Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

71 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
1answer
106 views

Mixed content issue while running updates.php in Drupal 6.37

We are facing this issue again for Drupal version 6.37. We do not have jquery update module installed. In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...
2
votes
1answer
116 views

Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?

I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
2
votes
0answers
139 views

How can I conditionally insert extra header data on Drupal 6 pages?

I'm using Drupal 6 with the WebForms module, and my entire site uses https. I need to insert some cache-control statements in the page headers of only certain pages (ones with forms on them). Is ...
1
vote
1answer
192 views

security kit module settings are blocking own site jQuery calls

I am using Security kit module to enhance security for my website. In that I have enabled Enable JavaScript + CSS + Noscript protection option. This setting is blocking one of Jquery call that is ....
1
vote
0answers
258 views

Drupal not detecting updated Trusted Host Settings

I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message: TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is not configured in ...
1
vote
1answer
202 views

How to add security questions in Drupal 8?

I need to add security questions while user creating his account in Drupal 8. I need to use those security questions to retrieve his password, when user forgets his password. Any suggestions ?
1
vote
1answer
28 views

How to securely access the data from another Drupal instance?

I have a site setup which feels fairly unconventional so please bare with me while I try to explain. I have 2 Drupal sites based on different servers. The main site (site A) contains the front-end ...
1
vote
1answer
16 views

Entity Reference + View + security

I have this scenario in DRUPAL 7 A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian). A content type named "Reports" with a field "...
1
vote
2answers
41 views

Best practice, removing admin access from many websites

hopefully this is not a repeat question, not sure how to search for this. I run over 50 websites, not all are on the same server but some do hold many users together. Not all our servers are ours, ...
1
vote
0answers
54 views

Keeping sensitive data from appearing in cache_form table

I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the ...
1
vote
0answers
21 views

Any security issues accessing $_POST and returning values from it in AJAX commands?

Just wondering if there needs to be any sanitization here: /** * Implements hook_ajax_render_alter(). */ function my_module_ajax_render_alter(&$commands) { if (isset($_POST['...
1
vote
1answer
26 views

I'm using CiviContribute and need CAPTCHA

I'm new to Drupal and CiviCRM. I work mostly with Blackbaud/NetCommunity. I'm operating a website that using CiviContribute for donations. Our Payment Processor is Paypal Payments Pro. I'm trying to ...
1
vote
0answers
594 views

Update database/dom after dialog button submitted with jQuery

Clicking a dialog button I want to update Drupal database using jQuery .ajax() function! I want to know if in first place is secure to do so or is another method to handle the synchronous requests? ...
1
vote
1answer
371 views

What to do for “Login attempt failed for admin.” and “Access denied” to path admin?

In Watchdog, I started seeing several entries like this: Login attempt failed for admin. And access denied 2016/04/04 - 15:06 admin These are generating a fair number of log entries. The IP ...
1
vote
1answer
112 views

Using the back button after logging out shows you pages from the authenticated user's session

Using the back button after logging out shows you pages from the authenticated user's session. I found a solution for this, need to set the header like this to fix this issue- drupal_add_http_header(...
1
vote
2answers
100 views

Is it safe to send the unencoded JSON output?

The mobile app developers wants an api to get a list of articles from our Drupal site. It should have these fields in the output: nid title field_teaser_body The api resonse has to be in JSON format....
1
vote
1answer
31 views

How to apply node access rules when querying menu_links table

I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way ...
1
vote
0answers
41 views

Is Commerce Stripe any more or less secure than Commerce Paypal?

The very first thing the Commerce Stripe module states is this: As of the implementation of PCI-DSS 3.0 (January 2015), this module is intended to work within the requirements of the Self ...
1
vote
0answers
165 views

Using captcha in varnish setup

Captcha and any form of page caching don't get along. I understand why this is, but i'm wondering if there might be a certain setup to use captcha even in cached environments. Post requests for ...
1
vote
0answers
99 views

Are HTTP headers and cookies validated against malicious input?

I'm developing a Drupal site for a government organisation and am required to fill in a security assessment form. The form asks for confirmation that the "application" (Drupal in this case) takes ...
1
vote
0answers
135 views

Drupal update system not detecting latest (security) releases

This morning I got e-mails about security updates and I know one of the modules, path_breadcrumb is installed on some of my sites. So I ssh into these sites, do drush pm-update --security-only and it ...
1
vote
1answer
132 views

How to save POST variables securely using entity api

I am creating a module that connects Drupal Commerce to Shipworks (a shipping management system). They communicate with each other using HTTP POSTs via a single endpoint URL on Drupal. One aspect I am ...
1
vote
0answers
70 views

Drupal site blocked by Windows defender

Visiting my Drupal 7 site just now with IE 11, I get this message: Windows Defender blocked content on this website lx7pyv.dofeqilr.com Hosted by: mysite.com Recommended icon Go to ...
1
vote
0answers
46 views

What are the appropriate file security settings and Apache settings for Drupal sites running on a VPS?

I would be grateful for some help on this one - I have looked at the other posts on this subject with interest, but they don't seem quite to fit my situation. I'm not a great Unix expert, but there ...
1
vote
0answers
699 views

$base_url is set in settings.php but Security Review flags it still

I get this message in Security Review report: Base URL is not set in settings.php even though my settings.php code has this: $base_url = 'https://www.mysite.com'; I cleared caches several times, ...
1
vote
0answers
295 views

Captcha on login form using the form block module

I am providing the registration form using the form block module. I also have Captcha and Hidden Captcha module enabled on mysite. However i am not getting the option to add a captcha to the ...
1
vote
0answers
38 views

Are there any security implications for having the Temporary Directory inside the Drupal root folder?

I'm having trouble finding the tmp dir of a particular host and I'm wondering if there is any reason not to just stick it inside the Drupal root.
0
votes
0answers
27 views

Securing Admin on separate port

I am attempting to secure the admin pages (/admin/*) and login page (/user/login) to port 8443. I have successfully done that with the following in apache 2.4: <VirtualHost _default_:443> ...
0
votes
1answer
51 views

Node field not sanitize on render

I have a form for users who want to add new content on my Drupal 8 website. I render node field on a twig template : {{ node_field_title.value }} But field are not sanitized by Drupal. Is it the ...
0
votes
0answers
31 views

Update Symfony before Drupal core?

Right now there are some security updates for Symfony: curl -sS https://get.symfony.com/cli/installer | bash echo y | ~/.symfony/bin/symfony self:update ~/.symfony/bin/symfony security:check Symfony ...
0
votes
0answers
21 views

766 security update database schema errors

After updating to 7.66 and running update.php i get an error: Class name must be a valid object or a string in /home/breastcancertiss/public_html/includes/common.inc on line 8066 I have 6 schema ...
0
votes
0answers
18 views

Slideshow: Cgi Generic Command execution (time-based)

One of our customers received a notice from his PCI scan vendor that the requests in the MD_Slider module used by Views are not sanitized. The latest version is two years old and it could be correct. ...
0
votes
0answers
22 views

Missing config/default directory error after patching the latest critical vulnerability

After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file. drupal/core from 8.5.8 to 8.5.11 drupal/jsonapi from 1.7 to ...
0
votes
0answers
49 views

Proper security for settings.php

I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
0
votes
0answers
54 views

itok triggering modsecurity injection 942100

When identifying false positives with my Drupal 7 site running ModSecurity CRS 3.1, I noticed visitors were getting denied access to a page because that page loaded an image using itok?= which had 2 --...
0
votes
2answers
68 views

Security model and menu access

Drupal 8.6.1 I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc. ...
0
votes
1answer
40 views

How to always require email verification before accessing a page?

I have a custom page defined by hook_menu. I want signed in users to be required to verify their email every time they want to access it. The page will have buttons on it that would allow someone to ...
0
votes
1answer
18 views

How to add registry key verification step with the key being stored in another database

I am currently learning how to use Drupal through Udemy classes; I am a complete newbie. I am building a Drupal Website, for my personal development, and when someone wants to register to the ...
0
votes
1answer
26 views

Custom Module Remote Fails Checksum with Drush

Background I have several proprietary Drupal modules that my company uses. We want to update these across all our sites. To that end, I've built an endpoint that produces code according to the (ill-...
0
votes
0answers
72 views

(Answered) Ajax link for anonymous users to delete node they created if $_SESSION exists. Is node's created timestamp secure enough in link?

I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away. Instead of forcing them to create an account and take ...
0
votes
1answer
52 views

Views php field or filter to a file or module

If I already have a view with a php filter or a php field, in drupal 7, how can I convert my whole view into a page? (prevent code injections or other security risks) What is the right way to resolve ...
0
votes
0answers
347 views

Basic authentication for external application making requests to Drupal instance

I have a external application that makes requests for content in my Drupal 8 instance. What I want to do is to make sure Drupal is only talking go my external application to stop traffic being spoofed....
0
votes
3answers
23 views

Find the password for user admin from a replicated old version of site

I have access to a copy of an old version of a production site on a dev server, but the owner of the website on prod has lost his credentials to admin and doesn't know his ssh login credentials. The ...
0
votes
0answers
118 views

Where do I store the encryption.key file?

According to the instructions on the AES encrypt project page, I should create an encryption.key file. Create a new 128 bit encryption key. A good way to do this is in the command line using ...
0
votes
1answer
248 views

PDO Exception shows full path

I have a vulnerability in my Drupal 7 site that if there is no mysql connection establish then PDO through the exception like below: PDOException: SQLSTATE[HY000] [2002] No connection could be made ...
0
votes
0answers
867 views

How to make all URL redirect to HTTPS

There is already a lot of links displaying videos inside my site (in node content) that are using: http://example.com/clips/2017/01/11/51706, http://www.example.com/clips/2017/01/11/51706, https://...
0
votes
0answers
18 views

Restricted visibility and search engine

The search engine crawler, like Googlebot, doesn't index any data, which is set to be visible only particular user, right? For example, let's say I have fields named field_A & field_B on user's ...
0
votes
1answer
23 views

Is it safe to use $vars['name_raw'] instead of $vars['name']?

I ran into an issue with usernames being trimmed in articles. I found a thread here with a fix suggesting to use $vars['name_raw']: https://www.drupal.org/node/854762#comment-7614255. It works. But I'...
0
votes
1answer
23 views

Web forms senders to make their email secure

Make Web forms secure- can we have an option for senders to make their email secure when sending private information back like account numbers, is there an option for this in Drupal or is it possible ...
0
votes
0answers
249 views

Safe way to login a user programmatically

I know that with the following code we can login a user programmatically. $username = "someuser"; $password = "somepass"; $uid = user_authenticate($username, $password); if ($uid) { $form_state = ...