Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
1
vote
2answers
41 views

Best practice, removing admin access from many websites

hopefully this is not a repeat question, not sure how to search for this. I run over 50 websites, not all are on the same server but some do hold many users together. Not all our servers are ours, ...
0
votes
1answer
23 views

Web forms senders to make their email secure

Make Web forms secure- can we have an option for senders to make their email secure when sending private information back like account numbers, is there an option for this in Drupal or is it possible ...
1
vote
2answers
93 views

Is it safe to use $_SESSION to store temporarily a user provided value under multi-step form processing

I have a form which contains an AJAX button press callback. Upon pressing this AJAX button, I want to store temporarily a form element's value before fully processing all the data upon pressing main ...
4
votes
1answer
1k views

How to get accurate information about available security updates after End-of-Life?

For a Drupal 6 site that use the update module, the "Available updates" report no longer shows accurate information about available security updates. Of course, this is because after Drupal 6's End-...
0
votes
1answer
690 views

How do you force Drupal login to encrypt the credentials

To make the Drupal login as secure as possible, we don't want to send the login credentials as clear text, but want to somehow encrypt the credentials or the entire request. Ideally the solution ...
4
votes
3answers
774 views

How can I stop Drupal from tracking or collecting IP addresses?

Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (...
1
vote
1answer
1k views

How do I modify the “has_js” cookie?

I have a web application deployed through Drupal 7.43. I need to modify the has_js cookie that is set by Drupal to make it both Http-only and Secure for a site security review. What are pros and cons ...
0
votes
0answers
314 views

Safe way to login a user programmatically

I know that with the following code we can login a user programmatically. $username = "someuser"; $password = "somepass"; $uid = user_authenticate($username, $password); if ($uid) { $form_state = ...
1
vote
1answer
149 views

PCI compatible recipe?

I've struggled to find a really straight answer that makes me super comfortable to this question after searching SE, PCI basics, drupal.org, AWS resources, and reading the Drupal PCI Compliance White ...
1
vote
0answers
56 views

Keeping sensitive data from appearing in cache_form table

I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the ...
2
votes
2answers
113 views

Secure Pages Module or force HTTPS Across Whole Site?

I understand that the Secure Pages module allows you to let some pages use http and force others to use https. Assuming that is correct, is there any reason for me to use Secure Pages if I'm already ...
1
vote
4answers
2k views

How to have a secure HTTPS login form?

I have Drupal site with a login form on my home page. How do I go about posting to a HTTPS url, and then after a successful authentication, redirect back to HTTP admin page?
0
votes
2answers
41 views

Prevent users from including their username in their password

I'm aware of the Password Policy module that has a number of features for forcing the user to constrain their passwords to certain criteria, but this module does not contain an option to prevent users ...
1
vote
0answers
21 views

Any security issues accessing $_POST and returning values from it in AJAX commands?

Just wondering if there needs to be any sanitization here: /** * Implements hook_ajax_render_alter(). */ function my_module_ajax_render_alter(&$commands) { if (isset($_POST['...
0
votes
1answer
57 views

How can I restore the security of an old site with a sql injection vulnerability which was probably exploited? [closed]

Edit: Sorry, the question was marked as unclear. In a nutshell, there are two questions: Does the code below indeed create an sql injection vector? (It seems clear that the answer is yes, even though ...
0
votes
1answer
50 views

The administrator menu disappeared

I added the following code in my .htaccess file : <IfModule mod_headers.c> Header set Set-Cookie HttpOnly;Secure Header always set X-XSS-Protection "1; mode=block" Header always set X-...
8
votes
3answers
5k views

Prevent Cross-site scripting

One of the security principles is sanitizing strings and variables passed from client to server. In plain PHP there are some functions to prevent XSS (Cross-site Scripting) vulnerabilities: ...
5
votes
1answer
4k views

Prevent SQL injection

One of the security principles is sanitize string and variables passed from client to server; SQL injection is one of the way to hack a website. in plain PHP there are some functions to prevent SQL ...
2
votes
3answers
569 views

How can i get prepared for DRUPAL-PSA-2016-001?

The PSA for tomorrow left me a bit uncomfortable. Quote: The Drupal Security Team urges you to reserve time for module updates at that time because exploits are expected to be developed within ...
1
vote
2answers
439 views

Which Drupal versions are affected by the vulnerabilities in advisory PSA-2016-001?

There is an PSA about the 2016-July-13 Security Advisory of several critical updates: View online: https://www.drupal.org/node/2764899 Advisory ID: DRUPAL-PSA-2016-001 Project: Drupal ...
1
vote
2answers
1k views

How do I redirect to www and https in settings.php?

I want to include code in settings.php which would handle redirects to the www alias and also https. Because it is for a distribution I would prefer not to have hard-coded URLs and I would also ...
0
votes
1answer
29 views

How can I display a page element based upon security?

If I want to hide or show a DOM element, say a button that can show further information because the logged in user is a manager, how can I do that in Drupal 8? Do I need to create separate pages for ...
1
vote
1answer
28 views

I'm using CiviContribute and need CAPTCHA

I'm new to Drupal and CiviCRM. I work mostly with Blackbaud/NetCommunity. I'm operating a website that using CiviContribute for donations. Our Payment Processor is Paypal Payments Pro. I'm trying to ...
1
vote
1answer
312 views

How to apply xss filter on a csv file

I have a CSV file from which I am importing some data. Should I need to apply XSS filter? How do I achieve this? while (!feof($handle)) { $data = fgetcsv($handle); $path[] = $data[0]; $...
2
votes
3answers
2k views

How to remove malicious scripts from admin pages after being hacked?

The site running Drupal 7 was hacked and every administration page, e.g. http://www.anysite.com/en/admin/dashboard contains script tag in head section with malicious src attribute, e.g. <head>...
1
vote
0answers
628 views

Update database/dom after dialog button submitted with jQuery

Clicking a dialog button I want to update Drupal database using jQuery .ajax() function! I want to know if in first place is secure to do so or is another method to handle the synchronous requests? ...
0
votes
1answer
55 views

warning message after uprgraded to drupal 6.38

I upgraded drupal 6.2 to drupal 6.38 to apply the security patch to ignore the vulnerabilities as mentioned in https://www.drupal.org/drupal-6.38-release-notes . But after updating to 6.38 when i ...
2
votes
1answer
50 views

How do I secure pages and related media files?

I would like to password protect Drupal pages (solved) and media files related to these pages (solved, but not optimally). Currently the Drupal pages are secured via Drupal and the media files via ...
1
vote
1answer
839 views

How do I handle third-party API credentials in settings? [closed]

I am building a module that will need to integrate credentials for the 3rd party service in Drupal 8. The module's admin panel should remember the credentials and use them to interact with the service,...
1
vote
0answers
19 views

site hacked: ctolls cercoincontri [duplicate]

one of the web site (in Drupal 7.43) I am looking after (apparently not that well, although updates have always been applied) has been hacked. There's now extra text in the footer pointing to an ...
3
votes
2answers
107 views

How can I ensure I retain access to a Drupal site after handing it over to a client?

Does Drupal have a mechanism which will allow me to keep control over a site after handing it over to a client? If things go wrong with the client relationship, I need to be sure I still have control ...
0
votes
2answers
85 views

Update to Search API 1.18 causes HTML to be displayed as plaintext

A security update to Search API (7.x-1.18) adds new sanitation as a security measure. Great! ..Except it now causes my custom field to be displayed as plaintext instead of HTML. Here is the ...
0
votes
0answers
124 views

How good is the default encryption method provided by the Encrypt module?

I want to encrypt certain field values from webform submissions and will use webform_encrypt module to achieve this. This is dependant on encrypt module. I am interested to know how satisfactory are ...
0
votes
1answer
117 views

Delete cookie just before render

I am trying to hide the fact that I have a Drupal site (as much as possible). The idea is that if a would be hacker (I am not talking about some ninja that could break into the pentagon) looks at ...
0
votes
1answer
32 views

How does Drupal ensures that the one time unique URL used to reset user password does not get transferred away inside the http_referer header?

For example in case the site relies on and loads some external JS (such as jQuery via CDN). Quite technical but any insights are highly appreciated. Thanks.
1
vote
1answer
436 views

What to do for “Login attempt failed for admin.” and “Access denied” to path admin?

In Watchdog, I started seeing several entries like this: Login attempt failed for admin. And access denied 2016/04/04 - 15:06 admin These are generating a fair number of log entries. The IP ...
0
votes
1answer
157 views

How did the ransomware get in? [closed]

A site where the site owner put off having updates done has been compromised with ransomware. This situation brings up a lot of questions. A Google search has not produced any answers. The server is ...
0
votes
1answer
538 views

Permanent Cookie Contains Sensitive Session Information [closed]

I have a cookie question in regards to a security scan (via IBM Rational AppScan) conducted on a drupal(7.43) site. The security scan failed with the following error: (Permanent Cookie Contains ...
0
votes
0answers
14 views

Why settings.php does not redirect to homepage so it betrays that the file is in that exact location even if moved by security reasons? [duplicate]

I have checked that www.example.com/sites/default/settings.php is reachable via web browser, even if it returns an empty page. What is more strange, in Drupal org webpage, http://www.drupal.org/sites/...
0
votes
1answer
25 views

Looking for informaton on Drupal core security process, audits and benchmarking

I'm looking for information on Drupal's security processes, any audits carried out, benchmarking against securty standards, what happens security-wise before a new Drupal release etc... The most ...
2
votes
0answers
33 views

How to handle user 1 with PCI compliance [closed]

PCI compliance states there can be no shared accounts. Typically between developers user 1 is shared and utilized for things that require user 1, but that would violate the PCI rules. Is there a way ...
1
vote
1answer
135 views

Increase security on logon

I am using Logintoboggan module but by chance by playing around with Wireshark packet sniffing tools I can see all login details and passwords when users login/register on my site! Is there a way to ...
2
votes
1answer
109 views

Add Encryption to Images

Is there a way to add encryption to images once they are uploaded on the website and stored on the server?
1
vote
1answer
42 views

Secure file download from other server

This is an unusual one. Let's say I have two web servers A and B. How would I go about making a link to a file from a Drupal website on server A to a file on server B such that the link is secure (the ...
2
votes
1answer
619 views

How can I exclude API keys, passwords, and so on from configuration management?

I am using Drupal 8 and drush cex to commit my configuration to my repository. However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive ...
2
votes
2answers
101 views

Is this a possible attack on database?

In the logs (Drupal 7), I have seen the next entry (I have edited some compromised info). It seems a failed (only I hope it actually failed) attempt to access the login account. I have tried to ...
0
votes
0answers
17 views

How to check for drupal page routine, no form submit working

On my drupal website, I suddenly can't submit any form successfully. The page appears to reload but does not go anywhere, stays exactly where any form is. Using drush uli, I can get in as admin but ...
4
votes
1answer
1k views

Multiple login attempts from different IP Addresses

My website has been getting about 25 login attempts per hour for the past few days for usernames admin, administrator and our website name. The attacker seems to be using differing IP addresses and ...
8
votes
2answers
418 views

Why is settings.php in the web folder?

In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a ...
2
votes
1answer
50 views

Can I temporarily stop update notifications for one project only? [duplicate]

Is there a way I can tell Drupal not to notify me about a particular version of a module? For example, if it isn't security related and I choose not to update one module but would like to receive ...

1 2
3
4 5
9