Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

0
votes
0answers
70 views

(Answered) Ajax link for anonymous users to delete node they created if $_SESSION exists. Is node's created timestamp secure enough in link?

I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away. Instead of forcing them to create an account and take ...
1
vote
1answer
70 views

How sensitive is a site's UUID?

I have set up continuous integration for a Drupal site. After every git push the site is built remotely from scratch in a Docker container. It runs a site install, sets the site's UUID to import the ...
-1
votes
1answer
107 views

How to locate the Entry Points of a Drupal 8 Core module?

I'm to perform a security audit on the Drupal 8 Core modules, and was curious if there were any telltale signs of Entry Points (ie, how a module communicates with an external module and vice-versa). ...
0
votes
1answer
1k views

Is there a risk of having xmlrpc.php on my site?

I recently noticed that all of my sites have the file xmlrpc.php. Searching it led me to "Gain Control of WordPress by Exploiting XML-RPC", and also to "Drupal Core - Critical - Multiple ...
0
votes
2answers
524 views

Unblock an automated blocked user

I used Login Security module to block users after some login failures. It works fine however I need to unblock such users after certain time like after 1 hour/day. How would I do that as it has ...
0
votes
1answer
31 views

How to securise custom modules

I'm trying to understand how to securise my custom modules to avoid php insert into custom inputs and SQL injections in my db_query. For inputs I'm using : $form['custom'] = array( '#type' =&...
-1
votes
1answer
401 views

How do I fix the following security issue that were reported from a security check?

After running some security checks on my website with Detectify & Tinfoil, I'm faced with some concerns. There seem to be a lot of security issues that I thought were covered by Drupal, and I'm ...
1
vote
1answer
45 views

Services Views module no longer maintaines. What are my options? [closed]

My site relies heavily on the Services and Services Views modules. The Services Views module is no longer being maintained and it has a security vulnerability in it. Could someone help me either ...
1
vote
0answers
254 views

Drupal not detecting updated Trusted Host Settings

I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message: TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is not configured in ...
2
votes
2answers
76 views

Is there a way to send emails when someone logs in?

Logins on my sites are very infrequent and are normally done by myself. I would like a way of getting email notification when someone logs in. This way I might be able to spot someone hacking into the ...
0
votes
1answer
52 views

Views php field or filter to a file or module

If I already have a view with a php filter or a php field, in drupal 7, how can I convert my whole view into a page? (prevent code injections or other security risks) What is the right way to resolve ...
0
votes
1answer
28 views

How can I filter sensitive data being recorded in calls to Watchdog

I have sensitive data that is sent to a Drupal instance and I don't want it to be logged. I can filter out sensitive values with simple string replacements for my own calls to watchdog(), but for PHP ...
0
votes
0answers
327 views

Basic authentication for external application making requests to Drupal instance

I have a external application that makes requests for content in my Drupal 8 instance. What I want to do is to make sure Drupal is only talking go my external application to stop traffic being spoofed....
1
vote
1answer
182 views

How to add security questions in Drupal 8?

I need to add security questions while user creating his account in Drupal 8. I need to use those security questions to retrieve his password, when user forgets his password. Any suggestions ?
-1
votes
1answer
52 views

How to write custom node_access that works with searchapi?

I'm trying to write a custom node access module, implementing hook_node_access. I have a searchapi index of all my nodes, which I would like to return results that obey the hook_node_access ...
1
vote
1answer
26 views

Best way to log clicks on a link of a custom content type

I have a custom content type (bundle, drupal 7) which has a link (rules link module) and I want to log the number of clicks on this link. At the moment I've an integer field in the bundle and I use ...
5
votes
1answer
573 views

What should I set my Content-Security-Policy to?

I'm using Drupal 8, and I currently use Header always set Content-Security-Policy "default-src 'self'; nosniff" However, this causes bugs, such as Google Analytics not working and the textbox ...
0
votes
3answers
23 views

Find the password for user admin from a replicated old version of site

I have access to a copy of an old version of a production site on a dev server, but the owner of the website on prod has lost his credentials to admin and doesn't know his ssh login credentials. The ...
0
votes
1answer
40 views

best way to restrict endpoints such as /node or /filter/tips

I am looking for the best way to restrict access to drupal pages such as /node, /filter/tips and /filter/tips/plain_text etc. Do I add rewrite rules to the .htaccess file?
0
votes
0answers
115 views

Where do I store the encryption.key file?

According to the instructions on the AES encrypt project page, I should create an encryption.key file. Create a new 128 bit encryption key. A good way to do this is in the command line using ...
0
votes
1answer
240 views

PDO Exception shows full path

I have a vulnerability in my Drupal 7 site that if there is no mysql connection establish then PDO through the exception like below: PDOException: SQLSTATE[HY000] [2002] No connection could be made ...
0
votes
1answer
371 views

Verify that salt.txt was located and being used by Drupal?

In my settings file in Drupal 8, I am specifying a location for hash-salt to a file outside of the docroot. Example: $settings['hash_salt'] = file_get_contents('/salt.txt'); I don't see anything in ...
0
votes
1answer
421 views

Drupal & Wordpress User Integration

I know I might be asking a really dumb and likely complex matter, but it's the only remotely easy option I have at the moment. Due to what is set up on two systems by my predecessor, wordpress and ...
1
vote
2answers
260 views

node_load_multiple does not respect node access grants

I used $nodes = node_load_multiple(NULL, array("title" => "Foo Bar")); to fetch nodes by titles. But after going through Drupal security standards, node_load_multiple is not the right way to load ...
1
vote
1answer
1k views

CSS and Js not loading with https

I'm trying to put my entire website under https connexion, but my css and js are not loaded. I don't know why. I had this code to the htaccess at the root of the website : # Force HTTPS and WWW ...
2
votes
1answer
218 views

How to delete first user (admin)

For security reason, I want to delete the first user (which has all rights, event without the admin role) and login only with the drush uli command. How can I do that? From the backoffice it say I can'...
1
vote
2answers
482 views

Why are there so many attempts by an anonymous user to access /wp-login.php?

I looked at /admin/reports/dblog today. There were five request in two minutes by an anonymous user to view /wp-login.php. These requests have been happening for an hour at least and continue 2-3 ...
1
vote
3answers
68 views

Why are anonymous visitors logged in when they visit /user/[uid] page?

This seems to be a massive security floor in Drupal. I have the following display suite code in a Block which is added as a custom field to the User account display:- <?php global $user; $uid =...
2
votes
3answers
965 views

How to prevent a site from ever using experimental core modules?

Quote from Experimental modules in Drupal 8: Drupal 8 core introduces the concept of experimental modules. These are modules that are provided with Drupal core for testing purposes, but that are ...
6
votes
2answers
764 views

Why has my security shield for my new module on Drupal.org been removed?

I have recently managed to create a module on drupal.org, by following the entire process from Sandbox->Project Application->Module Publish. However after few weeks my module lost the security ...
0
votes
0answers
858 views

How to make all URL redirect to HTTPS

There is already a lot of links displaying videos inside my site (in node content) that are using: http://example.com/clips/2017/01/11/51706, http://www.example.com/clips/2017/01/11/51706, https://...
0
votes
0answers
18 views

Restricted visibility and search engine

The search engine crawler, like Googlebot, doesn't index any data, which is set to be visible only particular user, right? For example, let's say I have fields named field_A & field_B on user's ...
1
vote
1answer
28 views

How to securely access the data from another Drupal instance?

I have a site setup which feels fairly unconventional so please bare with me while I try to explain. I have 2 Drupal sites based on different servers. The main site (site A) contains the front-end ...
5
votes
4answers
4k views

Remove the X-generator header from the response

I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header. I am using the following code, but it removes the x-...
5
votes
1answer
584 views

Understanding how SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006 works?

I understand that the files directory requires this in the .htaccess file: SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006 I know it prevents PHP from running in the files directory, but ...
0
votes
1answer
23 views

Is it safe to use $vars['name_raw'] instead of $vars['name']?

I ran into an issue with usernames being trimmed in articles. I found a thread here with a fix suggesting to use $vars['name_raw']: https://www.drupal.org/node/854762#comment-7614255. It works. But I'...
1
vote
1answer
16 views

Entity Reference + View + security

I have this scenario in DRUPAL 7 A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian). A content type named "Reports" with a field "...
1
vote
2answers
40 views

Best practice, removing admin access from many websites

hopefully this is not a repeat question, not sure how to search for this. I run over 50 websites, not all are on the same server but some do hold many users together. Not all our servers are ours, ...
0
votes
1answer
23 views

Web forms senders to make their email secure

Make Web forms secure- can we have an option for senders to make their email secure when sending private information back like account numbers, is there an option for this in Drupal or is it possible ...
1
vote
2answers
80 views

Is it safe to use $_SESSION to store temporarily a user provided value under multi-step form processing

I have a form which contains an AJAX button press callback. Upon pressing this AJAX button, I want to store temporarily a form element's value before fully processing all the data upon pressing main ...
4
votes
1answer
556 views

How to get accurate information about available security updates after End-of-Life?

For a Drupal 6 site that use the update module, the "Available updates" report no longer shows accurate information about available security updates. Of course, this is because after Drupal 6's End-...
0
votes
1answer
457 views

How do you force Drupal login to encrypt the credentials

To make the Drupal login as secure as possible, we don't want to send the login credentials as clear text, but want to somehow encrypt the credentials or the entire request. Ideally the solution ...
4
votes
3answers
626 views

How can I stop Drupal from tracking or collecting IP addresses?

Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (...
1
vote
1answer
979 views

How do I modify the “has_js” cookie?

I have a web application deployed through Drupal 7.43. I need to modify the has_js cookie that is set by Drupal to make it both Http-only and Secure for a site security review. What are pros and cons ...
0
votes
0answers
244 views

Safe way to login a user programmatically

I know that with the following code we can login a user programmatically. $username = "someuser"; $password = "somepass"; $uid = user_authenticate($username, $password); if ($uid) { $form_state = ...
1
vote
1answer
119 views

PCI compatible recipe?

I've struggled to find a really straight answer that makes me super comfortable to this question after searching SE, PCI basics, drupal.org, AWS resources, and reading the Drupal PCI Compliance White ...
1
vote
0answers
53 views

Keeping sensitive data from appearing in cache_form table

I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the ...
2
votes
2answers
95 views

Secure Pages Module or force HTTPS Across Whole Site?

I understand that the Secure Pages module allows you to let some pages use http and force others to use https. Assuming that is correct, is there any reason for me to use Secure Pages if I'm already ...
1
vote
4answers
2k views

How to have a secure HTTPS login form?

I have Drupal site with a login form on my home page. How do I go about posting to a HTTPS url, and then after a successful authentication, redirect back to HTTP admin page?
0
votes
2answers
40 views

Prevent users from including their username in their password

I'm aware of the Password Policy module that has a number of features for forcing the user to constrain their passwords to certain criteria, but this module does not contain an option to prevent users ...