Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

96
votes
6answers
14k views

What are the downsides of using PHP Filter code in blocks, nodes, views-args, etc?

I have seen many times people saying not to use custom PHP/PHP filter (from the Drupal UI) in blocks, nodes, views-args, rules, etc. I have searched around a bit and haven't found much, it seems like ...
142
votes
11answers
183k views

What are the recommended directory permissions?

I'm gearing up to deploy a Drupal 7 site and I can't find any documentation about what are the recommended security-conscious file and directory permissions should be set. Specifically default/files/ ...
40
votes
7answers
13k views

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

I just updated all my sites using the patch method of resolving the Drupal SA-CORE-2014-005 exploit. I just read reports that just yesterday there is someone from a Russian IP infiltrating drupal ...
51
votes
3answers
32k views

How to upgrade only core with drush?

There's a huge security leak in <7.32. So I want to upgrade all my Drupal sites asap without too much worrying about breaking stuff. But... $ drush dl drupal-7.32 It's forbidden to download ...
33
votes
6answers
9k views

What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?

Reading up on https://www.drupal.org/node/2357241 and the technical details at https://www.drupal.org/SA-CORE-2014-005, as well as the actual patch which is simply: diff --git a/includes/database/...
4
votes
3answers
1k views

PHP in database: bad practice but

Lots of times here I've been told that using views custom php fields, filters or others is a bad practice, because putting php in the sql is dangerous. My question is, if you only call to a function, ...
2
votes
1answer
495 views

How can I exclude API keys, passwords, and so on from configuration management?

I am using Drupal 8 and drush cex to commit my configuration to my repository. However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive ...
2
votes
3answers
1k views

How to remove malicious scripts from admin pages after being hacked?

The site running Drupal 7 was hacked and every administration page, e.g. http://www.anysite.com/en/admin/dashboard contains script tag in head section with malicious src attribute, e.g. <head>...
31
votes
3answers
11k views

Differences between value and safe_value

What are the differences between ['value'] and ['safe_value']?
16
votes
1answer
7k views

Is check_plain() enough?

Is check_plain() enough for re-displaying the text entered by users in the browser, or should I still filter with filter_xss()?
8
votes
2answers
382 views

Why is settings.php in the web folder?

In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a ...
6
votes
5answers
3k views

Spambots causing server crashes. How do I block them?

I have a Drupal 7 website on a shared hosting account that uses an Apache server. It is getting continuously battered by spam bots who try to post junk comments and create fake accounts. What methods ...
10
votes
4answers
5k views

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 — 2018 March exploit?

Just released exploit: https://www.drupal.org/sa-core-2018-002 --- Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 How can I tell if someone used this exploit to hack my site?...
2
votes
2answers
76 views

Is there a way to send emails when someone logs in?

Logins on my sites are very infrequent and are normally done by myself. I would like a way of getting email notification when someone logs in. This way I might be able to spot someone hacking into the ...
2
votes
2answers
2k views

Protect site from flooding when user login is attacked by brute force

I've been experiencing issues with bots trying to force their way into the website I manage. It seems to be a daily occurrence the the flood system is being triggered (I'm on D7). I'm happy the the ...
10
votes
1answer
7k views

How and when to use filter_xss() and check_plain()?

There are lots of template files like this one views-view-fields--magazine--magazine.tpl.php in my website. how and when I should use the filter_xss() and check_plain() to improve security? for ...
6
votes
1answer
2k views

How to place Drupal_Security_Do_Not_Remove_See_SA_* into httpd.conf instead of .htaccess

I run several Drupal 7 installations on a dedicated server with CentOS 6.4 and Apache 2 (the package httpd-2.2.15-29.el6.centos.x86_64). I wonder, how to properly configure the ...
4
votes
5answers
765 views

What are the ways/strategies to maintain Drupal sites a over period of 10-15 years?

We have started using Drupal as a PHP programming framework (and not just as a CMS). As result, we have many projects running on Drupal (6 or 7). Typically, after 2-3 years a project gets over and no ...
6
votes
3answers
3k views

Prevent Cross-site scripting

One of the security principles is sanitizing strings and variables passed from client to server. In plain PHP there are some functions to prevent XSS (Cross-site Scripting) vulnerabilities: ...
3
votes
1answer
107 views

Trying to make my entire site https

I am trying to make an entire Drupal site https. I tried enabling secure pages, and this seems to work for every authenticated user. However any anonymous user either gets only http, or possibly an ...
6
votes
2answers
764 views

Why has my security shield for my new module on Drupal.org been removed?

I have recently managed to create a module on drupal.org, by following the entire process from Sandbox->Project Application->Module Publish. However after few weeks my module lost the security ...
4
votes
1answer
556 views

How to get accurate information about available security updates after End-of-Life?

For a Drupal 6 site that use the update module, the "Available updates" report no longer shows accurate information about available security updates. Of course, this is because after Drupal 6's End-...
4
votes
3answers
626 views

How can I stop Drupal from tracking or collecting IP addresses?

Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (...
4
votes
2answers
2k views

Is allowing Full HTML (HTML filter on) input for all user roles safe?

Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?
3
votes
1answer
198 views

What is the best way to restrict website's direct access through node urls? [duplicate]

How can I prevent a node from being accessible on its own page, through node/xxx, but still be accessible through node description eg: /homepage? I tried using the Rabbit Hole module, which ...
3
votes
2answers
550 views

What are the alternatives for storing client side encrypted data?

I want to store client side encrypted data in Drupal 7, so that it is encrypted on the client end, and stored and transmitted in encrypted form. The password is never transmitted or stored on the ...
3
votes
2answers
961 views

How to update Drupal securely using GUI/web interface

The admin/reports/updates/update page lists updates, and there's what looks like a handy button Download these updates at the bottom. And then you're asked for your SSH user and password. Now unless ...
3
votes
2answers
515 views

Should Drupal 6 be considered insecure?

After reading the post about linkedin on IT security and this issue I would think that having a default Drupal 6 installation without, for example, the phpass module should be considered quite ...
2
votes
1answer
977 views

In what cases should I personally sanitize input & output when using the Database Abstraction Layer

I'm trying to get a clearer sense of where security vulnerabilities on my site may lie. At no point in my code do I ever query the MySQL database directly; I always use the Database Abstraction Layer (...
2
votes
2answers
3k views

How to get rid of 'security updates available' warnings?

I am using the ShareThis module on my website. Unfortunately, recent release 2.3 is flagged as a security update, but it is has a major bug (settings can't be saved). I have reverted to release 2.2. ...
1
vote
1answer
1k views

What is the suitable file permission for 'files'?

I have written this small bash script to rebuild D6.22 file permissions: #!/bin/bash cd /path/to/drupal chown -R bob:www-data . find . -type d -exec chmod u=rwx,g=rx,o= {} \; find . -type f -exec ...
1
vote
4answers
505 views

How to recover content/configuration from a hacked site

I have a situation where I am faced with two sites which were vulnerable to the Drupageddon SQL injection exploit. I am looking at what is the best strategy for recovering these websites. Given that ...
1
vote
7answers
7k views

Insecure content warning with D7 and SSL

I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome ...
5
votes
1answer
2k views

Drupal reuses its hash salt

The instructions in default.settings.php say This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if ...
4
votes
3answers
848 views

How do I go about putting standalone PHP files into Drupal 6?

I want to add an extra cool PHP Class, where would I put it in Drupal, how do I make absolutely sure the code doesn't present a security risk, should I just make it into a module?
4
votes
1answer
671 views

How safely allow untrusted users to use img tag?

Following this question, I'm wondering how can I allow users of a social site (which obviously are not all trusted) to upload images while avoiding XSS threats?
2
votes
1answer
4k views

What's the best file permission to drupal's files and directories? [duplicate]

Possible Duplicate: What are the recommended directory permissions? I want to know what's the best file permission under a linux system to my drupal's files and directories including the files ...
2
votes
1answer
731 views

Will forcing validation on a node save result in security issues or data integrity loss?

I have a content type containing lots of required and conditional fields. Because it can take a bit of time to properly create these nodes, and not all information will always be available to the end-...
2
votes
2answers
774 views

Drupal Commons 3 and Original Drupal Core Updates

I'm may be planning to switch over to Drupal Commons 3. When the original Drupal core gets security updates, will I be able to get those updates in the Drupal Commons or do I have to wait for Drupal ...
1
vote
0answers
45 views

Distribution Commerce Kickstart 1.x - is possbile run Drupal Core 7.61 / PHP 7.2 ? And how [closed]

I have small and very simple Drupal 7 site based on Commerce Kickstart 1.x distribution (originally instalation profile, now "distribution"). The version of distribution is 7.x-1.53. It is last ...
1
vote
2answers
123 views

Is this block safe from code injection exploit?

Thanks good people here, I have create a simple module which generate two blocks as follows: function myblockmodule_block_info(){ $block['myadblocks'] = array( 'info' => t('My first ...
1
vote
2answers
4k views

How to disable PHP files from being run in the sites/default/files directory?

By default does drupal 7's sites/default/files directory disables running of PHP files?
0
votes
1answer
458 views

How do you force Drupal login to encrypt the credentials

To make the Drupal login as secure as possible, we don't want to send the login credentials as clear text, but want to somehow encrypt the credentials or the entire request. Ideally the solution ...
0
votes
1answer
178 views

How allowing img tag in formats can be dangerous?

I get this recommendation form Security review module: It is recommended you remove the following tags from roles accessible by untrusted users: img I am wondering what real world threats can ...
0
votes
2answers
394 views

How to filter URLs for embedded IMG tags?

This is a great presentation about Drupal security. They were talking about ways to only allow tags from certain trusted domains. Any ideas how to do that? I couldn't find a D7 module for that.
0
votes
1answer
177 views

Can't access my website

I can't access my website. I guess it has been hacked. Some drupaldev user is already been created and is in admin list. I have blocked that user multiple times, but it reappears again and again in my ...
0
votes
1answer
666 views

Confusion about files permission

Accrding to drupal docs: The following is an example file listing of a safe configuration showing two files in a site where uploaded files are stored in the "files" directory. In order to see the ...