The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
0
votes
3answers
248 views

Drush error on core update “corrupt (wrong md5 checksum)”

I'm getting this error when I try to update core with Drush: File drupal-7.41.tar.gz is corrupt (wrong md5 checksum). [error] Updating project drupal failed. Attempting to roll back to previously ...
1
vote
1answer
118 views

Using the back button after logging out shows you pages from the authenticated user's session

Using the back button after logging out shows you pages from the authenticated user's session. I found a solution for this, need to set the header like this to fix this issue- drupal_add_http_header(...
8
votes
1answer
783 views

What do blocked IP addresses see?

I have been getting a lot of failed attacks targeting my server in the last few months. I have been using the Drupal IP block to block IPs that where sniffing for vulnerabilities. I would like to know ...
1
vote
2answers
104 views

Is it safe to send the unencoded JSON output?

The mobile app developers wants an api to get a list of articles from our Drupal site. It should have these fields in the output: nid title field_teaser_body The api resonse has to be in JSON format....
0
votes
1answer
492 views

Getting password hashes and salts from Drupal 7

I need to get user accounts' password hashes and salts from a Drupal 7 app, so as to migrate these accounts into Stormpath. Could you please help me to figure out where this data is stored and how to ...
3
votes
1answer
190 views

Is uploading/download executable files harmful in drupal? [closed]

In my site design, I have a field that is designed to hold an executable file (.exe, .bat, etc), for users to upload and download. I took pause as I was typing these extensions into the Allowed file ...
0
votes
1answer
81 views

Can a disabled module pose a security risk?

Is it possible for a module that is installed but not enabled to pose a security risk? Corollary question: Is it a recommended practice to update disabled modules when security updates become ...
2
votes
1answer
107 views

Mixed content issue while running updates.php in Drupal 6.37

We are facing this issue again for Drupal version 6.37. We do not have jquery update module installed. In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...
-2
votes
1answer
138 views

Is this way safe to bootstrap Drupal from an external PHP script? [duplicate]

I want to bootstrap Drupal from an external PHP file located in Drupal's root directory. The following code will do the job. error_reporting(E_ALL); ini_set("display_errors", 1); define('DRUPAL_ROOT',...
1
vote
1answer
31 views

How to apply node access rules when querying menu_links table

I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way ...
0
votes
1answer
36 views

how to provide security to user Profile?

I want to provide security to user profile, so that purpose am adding two check boxes Account Settings List item Make my profile only visible to members of my website members only. Make my profile ...
1
vote
1answer
66 views

Users with no roles are getting onto my system

I am having an issue with my site, there are users accessing it and creating accounts without having a role. Here we can see user roles is blank. From my understanding someone has found a weakness in ...
1
vote
1answer
518 views

How to extend flood control in a custom module?

I would like to use Drupal's flood control capability in another module. I have a resource I'm protecting with a password. Can I simply call flood_register_event() and otherwise use the variables as ...
1
vote
1answer
53 views

How can I evaluate the security of a contrib module?

Are there security standards for each stage of a module on Drupal.org? Create sandbox project > full project with dev version only > official release What is the process for the security of ...
2
votes
1answer
178 views

My site is hacked [duplicate]

It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code: $sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$...
3
votes
1answer
199 views

What is the best way to restrict website's direct access through node urls? [duplicate]

How can I prevent a node from being accessible on its own page, through node/xxx, but still be accessible through node description eg: /homepage? I tried using the Rabbit Hole module, which ...
0
votes
1answer
15 views

Is necessary any sanitization functions if I use the database layer correctly

In Writing secure code said: Use the database abstraction layer to avoid SQL injection attacks Then, my question: When I get value for a user form is necessary pass to check_plain() or others ...
1
vote
0answers
88 views

Updating drupal commons issue [duplicate]

Security Update for drupal All other updates are being done smoothly thorugh drush I have a multi site installation if drupal so i worried to remove the sites folder and update that the general way. ...
1
vote
0answers
41 views

Is Commerce Stripe any more or less secure than Commerce Paypal?

The very first thing the Commerce Stripe module states is this: As of the implementation of PCI-DSS 3.0 (January 2015), this module is intended to work within the requirements of the Self ...
0
votes
1answer
31 views

Are spam registrations a threat to a Drupal 7 site

Yesterday, as I was explaining to a client that someone would need to remove spam registrations, the client asked me what difference it made if they are in the system because we can just turn off all ...
1
vote
1answer
14 views

How can I monitor for bot accounts accessing drupal paths without permission?

On my site, users do not have permission to create content. However, looking through the watchdog logs, I found several accounts that were attempting to access node/add/article node/add/page and so ...
1
vote
0answers
168 views

Using captcha in varnish setup

Captcha and any form of page caching don't get along. I understand why this is, but i'm wondering if there might be a certain setup to use captcha even in cached environments. Post requests for ...
6
votes
1answer
4k views

How to override “This image has been removed”?

I'm using Drupal core 8.0.0-beta10. I just tried to add new basic page content that contains image to external website and while it's showing up in preview, image isn't showing up once page is ...
1
vote
1answer
980 views

How to add 'style=“width:100px”' in Global Custom Text field in a view?

It seems that the Global Custom Text field in a view delete part of my text. I write this: <div class="my-class" style="width:100px">Hello</div> but get this: <div class="my-class"&...
1
vote
0answers
100 views

Are HTTP headers and cookies validated against malicious input?

I'm developing a Drupal site for a government organisation and am required to fill in a security assessment form. The form asks for confirmation that the "application" (Drupal in this case) takes ...
0
votes
1answer
38 views

Is there any other way to create more secure link in a drupal_set_message?

Is there any other way to create more secure link in a drupal_set_message?? $loglink = l("bla bla", 'admin/config/services/blabla'); drupal_set_message(t("You should not have empty or the default ...
3
votes
2answers
719 views

OWASP security and drupal

Recently, To improve our site security we implemented and enabled OWASP security in our server using mod_security. After we enabled the OWASP security, whenever I try to create or edit contents in my ...
0
votes
1answer
549 views

Another question on Drupal files folder permissions and security

So there are the following two posts (among others) that say 755 is okay for the sites/default/files directory: What are the recommended directory permissions? Confusion about files permission I ...
3
votes
1answer
107 views

Trying to make my entire site https

I am trying to make an entire Drupal site https. I tried enabling secure pages, and this seems to work for every authenticated user. However any anonymous user either gets only http, or possibly an ...
1
vote
1answer
349 views

Is json_decode parse-ability proof of a safe string?

Do I need to use check_plain (or something else) when displaying a user supplied JSON string, when I have previously checked it successfully parses with json_decode?
0
votes
1answer
88 views

Should user input be able to cause an unhandled exception?

Drupal 7's user login form (and I dare say others) can be tampered with client-side, to cause Drupal to throw an unhandled exception. All you need to do is change the input fields, appending [] to ...
2
votes
1answer
3k views

Annoying Drupal Hack keeps changing bootstrap.inc and writes cryptic files to sites/default/files/styles

I'm having huge issues with a massive hack of our website. It was running Drupal 7.32 last year, when a big security issue was announced. Unfortunately we came too late and the site was hacked. For ...
2
votes
3answers
252 views

What is good way to hide update.php file?

I will like to know what is the correct/better way to hide update.php file on the production server. Currently when you try to access update.php file, Drupal shows default access denied page with ...
4
votes
1answer
804 views

Running Drupal 6 with PHP 5.3 and Maintaining Security [closed]

I have a number of Drupal 6 sites that I can't upgrade at this time due to sheer lack of time to do so (it would be a major overhaul). Therefore, I am required to continue running PHP 5.3 on my server,...
0
votes
1answer
27 views

Two concerns: Available for security updates / Image captions

I am looking at revamping a set of sites from ASP to Drupal. I like a lot of what I see in Drupal, but have two concerns: In reading about Drupalgeddon, it seems that the problem was that many people ...
2
votes
1answer
104 views

Maintaining Old Drupal Versions [closed]

Is there a list of best practices (or anything on drupal.org) for maintaining Drupal versions after end-of-life, specifically, when upgrading isn't an option? The best solution, of course, is to ...
6
votes
1answer
3k views

Will changing the value of $drupal_hash_salt in settings.php file break site

I was looking through a list of steps to take when there is a risk that your site has been hacked. It recommends changing the value of $drupal_hash_salt in settings.php. According to the inline ...
1
vote
4answers
509 views

How to recover content/configuration from a hacked site

I have a situation where I am faced with two sites which were vulnerable to the Drupageddon SQL injection exploit. I am looking at what is the best strategy for recovering these websites. Given that ...
1
vote
1answer
150 views

Updating from 7.34 to 7.35 after successfull update, drush status shows version 7.34?

Recently i tried to upgrade my site from 7.34 to 7.35 everything when successfully but when i go to status report or executing drush status command it shows that im still on drupal 7.34. These are ...
0
votes
0answers
42 views

Prevent image uploads with embedded code

I have a site which allows anonymous users to create a node with an image (the site allows people to submit images with quote memes so that the authenticity of the quote can be verified, quotefail.com)...
2
votes
1answer
89 views

Is there any sensitive data in the Configuration Management Export?

I noticed in default.settings.php this comment: Location of the site configuration files. The $config_directories array specifies the location of file system directories used for ...
0
votes
1answer
132 views

How to edit module file to make layout changes?

I have installed module Security Questions to allow users to answer security question while retrieving the password. It works fine. But I'm facing layout issue with it. How can I edit this module so ...
2
votes
2answers
2k views

How do I set the private file system path's permissions?

There is an option in Configuration > File system which let you define a path for private files. After setting a path in this field, the access for all users is restricted (including admin). I need ...
0
votes
1answer
49 views

Panopoly WYSIWYG exclude buttons configurations

Can anyone tell me if it's possible to configure the Panopoly wysiwyg to we can have different buttons available to different roles? At the moment, without have to create a module, I can't find a ...
2
votes
1answer
340 views

Should you use check_plain() prior to inserting into database?

I am currently using check_plain() etc on displaying user entered data in HTML, and I am also using check_plain() etc prior to inserting the user data into my custom tables. When inserting or ...
4
votes
2answers
258 views

Why did Views just jump from 3.8 to 3.10 (what happened to 3.9)?

There was a security advisory issued for Views yesterday, but the new version is two ahead of the last (3.10 to 3.8). What happened to 3.9? The Views release page doesn't list a 3.9, or a reason why ...
1
vote
0answers
137 views

Drupal update system not detecting latest (security) releases

This morning I got e-mails about security updates and I know one of the modules, path_breadcrumb is installed on some of my sites. So I ssh into these sites, do drush pm-update --security-only and it ...
3
votes
1answer
549 views

Why does default.settings.php suggest writing the value of the hash salt in an external file?

The default.settings.php file contains the following comment: For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that this ...
0
votes
1answer
30 views

Boost Security_review compatibility

I had security_review warning for boost cache folder. I've changed cache folder location to "sites/default/files/cache" And now I have no warning. Is this solution correct and safe?
1
vote
2answers
81 views

Removing potentially malicious code from template

Our drupal site was hacked at some point recently, and I've been tasked to clean it up because nobody knows much about drupal here. I think I've taken care of most of the glaring security holes, and ...