Questions tagged [security]
Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.
431
questions
153
votes
10
answers
212k
views
What are the recommended directory permissions?
I'm gearing up to deploy a Drupal 7 site and I can't find any documentation. What are the recommended security-conscious permissions for files and directories?
I am specifically interested to the ...
- 2,149
98
votes
7
answers
15k
views
What are the downsides of using PHP Filter code in blocks, nodes, views-args, etc?
I have seen many times people saying not to use custom PHP/PHP filter (from the Drupal UI) in blocks, nodes, views-args, rules, etc. I have searched around a bit and haven't found much, it seems like ...
- 6,815
57
votes
3
answers
34k
views
How to upgrade only core with drush?
There's a huge security leak in <7.32. So I want to upgrade all my Drupal sites asap without too much worrying about breaking stuff.
But...
$ drush dl drupal-7.32
It's forbidden to download ...
- 1,704
40
votes
7
answers
14k
views
Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?
I just updated all my sites using the patch method of resolving the Drupal SA-CORE-2014-005 exploit. I just read reports that just yesterday there is someone from a Russian IP infiltrating drupal ...
- 8,741
33
votes
6
answers
10k
views
What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?
Reading up on https://www.drupal.org/node/2357241 and the technical details at https://www.drupal.org/SA-CORE-2014-005, as well as the actual patch which is simply:
diff --git a/includes/database/...
- 4,604
31
votes
3
answers
13k
views
Differences between value and safe_value
What are the differences between ['value'] and ['safe_value']?
- 7,894
16
votes
1
answer
8k
views
Is check_plain() enough?
Is check_plain() enough for re-displaying the text entered by users in the browser, or should I still filter with filter_xss()?
- 7,894
15
votes
1
answer
3k
views
is db_insert secure?
I'm using the Drupal 7 method db_insert, to insert data into a custom table in the Drupal database. I've read that this is the prefered way, however I've walked through the code and doco and I can't ...
user5681
15
votes
3
answers
2k
views
Drupal admin area and login, Securing them with HTTPS
I've been reading a lot about this and trying many of the methods I've found and haven't yet been able to get anything working properly.
I want to be able to secure the admin area and associated ...
- 151
14
votes
4
answers
12k
views
Which files should I delete after a Drupal installation?
After installing Drupal, there are files in the root directory that I should delete. I know that install.php is one of those. Which other files should I delete?
- 6,197
14
votes
6
answers
8k
views
How to deal with someone trying to login as admin?
During these last days, I noticed in my dblog, that someone has been trying to sneak around.
The person tried finding the login url (my website isn't open for user registration) so they tried ...
- 407
11
votes
1
answer
9k
views
How and when to use filter_xss() and check_plain()?
There are lots of template files like this one views-view-fields--magazine--magazine.tpl.php in my website. how and when I should use the filter_xss() and check_plain() to improve security? for ...
- 3,862
10
votes
4
answers
2k
views
Somebody is trying to brute force the password
Looking at the site log, I found, that somebody with IP address: 91.236.74.135 is methodically sending requests to the page: /user?destination=node/add of my Drupal website. He does it once in every ...
- 1,896
9
votes
4
answers
5k
views
How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?
Just released exploit: https://www.drupal.org/sa-core-2018-002 --- Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002
How can I tell if someone used this exploit to hack my site?...
- 8,741
9
votes
4
answers
4k
views
Is drupal safe against brute force login attacks?
A brute-force attack is an attempt to gain unauthorized access to a website by continually generating and inputting various combinations of a password. This task is usually done by automation software ...
- 21.8k
8
votes
6
answers
2k
views
Will Drupal 6 be left in a secure state after it becomes unsupported?
I created a custom database interface using Drupal 6 + Views + CCK that works really well for my company and recently I had to migrate it to another server.
I thought "Hey, why not install Drupal 7 ...
- 287
8
votes
3
answers
8k
views
Prevent Cross-site scripting
One of the security principles is sanitizing strings and variables passed from client to server. In plain PHP there are some functions to prevent XSS (Cross-site Scripting) vulnerabilities:
...
- 21.8k
8
votes
2
answers
457
views
Why is settings.php in the web folder?
In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a ...
- 932
8
votes
1
answer
3k
views
Sanitized text input for EntityMetadataWrapper set()
Through searching, I've found plenty of examples using the EntityMetadataWrapper set() function to update entity fields, and have implemented it successfully in my module. However, I haven't been able ...
- 411
7
votes
5
answers
12k
views
How to enable a site to be in an iframe?
How can I enable a Drupal site to be in an iframe and place it in basic html page.
If I try this:
<iframe src="drupal-site.com"></iframe>
then it doesn't show any result.
Any ...
- 143
7
votes
1
answer
876
views
What do blocked IP addresses see?
I have been getting a lot of failed attacks targeting my server in the last few months. I have been using the Drupal IP block to block IPs that where sniffing for vulnerabilities. I would like to know ...
7
votes
4
answers
9k
views
base_url for both http and https?
I have a site that is accessible both through http and https. I see the security review complains that base_url is not defined in settings.php.
However when I define it as http://example.com, and ...
- 109
7
votes
1
answer
4k
views
Will changing the value of $drupal_hash_salt in settings.php file break site
I was looking through a list of steps to take when there is a risk that your site has been hacked. It recommends changing the value of $drupal_hash_salt in settings.php.
According to the inline ...
- 908
6
votes
1
answer
6k
views
Prevent SQL injection
One of the security principles is sanitize string and variables passed from client to server; SQL injection is one of the way to hack a website. in plain PHP there are some functions to prevent SQL ...
- 21.8k
6
votes
1
answer
3k
views
Drupal reuses its hash salt
The instructions in default.settings.php say
This variable will be set to a random value by the installer. All one-time
login links will be invalidated if the value is changed. Note that if ...
- 9,087
6
votes
5
answers
3k
views
Spambots causing server crashes. How do I block them?
I have a Drupal 7 website on a shared hosting account that uses an Apache server. It is getting continuously battered by spam bots who try to post junk comments and create fake accounts. What methods ...
- 502
6
votes
1
answer
6k
views
Recommendations for security testing a Drupal site? [closed]
I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal ...
- 237
6
votes
1
answer
3k
views
How to place Drupal_Security_Do_Not_Remove_See_SA_* into httpd.conf instead of .htaccess
I run several Drupal 7 installations on a dedicated server with CentOS 6.4 and Apache 2 (the package httpd-2.2.15-29.el6.centos.x86_64).
I wonder, how to properly configure the ...
- 884
6
votes
1
answer
294
views
What security issues are involved with cross-domain logons using OpenID?
I want to implement cross-domain logons for 3 sites. Is OpenID the best tool for protecting my site and users?
- 1,367
6
votes
2
answers
133
views
Module available for forcing users to re-enter their password to view/edit certain user account fields?
My users have custom fields for their user account that can contain some sensitive information. To protect against privilege escalation vulnerabilities, I'd like to make these fields only readable and ...
- 1,231
6
votes
1
answer
2k
views
Preventing SQL injection
In Drupal 6, queries are issued with db_query(). Using %-modifiers, query arguments are substituted into the query after being filtered. Strings %s (and only strings) are ultimately run through ...
- 895
5
votes
4
answers
2k
views
Malware on D7 website - Blacklisted by Google
I want to tell you about the malware attack to my Drupal website. Not just for your suggestions but also to create something helpful to anybody tha could suffer for the same problems. Well...
INITIAL ...
- 252
5
votes
1
answer
5k
views
Remove XMLRPC to avoid vulnerability exploit
How is xmlrpc.php from Drupal core affecting functionality?
Given the fact that a vulnerability was discovered for it, details in this article
is it safe to remove xmlrpc.php file?
Is it bad ...
- 531
5
votes
6
answers
9k
views
Remove the X-generator header from the response
I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header.
I am using the following code, but it removes the x-...
- 101
5
votes
4
answers
6k
views
Encrypting db password stored in settings.php
The db password in settings.php is stored as plain text.
Is there any way to encrypt that password?
My client says its a security risk even though the file permissions is as should.
- 427
5
votes
2
answers
9k
views
How to set up salt hash while installing Drupal 7?
I am no expert in salt hash but while I was installing Acquia Dev, I noticed a variable $drupal_hash_salt, filled with a randomly generated string, in settings.php of newly installed Drupal 7 and a ...
- 572
5
votes
2
answers
2k
views
Secure Pages module is not redirecting
I installed Secure Pages on a site, where I need to secure admin and user login pages. In general, it does its job, but when the user first tries to log in, and goes to the /user page, that page is ...
- 53
5
votes
2
answers
2k
views
Is bypassing Drupal's #token protection against CSRF safe for search forms specifically?
I see that $form['#token'] is employed in drupal_prepare_form() and drupal_validate_form() as a protective measure against cross-site request forgery.
I am wondering about the necessity of this ...
- 302
5
votes
1
answer
4k
views
How is password hashing/encryption performed?
I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could.
The class that performs password hashing in 8 is PhpassHashedPassword, based on https://www....
- 27.5k
4
votes
3
answers
326
views
Is CiviCRM data vulnerable to the Drupageddon bug?
Would CiviCRM data have been exposed to a Drupageddon exploit if it happened before I updated the site to Drupal 7.32?
CiviCRM is in a separate MySQL database. However, the site uses Views/CiviCRM ...
- 497
4
votes
3
answers
1k
views
PHP in database: bad practice but
Lots of times here I've been told that using views custom php fields, filters or others is a bad practice, because putting php in the sql is dangerous.
My question is, if you only call to a function, ...
- 2,204
4
votes
2
answers
2k
views
How critical is SA-CORE-2018-005?
The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability ...
- 493
4
votes
5
answers
3k
views
How secure are variable_get and variable_set?
I have a custom module that saves variables with FTP usernames and passwords. Is variable_get secure? Ie. Can it be accessed outside of the module.
Is variable_set equally secure?
Obviously they are ...
- 1,209
4
votes
5
answers
781
views
What are the ways/strategies to maintain Drupal sites a over period of 10-15 years?
We have started using Drupal as a PHP programming framework (and not just as a CMS). As result, we have many projects running on Drupal (6 or 7).
Typically, after 2-3 years a project gets over and no ...
- 1,446
4
votes
1
answer
528
views
My site was hacked, how can I use chmod permissions to avoid this?
To be honest, only the home page was switched (even the text that was modified bragged about this, grrrr!), but still... not pleasant at all.
So the important question, and something that was on my ...
- 495
4
votes
2
answers
525
views
Securing my drupal website
I'm working on my very first drupal website and it will consist of a login form which will then give the user access to a form. This next form will allow the user to query my database to show the ...
- 41
4
votes
2
answers
2k
views
Is allowing Full HTML (HTML filter on) input for all user roles safe?
Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?
- 1,368
4
votes
1
answer
3k
views
In Drupal 7, how to prevent *.php files from being upload to the /files folder when its required to have 777 permissions?
Hi one of the sites im working on just recently got comprised and a bunch of php files got upload somehow or someway into the files folder and started sending out alot of spam. I know during ...
- 8,741
4
votes
2
answers
729
views
Using modules "not covered by Drupal’s security advisory policy"
I would like to use a Drupal 7 module that is "not covered by Drupal’s security advisory policy", specifically the Conditional Fields module.
It would allow me to do exactly what I need. It looks ...
- 325
4
votes
1
answer
404
views
Drupal automatic "antihack" behaviour
I experience some difficulties with formalizing a question for Google, so I'm going to post it here and request real human help=)
Are there any systems (modules or smth similar) in Drupal that ...
- 425