Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
0
votes
1answer
33 views

what security measures should be taken when creating/updating/retrieving entities with data from users' form submissions?

We have webforms for authenticated users (anyone can create an account without admin approval) to fill out. With their submission data I'm using the civicrm_api to create contacts and relationships. ...
1
vote
2answers
205 views

Drupal 8 password retention

I am currently reviewing Drupal 8's security features and was wondering about how Drupal stores user passwords. I know Drupal uses salted hashes to store the password in the database, but does Drupal ...
0
votes
1answer
362 views

With enabling modsecurity_crs_41_sql_injection_attacks all submit form return forbidden 403

I installed and activated the module mod_security. then I enabled the modsecurity_crs_41_sql_injection_attacks.conf. For each form, when I submit, I have an error 403 forbidden Error log: [Wed Nov ...
1
vote
1answer
103 views

Drupal form_state sanitization

I'm new to Drupal and I am doing some module development for a Drupal 7 install. I've done development outside of Drupal and normally its best to always sanitize user input. I've seen different ...
1
vote
1answer
220 views

security kit module settings are blocking own site jQuery calls

I am using Security kit module to enhance security for my website. In that I have enabled Enable JavaScript + CSS + Noscript protection option. This setting is blocking one of Jquery call that is ....
2
votes
3answers
344 views

How to securely authenticate content embeded in another site?

I need to embed password protected content to a second domain with an iframe. The content itself is a view which will be displayed on a third party site via an iframe and the content is prepared with ...
2
votes
1answer
295 views

How to determine the code for settings.php config override based on .yml?

I am trying to put my API keys in a separate file instead of storing them in config management. For example, I installed the Commerce Stripe module. When I export the config, it looks like this: ...
0
votes
0answers
75 views

(Answered) Ajax link for anonymous users to delete node they created if $_SESSION exists. Is node's created timestamp secure enough in link?

I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away. Instead of forcing them to create an account and take ...
1
vote
1answer
76 views

How sensitive is a site's UUID?

I have set up continuous integration for a Drupal site. After every git push the site is built remotely from scratch in a Docker container. It runs a site install, sets the site's UUID to import the ...
0
votes
1answer
116 views

How to locate the Entry Points of a Drupal 8 Core module?

I'm to perform a security audit on the Drupal 8 Core modules, and was curious if there were any telltale signs of Entry Points (ie, how a module communicates with an external module and vice-versa). ...
0
votes
1answer
1k views

Is there a risk of having xmlrpc.php on my site?

I recently noticed that all of my sites have the file xmlrpc.php. Searching it led me to "Gain Control of WordPress by Exploiting XML-RPC", and also to "Drupal Core - Critical - Multiple ...
0
votes
2answers
564 views

Unblock an automated blocked user

I used Login Security module to block users after some login failures. It works fine however I need to unblock such users after certain time like after 1 hour/day. How would I do that as it has ...
0
votes
1answer
33 views

How to securise custom modules

I'm trying to understand how to securise my custom modules to avoid php insert into custom inputs and SQL injections in my db_query. For inputs I'm using : $form['custom'] = array( '#type' =&...
-1
votes
1answer
468 views

How do I fix the following security issue that were reported from a security check?

After running some security checks on my website with Detectify & Tinfoil, I'm faced with some concerns. There seem to be a lot of security issues that I thought were covered by Drupal, and I'm ...
1
vote
1answer
45 views

Services Views module no longer maintaines. What are my options? [closed]

My site relies heavily on the Services and Services Views modules. The Services Views module is no longer being maintained and it has a security vulnerability in it. Could someone help me either ...
1
vote
0answers
268 views

Drupal not detecting updated Trusted Host Settings

I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message: TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is not configured in ...
2
votes
2answers
76 views

Is there a way to send emails when someone logs in?

Logins on my sites are very infrequent and are normally done by myself. I would like a way of getting email notification when someone logs in. This way I might be able to spot someone hacking into the ...
0
votes
1answer
52 views

Views php field or filter to a file or module

If I already have a view with a php filter or a php field, in drupal 7, how can I convert my whole view into a page? (prevent code injections or other security risks) What is the right way to resolve ...
0
votes
1answer
28 views

How can I filter sensitive data being recorded in calls to Watchdog

I have sensitive data that is sent to a Drupal instance and I don't want it to be logged. I can filter out sensitive values with simple string replacements for my own calls to watchdog(), but for PHP ...
0
votes
0answers
368 views

Basic authentication for external application making requests to Drupal instance

I have a external application that makes requests for content in my Drupal 8 instance. What I want to do is to make sure Drupal is only talking go my external application to stop traffic being spoofed....
1
vote
1answer
225 views

How to add security questions in Drupal 8?

I need to add security questions while user creating his account in Drupal 8. I need to use those security questions to retrieve his password, when user forgets his password. Any suggestions ?
-1
votes
1answer
53 views

How to write custom node_access that works with searchapi?

I'm trying to write a custom node access module, implementing hook_node_access. I have a searchapi index of all my nodes, which I would like to return results that obey the hook_node_access ...
1
vote
1answer
26 views

Best way to log clicks on a link of a custom content type

I have a custom content type (bundle, drupal 7) which has a link (rules link module) and I want to log the number of clicks on this link. At the moment I've an integer field in the bundle and I use ...
0
votes
3answers
23 views

Find the password for user admin from a replicated old version of site

I have access to a copy of an old version of a production site on a dev server, but the owner of the website on prod has lost his credentials to admin and doesn't know his ssh login credentials. The ...
0
votes
1answer
44 views

best way to restrict endpoints such as /node or /filter/tips

I am looking for the best way to restrict access to drupal pages such as /node, /filter/tips and /filter/tips/plain_text etc. Do I add rewrite rules to the .htaccess file?
0
votes
0answers
129 views

Where do I store the encryption.key file?

According to the instructions on the AES encrypt project page, I should create an encryption.key file. Create a new 128 bit encryption key. A good way to do this is in the command line using ...
0
votes
1answer
273 views

PDO Exception shows full path

I have a vulnerability in my Drupal 7 site that if there is no mysql connection establish then PDO through the exception like below: PDOException: SQLSTATE[HY000] [2002] No connection could be made ...
0
votes
1answer
432 views

Verify that salt.txt was located and being used by Drupal?

In my settings file in Drupal 8, I am specifying a location for hash-salt to a file outside of the docroot. Example: $settings['hash_salt'] = file_get_contents('/salt.txt'); I don't see anything in ...
0
votes
1answer
448 views

Drupal & Wordpress User Integration

I know I might be asking a really dumb and likely complex matter, but it's the only remotely easy option I have at the moment. Due to what is set up on two systems by my predecessor, wordpress and ...
1
vote
2answers
281 views

node_load_multiple does not respect node access grants

I used $nodes = node_load_multiple(NULL, array("title" => "Foo Bar")); to fetch nodes by titles. But after going through Drupal security standards, node_load_multiple is not the right way to load ...
1
vote
1answer
1k views

CSS and Js not loading with https

I'm trying to put my entire website under https connexion, but my css and js are not loaded. I don't know why. I had this code to the htaccess at the root of the website : # Force HTTPS and WWW ...
2
votes
1answer
251 views

How to delete first user (admin)

For security reason, I want to delete the first user (which has all rights, event without the admin role) and login only with the drush uli command. How can I do that? From the backoffice it say I can'...
1
vote
2answers
516 views

Why are there so many attempts by an anonymous user to access /wp-login.php?

I looked at /admin/reports/dblog today. There were five request in two minutes by an anonymous user to view /wp-login.php. These requests have been happening for an hour at least and continue 2-3 ...
1
vote
3answers
69 views

Why are anonymous visitors logged in when they visit /user/[uid] page?

This seems to be a massive security floor in Drupal. I have the following display suite code in a Block which is added as a custom field to the User account display:- <?php global $user; $uid =...
2
votes
3answers
965 views

How to prevent a site from ever using experimental core modules?

Quote from Experimental modules in Drupal 8: Drupal 8 core introduces the concept of experimental modules. These are modules that are provided with Drupal core for testing purposes, but that are ...
6
votes
2answers
770 views

Why has my security shield for my new module on Drupal.org been removed?

I have recently managed to create a module on drupal.org, by following the entire process from Sandbox->Project Application->Module Publish. However after few weeks my module lost the security ...
0
votes
0answers
893 views

How to make all URL redirect to HTTPS

There is already a lot of links displaying videos inside my site (in node content) that are using: http://example.com/clips/2017/01/11/51706, http://www.example.com/clips/2017/01/11/51706, https://...
0
votes
0answers
18 views

Restricted visibility and search engine

The search engine crawler, like Googlebot, doesn't index any data, which is set to be visible only particular user, right? For example, let's say I have fields named field_A & field_B on user's ...
1
vote
1answer
29 views

How to securely access the data from another Drupal instance?

I have a site setup which feels fairly unconventional so please bare with me while I try to explain. I have 2 Drupal sites based on different servers. The main site (site A) contains the front-end ...
5
votes
5answers
4k views

Remove the X-generator header from the response

I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header. I am using the following code, but it removes the x-...
0
votes
1answer
321 views

SA-CORE-2013-003 - Files directory Not fully protected

I'm using Pressflow 6.38 and I'm trying to implement SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities | Drupal.org inside of /etc/httpd/conf.d/pressflow.conf configuration file, like ...
0
votes
1answer
23 views

Is it safe to use $vars['name_raw'] instead of $vars['name']?

I ran into an issue with usernames being trimmed in articles. I found a thread here with a fix suggesting to use $vars['name_raw']: https://www.drupal.org/node/854762#comment-7614255. It works. But I'...
1
vote
1answer
16 views

Entity Reference + View + security

I have this scenario in DRUPAL 7 A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian). A content type named "Reports" with a field "...
1
vote
2answers
41 views

Best practice, removing admin access from many websites

hopefully this is not a repeat question, not sure how to search for this. I run over 50 websites, not all are on the same server but some do hold many users together. Not all our servers are ours, ...
0
votes
1answer
23 views

Web forms senders to make their email secure

Make Web forms secure- can we have an option for senders to make their email secure when sending private information back like account numbers, is there an option for this in Drupal or is it possible ...
1
vote
2answers
84 views

Is it safe to use $_SESSION to store temporarily a user provided value under multi-step form processing

I have a form which contains an AJAX button press callback. Upon pressing this AJAX button, I want to store temporarily a form element's value before fully processing all the data upon pressing main ...
4
votes
1answer
556 views

How to get accurate information about available security updates after End-of-Life?

For a Drupal 6 site that use the update module, the "Available updates" report no longer shows accurate information about available security updates. Of course, this is because after Drupal 6's End-...
0
votes
1answer
541 views

How do you force Drupal login to encrypt the credentials

To make the Drupal login as secure as possible, we don't want to send the login credentials as clear text, but want to somehow encrypt the credentials or the entire request. Ideally the solution ...
4
votes
3answers
661 views

How can I stop Drupal from tracking or collecting IP addresses?

Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (...
1
vote
1answer
1k views

How do I modify the “has_js” cookie?

I have a web application deployed through Drupal 7.43. I need to modify the has_js cookie that is set by Drupal to make it both Http-only and Secure for a site security review. What are pros and cons ...