Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

71 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
0
votes
2answers
40 views

Prevent users from including their username in their password

I'm aware of the Password Policy module that has a number of features for forcing the user to constrain their passwords to certain criteria, but this module does not contain an option to prevent users ...
0
votes
1answer
49 views

The administrator menu disappeared

I added the following code in my .htaccess file : <IfModule mod_headers.c> Header set Set-Cookie HttpOnly;Secure Header always set X-XSS-Protection "1; mode=block" Header always set X-...
0
votes
0answers
113 views

How good is the default encryption method provided by the Encrypt module?

I want to encrypt certain field values from webform submissions and will use webform_encrypt module to achieve this. This is dependant on encrypt module. I am interested to know how satisfactory are ...
0
votes
1answer
109 views

Delete cookie just before render

I am trying to hide the fact that I have a Drupal site (as much as possible). The idea is that if a would be hacker (I am not talking about some ninja that could break into the pentagon) looks at ...
0
votes
0answers
17 views

How to check for drupal page routine, no form submit working

On my drupal website, I suddenly can't submit any form successfully. The page appears to reload but does not go anywhere, stays exactly where any form is. Using drush uli, I can get in as admin but ...
0
votes
0answers
104 views

code automatically changing on me - iframe not working consistently - IE11 cross-site scripting error

I have created a Basic Page and put code in the body for an iframe so we can connect to our university library publication system. I'm doing this for all our users with publications. I had about 20 ...
0
votes
1answer
15 views

Is necessary any sanitization functions if I use the database layer correctly

In Writing secure code said: Use the database abstraction layer to avoid SQL injection attacks Then, my question: When I get value for a user form is necessary pass to check_plain() or others ...
0
votes
1answer
31 views

Are spam registrations a threat to a Drupal 7 site

Yesterday, as I was explaining to a client that someone would need to remove spam registrations, the client asked me what difference it made if they are in the system because we can just turn off all ...
0
votes
0answers
41 views

Prevent image uploads with embedded code

I have a site which allows anonymous users to create a node with an image (the site allows people to submit images with quote memes so that the authenticity of the quote can be verified, quotefail.com)...
0
votes
1answer
49 views

Panopoly WYSIWYG exclude buttons configurations

Can anyone tell me if it's possible to configure the Panopoly wysiwyg to we can have different buttons available to different roles? At the moment, without have to create a module, I can't find a ...
0
votes
1answer
30 views

Boost Security_review compatibility

I had security_review warning for boost cache folder. I've changed cache folder location to "sites/default/files/cache" And now I have no warning. Is this solution correct and safe?
0
votes
3answers
388 views

How to automatically put your site into maintenance mode if at least a critical security update is available?

I think I'm craving for this functionality. What I want is, if after a CRON run, Drupal detects that such a security update is available, the site would be taken down for maintenance mode to avoid ...
0
votes
0answers
87 views

Drupal 7 multisite password protect single site

I am running a Drupal 7 multisite platform in which sites will be added at a later date to a live version of the website. During the testing process I need the new sites to be on their final live ...
0
votes
1answer
119 views

How to block the user after a few failed logins

modules like login security deny the user IP after afew failed logins. there are softwares that randomly generate new IP for user so it makes such modules useless. sending cookie to the user browser ...
0
votes
0answers
47 views

How to externally register a new user without accessing /user/register?

I have a (Drupal 7) site which uses LDAP to authenticate logins according to an Active Directory groups only. In the Apache config file, the URLs '/user' and '/admin' are both blocked externally. ...
0
votes
0answers
689 views

Access denied for image urls created via image style although derivative token is appended?

I want to apply an image style to an image and use it via CSS: if (isset($node->field_images_image['und'][0]['filename'])) $vars['blurred_background'] = image_style_url('background_blurred', '...
0
votes
0answers
388 views

D7 Organic groups and securing private files

I'm looking for a current solution for private file protection in D7 (so files uploaded without a node can be hidden from unauthorized users). I saw this question, organic groups and private files, ...
0
votes
0answers
66 views

Strange behaviour,it may be an attack

I have a political website, and I expect attacks anytime. Yesterday, someone told me on my Facebook page that he will hacker me; I blocked him immediately. Today, when I tried to create a user on the ...
-1
votes
0answers
8 views

Installing security updates on Drupal 7.3.4 hosted on Windows 2012 R2 IIS 8.0

I am brand new to Drupal. I have noticed that there are security updates avaialble for my version. When I select the first item requiring an update and select download I get the following error HTTP ...
-1
votes
1answer
52 views

How to write custom node_access that works with searchapi?

I'm trying to write a custom node access module, implementing hook_node_access. I have a searchapi index of all my nodes, which I would like to return results that obey the hook_node_access ...
-3
votes
0answers
23 views

Scan error of “The following CGIs are not protected by a random token”

A scan run against my Dev Drupal 7 website lists the following error: The following CGIs are not protected by a random token: /contact-ocr /civ-rts-coordinators The content of these 2 URLs are ...