Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

2
votes
1answer
106 views

Mixed content issue while running updates.php in Drupal 6.37

We are facing this issue again for Drupal version 6.37. We do not have jquery update module installed. In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...
2
votes
1answer
116 views

Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?

I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
1
vote
1answer
10 views

Configuring Fail2ban for the r4032login module

Recently, I installed fail2ban on my server to help prevent bots from abusing the site. I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the ...
1
vote
1answer
181 views

security kit module settings are blocking own site jQuery calls

I am using Security kit module to enhance security for my website. In that I have enabled Enable JavaScript + CSS + Noscript protection option. This setting is blocking one of Jquery call that is ....
1
vote
1answer
182 views

How to add security questions in Drupal 8?

I need to add security questions while user creating his account in Drupal 8. I need to use those security questions to retrieve his password, when user forgets his password. Any suggestions ?
1
vote
1answer
28 views

How to securely access the data from another Drupal instance?

I have a site setup which feels fairly unconventional so please bare with me while I try to explain. I have 2 Drupal sites based on different servers. The main site (site A) contains the front-end ...
1
vote
1answer
16 views

Entity Reference + View + security

I have this scenario in DRUPAL 7 A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian). A content type named "Reports" with a field "...
1
vote
1answer
26 views

I'm using CiviContribute and need CAPTCHA

I'm new to Drupal and CiviCRM. I work mostly with Blackbaud/NetCommunity. I'm operating a website that using CiviContribute for donations. Our Payment Processor is Paypal Payments Pro. I'm trying to ...
1
vote
1answer
363 views

What to do for “Login attempt failed for admin.” and “Access denied” to path admin?

In Watchdog, I started seeing several entries like this: Login attempt failed for admin. And access denied 2016/04/04 - 15:06 admin These are generating a fair number of log entries. The IP ...
1
vote
1answer
110 views

Using the back button after logging out shows you pages from the authenticated user's session

Using the back button after logging out shows you pages from the authenticated user's session. I found a solution for this, need to set the header like this to fix this issue- drupal_add_http_header(...
1
vote
1answer
31 views

How to apply node access rules when querying menu_links table

I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way ...
1
vote
1answer
131 views

How to save POST variables securely using entity api

I am creating a module that connects Drupal Commerce to Shipworks (a shipping management system). They communicate with each other using HTTP POSTs via a single endpoint URL on Drupal. One aspect I am ...
0
votes
1answer
40 views

How to always require email verification before accessing a page?

I have a custom page defined by hook_menu. I want signed in users to be required to verify their email every time they want to access it. The page will have buttons on it that would allow someone to ...
0
votes
1answer
18 views

How to add registry key verification step with the key being stored in another database

I am currently learning how to use Drupal through Udemy classes; I am a complete newbie. I am building a Drupal Website, for my personal development, and when someone wants to register to the ...
2
votes
0answers
139 views

How can I conditionally insert extra header data on Drupal 6 pages?

I'm using Drupal 6 with the WebForms module, and my entire site uses https. I need to insert some cache-control statements in the page headers of only certain pages (ones with forms on them). Is ...
1
vote
0answers
254 views

Drupal not detecting updated Trusted Host Settings

I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message: TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is not configured in ...
1
vote
0answers
53 views

Keeping sensitive data from appearing in cache_form table

I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the ...
1
vote
0answers
20 views

Any security issues accessing $_POST and returning values from it in AJAX commands?

Just wondering if there needs to be any sanitization here: /** * Implements hook_ajax_render_alter(). */ function my_module_ajax_render_alter(&$commands) { if (isset($_POST['...
1
vote
0answers
591 views

Update database/dom after dialog button submitted with jQuery

Clicking a dialog button I want to update Drupal database using jQuery .ajax() function! I want to know if in first place is secure to do so or is another method to handle the synchronous requests? ...
1
vote
0answers
41 views

Is Commerce Stripe any more or less secure than Commerce Paypal?

The very first thing the Commerce Stripe module states is this: As of the implementation of PCI-DSS 3.0 (January 2015), this module is intended to work within the requirements of the Self ...
1
vote
0answers
163 views

Using captcha in varnish setup

Captcha and any form of page caching don't get along. I understand why this is, but i'm wondering if there might be a certain setup to use captcha even in cached environments. Post requests for ...
1
vote
0answers
99 views

Are HTTP headers and cookies validated against malicious input?

I'm developing a Drupal site for a government organisation and am required to fill in a security assessment form. The form asks for confirmation that the "application" (Drupal in this case) takes ...
1
vote
0answers
134 views

Drupal update system not detecting latest (security) releases

This morning I got e-mails about security updates and I know one of the modules, path_breadcrumb is installed on some of my sites. So I ssh into these sites, do drush pm-update --security-only and it ...
1
vote
0answers
70 views

Drupal site blocked by Windows defender

Visiting my Drupal 7 site just now with IE 11, I get this message: Windows Defender blocked content on this website lx7pyv.dofeqilr.com Hosted by: mysite.com Recommended icon Go to ...
1
vote
0answers
46 views

What are the appropriate file security settings and Apache settings for Drupal sites running on a VPS?

I would be grateful for some help on this one - I have looked at the other posts on this subject with interest, but they don't seem quite to fit my situation. I'm not a great Unix expert, but there ...
1
vote
0answers
696 views

$base_url is set in settings.php but Security Review flags it still

I get this message in Security Review report: Base URL is not set in settings.php even though my settings.php code has this: $base_url = 'https://www.mysite.com'; I cleared caches several times, ...
1
vote
0answers
295 views

Captcha on login form using the form block module

I am providing the registration form using the form block module. I also have Captcha and Hidden Captcha module enabled on mysite. However i am not getting the option to add a captcha to the ...
1
vote
0answers
38 views

Are there any security implications for having the Temporary Directory inside the Drupal root folder?

I'm having trouble finding the tmp dir of a particular host and I'm wondering if there is any reason not to just stick it inside the Drupal root.
0
votes
0answers
28 views

Update Symfony before Drupal core?

Right now there are some security updates for Symfony: curl -sS https://get.symfony.com/cli/installer | bash echo y | ~/.symfony/bin/symfony self:update ~/.symfony/bin/symfony security:check Symfony ...
0
votes
0answers
20 views

766 security update database schema errors

After updating to 7.66 and running update.php i get an error: Class name must be a valid object or a string in /home/breastcancertiss/public_html/includes/common.inc on line 8066 I have 6 schema ...
0
votes
0answers
17 views

Slideshow: Cgi Generic Command execution (time-based)

One of our customers received a notice from his PCI scan vendor that the requests in the MD_Slider module used by Views are not sanitized. The latest version is two years old and it could be correct. ...
0
votes
0answers
21 views

Missing config/default directory error after patching the latest critical vulnerability

After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file. drupal/core from 8.5.8 to 8.5.11 drupal/jsonapi from 1.7 to ...
0
votes
0answers
48 views

Proper security for settings.php

I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
0
votes
0answers
48 views

itok triggering modsecurity injection 942100

When identifying false positives with my Drupal 7 site running ModSecurity CRS 3.1, I noticed visitors were getting denied access to a page because that page loaded an image using itok?= which had 2 --...
0
votes
0answers
16 views

public page on password protected site

I have a password protected site where I want unauthenticated users to access a public sign up page. where/how should permissions be provisioned to an anonymous users so that this works?
0
votes
0answers
70 views

(Answered) Ajax link for anonymous users to delete node they created if $_SESSION exists. Is node's created timestamp secure enough in link?

I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away. Instead of forcing them to create an account and take ...
0
votes
0answers
327 views

Basic authentication for external application making requests to Drupal instance

I have a external application that makes requests for content in my Drupal 8 instance. What I want to do is to make sure Drupal is only talking go my external application to stop traffic being spoofed....
0
votes
0answers
115 views

Where do I store the encryption.key file?

According to the instructions on the AES encrypt project page, I should create an encryption.key file. Create a new 128 bit encryption key. A good way to do this is in the command line using ...
0
votes
0answers
858 views

How to make all URL redirect to HTTPS

There is already a lot of links displaying videos inside my site (in node content) that are using: http://example.com/clips/2017/01/11/51706, http://www.example.com/clips/2017/01/11/51706, https://...
0
votes
0answers
18 views

Restricted visibility and search engine

The search engine crawler, like Googlebot, doesn't index any data, which is set to be visible only particular user, right? For example, let's say I have fields named field_A & field_B on user's ...
0
votes
0answers
244 views

Safe way to login a user programmatically

I know that with the following code we can login a user programmatically. $username = "someuser"; $password = "somepass"; $uid = user_authenticate($username, $password); if ($uid) { $form_state = ...
0
votes
0answers
110 views

How good is the default encryption method provided by the Encrypt module?

I want to encrypt certain field values from webform submissions and will use webform_encrypt module to achieve this. This is dependant on encrypt module. I am interested to know how satisfactory are ...
0
votes
0answers
17 views

How to check for drupal page routine, no form submit working

On my drupal website, I suddenly can't submit any form successfully. The page appears to reload but does not go anywhere, stays exactly where any form is. Using drush uli, I can get in as admin but ...
0
votes
0answers
103 views

code automatically changing on me - iframe not working consistently - IE11 cross-site scripting error

I have created a Basic Page and put code in the body for an iframe so we can connect to our university library publication system. I'm doing this for all our users with publications. I had about 20 ...
0
votes
0answers
41 views

Prevent image uploads with embedded code

I have a site which allows anonymous users to create a node with an image (the site allows people to submit images with quote memes so that the authenticity of the quote can be verified, quotefail.com)...
0
votes
0answers
86 views

Drupal 7 multisite password protect single site

I am running a Drupal 7 multisite platform in which sites will be added at a later date to a live version of the website. During the testing process I need the new sites to be on their final live ...
0
votes
0answers
47 views

How to externally register a new user without accessing /user/register?

I have a (Drupal 7) site which uses LDAP to authenticate logins according to an Active Directory groups only. In the Apache config file, the URLs '/user' and '/admin' are both blocked externally. ...
0
votes
0answers
689 views

Access denied for image urls created via image style although derivative token is appended?

I want to apply an image style to an image and use it via CSS: if (isset($node->field_images_image['und'][0]['filename'])) $vars['blurred_background'] = image_style_url('background_blurred', '...
0
votes
0answers
388 views

D7 Organic groups and securing private files

I'm looking for a current solution for private file protection in D7 (so files uploaded without a node can be hidden from unauthorized users). I saw this question, organic groups and private files, ...
0
votes
0answers
66 views

Strange behaviour,it may be an attack

I have a political website, and I expect attacks anytime. Yesterday, someone told me on my Facebook page that he will hacker me; I blocked him immediately. Today, when I tried to create a user on the ...