Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

1
vote
1answer
214 views

How Encrypt module actually works?

I installed the Drupal Encrypt module and enabled it. However, I wonder how this module actually works. Does it encrypt all the submissions from the browser that the user/admin key in like 1) Login 2)...
1
vote
1answer
34 views

Securing folder in Custom Module for Drupal 6

I wrote a custom module, which logs errors to an external text file. The files are kept in /sites/all/modules/custom/my_module/logging/ The problem is, if the user know the name of the file, they ...
0
votes
1answer
50 views

Ambiguity of using '.' as a separator in the site directory name might have security implications?

In a Drupal installation, which is served through the web server's default server config (i.e. it gets any request for an otherwise unknown domain) I have a settings file at DRUPAL_ROOT/sites/example....
-1
votes
2answers
50 views

Safety of letting user define javascript paths in fields

I have a module that uses the Fields API to insert a HTML5 canvas element and allows users to define paths to user scripts to be loaded with the page: The scripts are relative to a hard-coded path ...
0
votes
1answer
115 views

Security concerns with cache_get() and cache_set()

are there any security concerns with Drupal's cache_set() and cache_get() functions? I mean, I receive some values through an Ajax-GET-request. Can I pass them to the two functions with the following ...
1
vote
1answer
49 views
0
votes
1answer
73 views

Odd log entries: is it indicative of an attack?, is there anything other than IP blocking that I should do? [closed]

So I've been getting some odd log entries in my Drupal 7 install: Here's two: As far as I can see they haven't done anything and I've blocked the IP addresses but they keep coming with different IP ...
0
votes
0answers
32 views

Is my Drupal website hacked? [duplicate]

So I am running this Drupal 7 website, I just checked users list and got surprised with this: As you can see the usernames are spam and their emails are also spam. But I do not get it how they did ...
1
vote
1answer
51 views

Site affected by PSA-2014-003, revoke all public keys?

I didn't patch my website right after PSA-2014-003, it run about one week unpatched. Now, I'm moving my website to a new server, using an old database backup. In my old server, I used an passphrase ...
0
votes
1answer
177 views

Can't access my website

I can't access my website. I guess it has been hacked. Some drupaldev user is already been created and is in admin list. I have blocked that user multiple times, but it reappears again and again in my ...
5
votes
1answer
2k views

Drupal reuses its hash salt

The instructions in default.settings.php say This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if ...
4
votes
2answers
964 views

After Drupal 7.32 should sql injection attempts create PDOExceptions?

I have the Logging and Alerts module installed on a few of my sites. Yesterday I noticed a series of notification emails with the following data. These produced PDOException exceptions and so far as I ...
4
votes
3answers
316 views

Is CiviCRM data vulnerable to the Drupageddon bug?

Would CiviCRM data have been exposed to a Drupageddon exploit if it happened before I updated the site to Drupal 7.32? CiviCRM is in a separate MySQL database. However, the site uses Views/CiviCRM ...
0
votes
0answers
28 views

All the sudden my site show rare characters and links doesn't work.Help [duplicate]

All the sudden my site (drupal 7) shows rare characters like �0�1�0� Also, the links doesn't work. All links in the site reload the home page. I can't access example.com/user neither. Please help. ...
1
vote
0answers
14 views

Auditing my D7 Site after upgrade to 7.32 w/ Zen [duplicate]

As a security nut case, I should have taken the last Drupal Core security update seriously. I did not, as we're in the process of building a brand new version of the website, and were planning on ...
2
votes
1answer
116 views

Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?

I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
1
vote
1answer
115 views

Aegir and SA-CORE-2014-005

Case: - Aegir server 2.1 on Drupal 6.31 -- Platform Hostmaster: Drupal 6.31 --- Hostmaster: ? -- Platform 1: Drupal 7.31 --- Site 1: HACKED --- Site 2: HACKED -- Platform 2: Drupal 7.32 --- Site 3: ? ...
1
vote
2answers
689 views

Unattended automatic security updates / upgrades [duplicate]

What is the best way to get Drupal to automatically perform security updates? And are people commonly employing such a method? For motivation, consider this: Drupal just released a PSA about a ...
1
vote
1answer
139 views

Drupal Commerce Authorize.net gateway and POODLE

I got a notice today that Authorize.net is going to shut off their SSLv3 protocol on November 4 (7 days from today) in response to the POODLE threat. I'm using Drupal Commerce's commerce_authnet ...
0
votes
3answers
1k views

How can I break into my own Drupal site?

I was doing a Media module tutorial. Half way through it I decided to install the tutorial companion files and foolishly replaced my files. In the companions readme it says the admin login is username ...
40
votes
7answers
13k views

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

I just updated all my sites using the patch method of resolving the Drupal SA-CORE-2014-005 exploit. I just read reports that just yesterday there is someone from a Russian IP infiltrating drupal ...
0
votes
1answer
122 views

Is it possible to use Google to find Drupal with a specific version of Drupal?

Ideally it wouldn't be possible to use Google or another search engine to find many Drupal installations with e.g. Drupal core 7.31. But I'm not sure if it's not. So I would like to know: is it in ...
0
votes
1answer
117 views

How to skip “Checked available update data for” all modules when I just want to update core or a specific module?

I'm upgrading a lot of my Drupal sites to 7.32. Unfortunately it takes a lot of time for each site because of some update check that I don't need. On How to upgrade only core with drush? I learned I ...
51
votes
3answers
32k views

How to upgrade only core with drush?

There's a huge security leak in <7.32. So I want to upgrade all my Drupal sites asap without too much worrying about breaking stuff. But... $ drush dl drupal-7.32 It's forbidden to download ...
33
votes
6answers
9k views

What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?

Reading up on https://www.drupal.org/node/2357241 and the technical details at https://www.drupal.org/SA-CORE-2014-005, as well as the actual patch which is simply: diff --git a/includes/database/...
1
vote
1answer
105 views

How to hide username displayed in code with Omega 3 theme

Drupal 7 with Omega version 3 theme generates a username class for the article tag in the HTML code, something like : class="node node-page node-published node-not-promoted node-not-sticky author-...
0
votes
1answer
1k views

Migrate user passwords salted and hashed with md5

I have quite complex migration for some legacy non drupal site to migrate it into D7. The whole migration works fine but it turned out that source user passwords are salted and hashed with MD5. ...
0
votes
3answers
383 views

How to automatically put your site into maintenance mode if at least a critical security update is available?

I think I'm craving for this functionality. What I want is, if after a CRON run, Drupal detects that such a security update is available, the site would be taken down for maintenance mode to avoid ...
0
votes
0answers
86 views

Drupal 7 multisite password protect single site

I am running a Drupal 7 multisite platform in which sites will be added at a later date to a live version of the website. During the testing process I need the new sites to be on their final live ...
5
votes
2answers
4k views

Remove XMLRPC to avoid vulnerability exploit

How is xmlrpc.php from Drupal core affecting functionality? Given the fact that a vulnerability was discovered for it, details in this article is it safe to remove xmlrpc.php file? Is it bad ...
1
vote
0answers
70 views

Drupal site blocked by Windows defender

Visiting my Drupal 7 site just now with IE 11, I get this message: Windows Defender blocked content on this website lx7pyv.dofeqilr.com Hosted by: mysite.com Recommended icon Go to ...
1
vote
0answers
46 views

What are the appropriate file security settings and Apache settings for Drupal sites running on a VPS?

I would be grateful for some help on this one - I have looked at the other posts on this subject with interest, but they don't seem quite to fit my situation. I'm not a great Unix expert, but there ...
1
vote
1answer
113 views

Where does field help text get filtered?

Drupal 7 fields, by default, have a nice text box beneath them for Help Text. This is set up with field_ui_field_edit_form(): $form['instance']['description'] = array( '#type' => 'textarea', '...
1
vote
1answer
137 views

Is someone trying to hack my site?

I was looking at my drupal site log messages and I´ve been having very weird ones as the ones attached. I was wondering if someone is trying to hack my site, if so, how can I prevent that? I have all ...
5
votes
4answers
4k views

Encrypting db password stored in settings.php

The db password in settings.php is stored as plain text. Is there any way to encrypt that password? My client says its a security risk even though the file permissions is as should.
2
votes
2answers
660 views

Secure pages and installing new modules (AJAX error)

I've just configured my website to work with secure pages and everything seems to be working fine except for the ability to install a new module. Whenever I try, I get this error: An AJAX HTTP ...
1
vote
1answer
98 views

Change in core module security risk

As interim solution to an issue in JavaScript, I changed the User module code, to disallow single quotation mark. I changed the following line. if (preg_match('/[^\x{80}-\x{F7} a-z0-9@_.\'-]/i', $...
8
votes
4answers
6k views

base_url for both http and https?

I have a site that is accessible both through http and https. I see the security review complains that base_url is not defined in settings.php. However when I define it as http://example.com, and ...
2
votes
1answer
1k views

rule to remove “Public files directory Not fully protected” in nginx?

I use D7 with nginx and php5-fpm on Linux and get this security warning: Public files directory Not fully protected I see here that one needs to use this snippet in Apache's htaccess to resolve ...
1
vote
1answer
1k views

$drupal_hash_salt is empty in my installations

This is the code in settings.php $drupal_hash_salt = ''; From what I know it should be a random string and I shouldn't change it at all and it has a direct effect on the website security. But why ...
10
votes
1answer
7k views

How and when to use filter_xss() and check_plain()?

There are lots of template files like this one views-view-fields--magazine--magazine.tpl.php in my website. how and when I should use the filter_xss() and check_plain() to improve security? for ...
0
votes
1answer
119 views

How to block the user after a few failed logins

modules like login security deny the user IP after afew failed logins. there are softwares that randomly generate new IP for user so it makes such modules useless. sending cookie to the user browser ...
4
votes
1answer
671 views

How safely allow untrusted users to use img tag?

Following this question, I'm wondering how can I allow users of a social site (which obviously are not all trusted) to upload images while avoiding XSS threats?
0
votes
1answer
178 views

How allowing img tag in formats can be dangerous?

I get this recommendation form Security review module: It is recommended you remove the following tags from roles accessible by untrusted users: img I am wondering what real world threats can ...
1
vote
1answer
373 views

Security issues while using external javascript and php files to access mysql database in drupal nodes

I have created a search_interface node which asks for filters and onClick event of the submit button, I have called an external search.js script. My search_interface node is of a custom content type ...
2
votes
1answer
492 views

What are the 'todos' when your database is hacked?

I want to plan for the terrible nightmare of my database being stolen. I feel I am secure, and I am not holding much actual data, but... if it does get taken - what do we do, is there a standard way ...
0
votes
2answers
71 views

Encrypt entire site - request access [closed]

How can I encrypt my entire site? I also need to require password and username to access site. When visitors are accessing site, they will be redirected to a login page where they can also request ...
0
votes
1answer
159 views

How to save database connection easy and safe?

I'm trying to let Drupal7 connect to several databases(pgsql) and update data automatically. So I use Database::addConnectionInfo($name,'default',$connString) And db_set_active($name). It works ...
1
vote
1answer
5k views

security report there is no .htaccess file in private:// directory

I have this security report that is constantly saying: Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your private:// directory which contains the following ...
2
votes
2answers
200 views

Drupal 7, Is there a module that detects file structure changes? [closed]

Recently one of my clients sites was hacked and hackers uploaded a few directories and files into the web root folder. I'm looking for a module or a method that has the ability detect file structure ...