Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

72 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
1answer
107 views

Mixed content issue while running updates.php in Drupal 6.37

We are facing this issue again for Drupal version 6.37. We do not have jquery update module installed. In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...
2
votes
1answer
116 views

Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?

I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
2
votes
0answers
139 views

How can I conditionally insert extra header data on Drupal 6 pages?

I'm using Drupal 6 with the WebForms module, and my entire site uses https. I need to insert some cache-control statements in the page headers of only certain pages (ones with forms on them). Is ...
1
vote
1answer
239 views

security kit module settings are blocking own site jQuery calls

I am using Security kit module to enhance security for my website. In that I have enabled Enable JavaScript + CSS + Noscript protection option. This setting is blocking one of Jquery call that is ....
1
vote
0answers
277 views

Drupal not detecting updated Trusted Host Settings

I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message: TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is not configured in ...
1
vote
1answer
241 views

How to add security questions in Drupal 8?

I need to add security questions while user creating his account in Drupal 8. I need to use those security questions to retrieve his password, when user forgets his password. Any suggestions ?
1
vote
1answer
29 views

How to securely access the data from another Drupal instance?

I have a site setup which feels fairly unconventional so please bare with me while I try to explain. I have 2 Drupal sites based on different servers. The main site (site A) contains the front-end ...
1
vote
1answer
16 views

Entity Reference + View + security

I have this scenario in DRUPAL 7 A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian). A content type named "Reports" with a field "...
1
vote
2answers
41 views

Best practice, removing admin access from many websites

hopefully this is not a repeat question, not sure how to search for this. I run over 50 websites, not all are on the same server but some do hold many users together. Not all our servers are ours, ...
1
vote
0answers
56 views

Keeping sensitive data from appearing in cache_form table

I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the ...
1
vote
0answers
21 views

Any security issues accessing $_POST and returning values from it in AJAX commands?

Just wondering if there needs to be any sanitization here: /** * Implements hook_ajax_render_alter(). */ function my_module_ajax_render_alter(&$commands) { if (isset($_POST['...
1
vote
1answer
26 views

I'm using CiviContribute and need CAPTCHA

I'm new to Drupal and CiviCRM. I work mostly with Blackbaud/NetCommunity. I'm operating a website that using CiviContribute for donations. Our Payment Processor is Paypal Payments Pro. I'm trying to ...
1
vote
0answers
610 views

Update database/dom after dialog button submitted with jQuery

Clicking a dialog button I want to update Drupal database using jQuery .ajax() function! I want to know if in first place is secure to do so or is another method to handle the synchronous requests? ...
1
vote
1answer
401 views

What to do for “Login attempt failed for admin.” and “Access denied” to path admin?

In Watchdog, I started seeing several entries like this: Login attempt failed for admin. And access denied 2016/04/04 - 15:06 admin These are generating a fair number of log entries. The IP ...
1
vote
1answer
119 views

Using the back button after logging out shows you pages from the authenticated user's session

Using the back button after logging out shows you pages from the authenticated user's session. I found a solution for this, need to set the header like this to fix this issue- drupal_add_http_header(...
1
vote
2answers
104 views

Is it safe to send the unencoded JSON output?

The mobile app developers wants an api to get a list of articles from our Drupal site. It should have these fields in the output: nid title field_teaser_body The api resonse has to be in JSON format....
1
vote
1answer
32 views

How to apply node access rules when querying menu_links table

I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way ...
1
vote
0answers
41 views

Is Commerce Stripe any more or less secure than Commerce Paypal?

The very first thing the Commerce Stripe module states is this: As of the implementation of PCI-DSS 3.0 (January 2015), this module is intended to work within the requirements of the Self ...
1
vote
0answers
169 views

Using captcha in varnish setup

Captcha and any form of page caching don't get along. I understand why this is, but i'm wondering if there might be a certain setup to use captcha even in cached environments. Post requests for ...
1
vote
0answers
100 views

Are HTTP headers and cookies validated against malicious input?

I'm developing a Drupal site for a government organisation and am required to fill in a security assessment form. The form asks for confirmation that the "application" (Drupal in this case) takes ...
1
vote
0answers
138 views

Drupal update system not detecting latest (security) releases

This morning I got e-mails about security updates and I know one of the modules, path_breadcrumb is installed on some of my sites. So I ssh into these sites, do drush pm-update --security-only and it ...
1
vote
1answer
134 views

How to save POST variables securely using entity api

I am creating a module that connects Drupal Commerce to Shipworks (a shipping management system). They communicate with each other using HTTP POSTs via a single endpoint URL on Drupal. One aspect I am ...
1
vote
0answers
71 views

Drupal site blocked by Windows defender

Visiting my Drupal 7 site just now with IE 11, I get this message: Windows Defender blocked content on this website lx7pyv.dofeqilr.com Hosted by: mysite.com Recommended icon Go to ...
1
vote
0answers
711 views

$base_url is set in settings.php but Security Review flags it still

I get this message in Security Review report: Base URL is not set in settings.php even though my settings.php code has this: $base_url = 'https://www.mysite.com'; I cleared caches several times, ...
1
vote
0answers
297 views

Captcha on login form using the form block module

I am providing the registration form using the form block module. I also have Captcha and Hidden Captcha module enabled on mysite. However i am not getting the option to add a captcha to the ...
1
vote
0answers
38 views

Are there any security implications for having the Temporary Directory inside the Drupal root folder?

I'm having trouble finding the tmp dir of a particular host and I'm wondering if there is any reason not to just stick it inside the Drupal root.
0
votes
0answers
21 views

What is x-speed-cache-key? What is its purpose?

Our drupal site was pentested. The pentest report labeled an action involving the header X-Speed-Cache-Key as a security concern. The finding stated: Arbitrary parameters supplied to the query ...
0
votes
0answers
25 views

Drupal and security hardening - PHP chmod

I am struggling with the following case with Drupal and PHP hardening on an Red Hat Linux infrastructure. For drupal installation a user has been created. All the files and directories are owned by ...
0
votes
0answers
33 views

Phar not working in Drupal 8

If I try to use a simple Phar call in my controller: $tar = new \PharData('/path/to/myTar.tar'); I get the error: "Unexpected file extension" This is because Drupal Security checks to see if the ...
0
votes
0answers
21 views

How generate a token for consumer with simple_oauth?

I'm searching how to generate a token with simple_oauth but I'm lost due the installation of our drupal. We're using the Headless Lightning distribution with JSON:API, consumers and simple oauth for a ...
0
votes
1answer
55 views

Node field not sanitize on render

I have a form for users who want to add new content on my Drupal 8 website. I render node field on a twig template : {{ node_field_title.value }} But field are not sanitized by Drupal. Is it the ...
0
votes
0answers
40 views

Update Symfony before Drupal core?

Right now there are some security updates for Symfony: curl -sS https://get.symfony.com/cli/installer | bash echo y | ~/.symfony/bin/symfony self:update ~/.symfony/bin/symfony security:check Symfony ...
0
votes
0answers
22 views

766 security update database schema errors

After updating to 7.66 and running update.php i get an error: Class name must be a valid object or a string in /home/breastcancertiss/public_html/includes/common.inc on line 8066 I have 6 schema ...
0
votes
0answers
20 views

Slideshow: Cgi Generic Command execution (time-based)

One of our customers received a notice from his PCI scan vendor that the requests in the MD_Slider module used by Views are not sanitized. The latest version is two years old and it could be correct. ...
0
votes
0answers
23 views

Missing config/default directory error after patching the latest critical vulnerability

After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file. drupal/core from 8.5.8 to 8.5.11 drupal/jsonapi from 1.7 to ...
0
votes
0answers
59 views

Proper security for settings.php

I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
0
votes
0answers
66 views

itok triggering modsecurity injection 942100

When identifying false positives with my Drupal 7 site running ModSecurity CRS 3.1, I noticed visitors were getting denied access to a page because that page loaded an image using itok?= which had 2 --...
0
votes
2answers
85 views

Security model and menu access

Drupal 8.6.1 I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc. ...
0
votes
1answer
41 views

How to always require email verification before accessing a page?

I have a custom page defined by hook_menu. I want signed in users to be required to verify their email every time they want to access it. The page will have buttons on it that would allow someone to ...
0
votes
1answer
18 views

How to add registry key verification step with the key being stored in another database

I am currently learning how to use Drupal through Udemy classes; I am a complete newbie. I am building a Drupal Website, for my personal development, and when someone wants to register to the ...
0
votes
1answer
27 views

Custom Module Remote Fails Checksum with Drush

Background I have several proprietary Drupal modules that my company uses. We want to update these across all our sites. To that end, I've built an endpoint that produces code according to the (ill-...
0
votes
0answers
75 views

(Answered) Ajax link for anonymous users to delete node they created if $_SESSION exists. Is node's created timestamp secure enough in link?

I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away. Instead of forcing them to create an account and take ...
0
votes
1answer
52 views

Views php field or filter to a file or module

If I already have a view with a php filter or a php field, in drupal 7, how can I convert my whole view into a page? (prevent code injections or other security risks) What is the right way to resolve ...
0
votes
0answers
382 views

Basic authentication for external application making requests to Drupal instance

I have a external application that makes requests for content in my Drupal 8 instance. What I want to do is to make sure Drupal is only talking go my external application to stop traffic being spoofed....
0
votes
3answers
23 views

Find the password for user admin from a replicated old version of site

I have access to a copy of an old version of a production site on a dev server, but the owner of the website on prod has lost his credentials to admin and doesn't know his ssh login credentials. The ...
0
votes
0answers
133 views

Where do I store the encryption.key file?

According to the instructions on the AES encrypt project page, I should create an encryption.key file. Create a new 128 bit encryption key. A good way to do this is in the command line using ...
0
votes
1answer
285 views

PDO Exception shows full path

I have a vulnerability in my Drupal 7 site that if there is no mysql connection establish then PDO through the exception like below: PDOException: SQLSTATE[HY000] [2002] No connection could be made ...
0
votes
0answers
904 views

How to make all URL redirect to HTTPS

There is already a lot of links displaying videos inside my site (in node content) that are using: http://example.com/clips/2017/01/11/51706, http://www.example.com/clips/2017/01/11/51706, https://...
0
votes
0answers
18 views

Restricted visibility and search engine

The search engine crawler, like Googlebot, doesn't index any data, which is set to be visible only particular user, right? For example, let's say I have fields named field_A & field_B on user's ...
0
votes
1answer
23 views

Is it safe to use $vars['name_raw'] instead of $vars['name']?

I ran into an issue with usernames being trimmed in articles. I found a thread here with a fix suggesting to use $vars['name_raw']: https://www.drupal.org/node/854762#comment-7614255. It works. But I'...