
votes
2answers
962 views

How to update Drupal securely using GUI/web interface

The admin/reports/updates/update page lists updates, and there's what looks like a handy button Download these updates at the bottom. And then you're asked for your SSH user and password. Now unless ...
2
votes
2answers
3k views

How to get rid of 'security updates available' warnings?

I am using the ShareThis module on my website. Unfortunately, recent release 2.3 is flagged as a security update, but it is has a major bug (settings can't be saved). I have reverted to release 2.2. ...
2
votes
1answer
985 views

In what cases should I personally sanitize input & output when using the Database Abstraction Layer

I'm trying to get a clearer sense of where security vulnerabilities on my site may lie. At no point in my code do I ever query the MySQL database directly; I always use the Database Abstraction Layer (...
1
vote
1answer
1k views

What is the suitable file permission for 'files'?

I have written this small bash script to rebuild D6.22 file permissions: #!/bin/bash cd /path/to/drupal chown -R bob:www-data . find . -type d -exec chmod u=rwx,g=rx,o= {} \; find . -type f -exec ...
1
vote
7answers
8k views

Insecure content warning with D7 and SSL

I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome ...
5
votes
1answer
2k views

Drupal reuses its hash salt

The instructions in default.settings.php say This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if ...
4
votes
1answer
676 views

How safely allow untrusted users to use img tag?

Following this question, I'm wondering how can I allow users of a social site (which obviously are not all trusted) to upload images while avoiding XSS threats?
4
votes
3answers
848 views

How do I go about putting standalone PHP files into Drupal 6?

I want to add an extra cool PHP Class, where would I put it in Drupal, how do I make absolutely sure the code doesn't present a security risk, should I just make it into a module?
2
votes
1answer
735 views

Will forcing validation on a node save result in security issues or data integrity loss?

I have a content type containing lots of required and conditional fields. Because it can take a bit of time to properly create these nodes, and not all information will always be available to the end-...
2
votes
1answer
4k views

What's the best file permission to drupal's files and directories? [duplicate]

Possible Duplicate: What are the recommended directory permissions? I want to know what's the best file permission under a linux system to my drupal's files and directories including the files ...
2
votes
2answers
774 views

Drupal Commons 3 and Original Drupal Core Updates

I'm may be planning to switch over to Drupal Commons 3. When the original Drupal core gets security updates, will I be able to get those updates in the Drupal Commons or do I have to wait for Drupal ...
1
vote
2answers
615 views

Automatically block user that access /wp-login.php

Is it possible to block any users IP if they try to access a specific URL such as /wp-login.php page which does not exist on Drupal. Basically to automatically blacklist the user, for days or even ...
1
vote
2answers
4k views

How to disable PHP files from being run in the sites/default/files directory?

By default does drupal 7's sites/default/files directory disables running of PHP files?
1
vote
2answers
123 views

Is this block safe from code injection exploit?

Thanks good people here, I have create a simple module which generate two blocks as follows: function myblockmodule_block_info(){ $block['myadblocks'] = array( 'info' => t('My first ...
0
votes
1answer
671 views

Confusion about files permission

Accrding to drupal docs: The following is an example file listing of a safe configuration showing two files in a site where uploaded files are stored in the "files" directory. In order to see the ...
0
votes
1answer
187 views

How allowing img tag in formats can be dangerous?

I get this recommendation form Security review module: It is recommended you remove the following tags from roles accessible by untrusted users: img I am wondering what real world threats can ...
0
votes
1answer
577 views

How do you force Drupal login to encrypt the credentials

To make the Drupal login as secure as possible, we don't want to send the login credentials as clear text, but want to somehow encrypt the credentials or the entire request. Ideally the solution ...
0
votes
2answers
402 views

How to filter URLs for embedded IMG tags?

This is a great presentation about Drupal security. They were talking about ways to only allow tags from certain trusted domains. Any ideas how to do that? I couldn't find a D7 module for that.
0
votes
1answer
425 views

how to set content-security-policy header

I want to set Content-Security-Policy header in my site. I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.
0
votes
1answer
180 views

Can't access my website

I can't access my website. I guess it has been hacked. Some drupaldev user is already been created and is in admin list. I have blocked that user multiple times, but it reappears again and again in my ...