Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
2
votes
3answers
370 views

Is Drupal secure?

I want to respond to this: "Drupal is listed as limited use, not generally available because of the licensing and security issues related to various modules that people want to use." I have two ...
2
votes
3answers
965 views

How to prevent a site from ever using experimental core modules?

Quote from Experimental modules in Drupal 8: Drupal 8 core introduces the concept of experimental modules. These are modules that are provided with Drupal core for testing purposes, but that are ...
2
votes
2answers
2k views

Protect site from flooding when user login is attacked by brute force

I've been experiencing issues with bots trying to force their way into the website I manage. It seems to be a daily occurrence the the flood system is being triggered (I'm on D7). I'm happy the the ...
2
votes
2answers
430 views

Code for page access

I would like to use PHP code in nodes of a specific content type. I can check the user's permission with the global $user if the user can access the node. Is there any module to set view for created ...
2
votes
3answers
567 views

How can i get prepared for DRUPAL-PSA-2016-001?

The PSA for tomorrow left me a bit uncomfortable. Quote: The Drupal Security Team urges you to reserve time for module updates at that time because exploits are expected to be developed within ...
2
votes
1answer
318 views

Should you use check_plain() prior to inserting into database?

I am currently using check_plain() etc on displaying user entered data in HTML, and I am also using check_plain() etc prior to inserting the user data into my custom tables. When inserting or ...
2
votes
3answers
5k views

My drupal 7.22 site got hacked

When I tried logging in to my Drupal site this morning, I got an error. When I took a look at the log files, I found a error about the template.php file used by the theme currently set: [Sat Sep ...
2
votes
1answer
80 views

Site's settings file return blank screen

I'm looking through a few of my drupal sites since the recent DRUPAL-SA-CORE-2012-003 security update. I noticed that on a few of them, if I navigate to the settings.php file location through the url. ...
2
votes
2answers
2k views

Drupal Database Encryption

I am seriously looking for a solution to encrypt at least some of the tables in my Drupal 7 database. I'm totally suspicious about my hosting providers, I really don't want my user's data and also my ...
2
votes
2answers
4k views

Easiest way to hack Drupal 6.22 installation for security audit

I am doing a security audit for a client. Their installation is Drupal 6.22. I need to show them it's unsafe. What is the easiest way to hack it as an example? I would need to directly show them ...
2
votes
2answers
156 views

How do I receive security updates?

On my client(s) website, I turned the update module on. From time to time, they receive an error message on every page about a security update. They complain about this message, and they don't want ...
2
votes
2answers
76 views

Is there a way to send emails when someone logs in?

Logins on my sites are very infrequent and are normally done by myself. I would like a way of getting email notification when someone logs in. This way I might be able to spot someone hacking into the ...
2
votes
2answers
381 views

prompt in IE8 for secure pages produces altered layout

My Drupal 7 website looks fine in most browsers, but in IE8 I am getting the prompt: "Do you want to view only the webpage content that was delivered securely? This webpage contains content ...
2
votes
1answer
46 views

Is it safe to allow domain.com/username?

Are there any security risks if we create pathauto roule so that the user account pages are at domain.com/username
2
votes
1answer
221 views

How to delete first user (admin)

For security reason, I want to delete the first user (which has all rights, event without the admin role) and login only with the drush uli command. How can I do that? From the backoffice it say I can'...
2
votes
1answer
508 views

How can I exclude API keys, passwords, and so on from configuration management?

I am using Drupal 8 and drush cex to commit my configuration to my repository. However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive ...
2
votes
3answers
214 views

What is good way to hide update.php file?

I will like to know what is the correct/better way to hide update.php file on the production server. Currently when you try to access update.php file, Drupal shows default access denied page with ...
2
votes
1answer
4k views

What code should .htaccess of files directory hold in drupal 7.25?

The module Security Review gives the report my .htaccess in files directory is a security risk because says it has insufficient code to protect the site from anyone wanting to make php edits. However, ...
2
votes
2answers
774 views

Drupal Commons 3 and Original Drupal Core Updates

I'm may be planning to switch over to Drupal Commons 3. When the original Drupal core gets security updates, will I be able to get those updates in the Drupal Commons or do I have to wait for Drupal ...
2
votes
3answers
330 views

How to securely authenticate content embeded in another site?

I need to embed password protected content to a second domain with an iframe. The content itself is a view which will be displayed on a third party site via an iframe and the content is prepared with ...
2
votes
1answer
276 views

How to determine the code for settings.php config override based on .yml?

I am trying to put my API keys in a separate file instead of storing them in config management. For example, I installed the Commerce Stripe module. When I export the config, it looks like this: ...
2
votes
2answers
100 views

Is this a possible attack on database?

In the logs (Drupal 7), I have seen the next entry (I have edited some compromised info). It seems a failed (only I hope it actually failed) attempt to access the login account. I have tried to ...
2
votes
1answer
47 views

Can I temporarily stop update notifications for one project only? [duplicate]

Is there a way I can tell Drupal not to notify me about a particular version of a module? For example, if it isn't security related and I choose not to update one module but would like to receive ...
2
votes
1answer
175 views

My site is hacked [duplicate]

It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code: $sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$...
2
votes
1answer
1k views

rule to remove “Public files directory Not fully protected” in nginx?

I use D7 with nginx and php5-fpm on Linux and get this security warning: Public files directory Not fully protected I see here that one needs to use this snippet in Apache's htaccess to resolve ...
2
votes
2answers
111 views

What file or data I should NOT give outsourcing developer for security when they need a copy site of my site?

I'm asking a outsourcing developer to modify some part of my site and then he needs the copy of my site as a test site. My site is already working site and has users registered. What comes in mind ...
2
votes
1answer
602 views

How to prevent login if a condition is not met

I am working on a Drupal 6 site (which I did not make and am not in charge of the general IT architecture at this company). The site is on an intranet and they regularly import all users from an ...
2
votes
2answers
362 views

drupal module secure pages toggles between http and https on reload

I am using the secure pages drupal module to enable https for some of the pages , but i have noticed one bug in this , each time i reload the page its toggling between http and https, and if i go from ...
2
votes
1answer
104 views

Add Encryption to Images

Is there a way to add encryption to images once they are uploaded on the website and stored on the server?
2
votes
1answer
3k views

Annoying Drupal Hack keeps changing bootstrap.inc and writes cryptic files to sites/default/files/styles

I'm having huge issues with a massive hack of our website. It was running Drupal 7.32 last year, when a big security issue was announced. Unfortunately we came too late and the site was hacked. For ...
2
votes
2answers
440 views

How to get update status of multiple Drupal sites

I have several servers each with numerous Drupal sites on. Not all of them are developed by me. How would you keep on top of the sites to make sure they are all up to date security wise. In an ideal ...
2
votes
3answers
60 views

Avoid username output as a class of an article tag

Drupal 7 generates a username class for the article tag, something like : class="node node-page node-published node-not-promoted node-not-sticky author-username odd clearfix". I'd like to avoid to ...
2
votes
1answer
2k views

Best practices for protecting from injection on form fields

I am building a form in Drupal 7. I have a textarea field and would like to know if it is safe to get the field content ($form['values']['field_name']) and save it to the database using something like ...
2
votes
2answers
78 views

Markup filtering at theme level (security)

Please could someone advise if any sort of sanitization/filtering is required for the #markup below i.e. check_markup(), check_plain(), etc The $title variable is basically just from drupal_get_title(...
2
votes
1answer
4k views

What's the best file permission to drupal's files and directories? [duplicate]

Possible Duplicate: What are the recommended directory permissions? I want to know what's the best file permission under a linux system to my drupal's files and directories including the files ...
2
votes
1answer
202 views

How to deny access to invalid $_GET parameters

For example, there is a pager with 10 pages. How to deny access if $_GET['page'] is bigger than 9 or is not numeric?
2
votes
1answer
980 views

In what cases should I personally sanitize input & output when using the Database Abstraction Layer

I'm trying to get a clearer sense of where security vulnerabilities on my site may lie. At no point in my code do I ever query the MySQL database directly; I always use the Database Abstraction Layer (...
2
votes
1answer
105 views

Why would my hosting account user name show up in page not found errors in my logs? [closed]

I'm running a Drupal 6 site and recently I've started seeing "Page not found" errors which contain the user name on my hosting server. For example "~username/blog/the-blog-post-title". I use Pathauto ...
2
votes
2answers
29 views

Session API Security Advisory

I'm working on a website that is interested in adding chat features. I did some research, and ended up installing the DrupalChat module, and its dependencies. After configuring the module, I realized ...
2
votes
2answers
95 views

Secure Pages Module or force HTTPS Across Whole Site?

I understand that the Secure Pages module allows you to let some pages use http and force others to use https. Assuming that is correct, is there any reason for me to use Secure Pages if I'm already ...
2
votes
1answer
50 views

How do I secure pages and related media files?

I would like to password protect Drupal pages (solved) and media files related to these pages (solved, but not optimally). Currently the Drupal pages are secured via Drupal and the media files via ...
2
votes
1answer
104 views

Maintaining Old Drupal Versions [closed]

Is there a list of best practices (or anything on drupal.org) for maintaining Drupal versions after end-of-life, specifically, when upgrading isn't an option? The best solution, of course, is to ...
2
votes
1answer
89 views

Is there any sensitive data in the Configuration Management Export?

I noticed in default.settings.php this comment: Location of the site configuration files. The $config_directories array specifies the location of file system directories used for ...
2
votes
2answers
2k views

How do I set the private file system path's permissions?

There is an option in Configuration > File system which let you define a path for private files. After setting a path in this field, the access for all users is restricted (including admin). I need ...
2
votes
2answers
272 views

Deleting users who have created content can lead to access bypass?

The statement below appears in several places on the Internet about Drupal security. Is it the case that someone once wrote this and people repeat it in the their '10 Drupal security tips' posts ...
2
votes
1answer
216 views

Recommended tools/techniques for monitoring for spam attacks on multi-site and shared servers

I'm managing a number of servers with dozens of Drupal sites, some with a single multi-site Drupal installation and others with dozens of separate Drupal installations. We're constantly running into ...
2
votes
1answer
731 views

Will forcing validation on a node save result in security issues or data integrity loss?

I have a content type containing lots of required and conditional fields. Because it can take a bit of time to properly create these nodes, and not all information will always be available to the end-...
2
votes
1answer
376 views

Is there any security consideration with webform and Salesforce API?

We are implementing the Salesforce webform module for our client and they are asking us if there are any security issues to consider by having SOAP installed on their server. (The Salesforce API ...
2
votes
0answers
33 views

How to handle user 1 with PCI compliance [closed]

PCI compliance states there can be no shared accounts. Typically between developers user 1 is shared and utilized for things that require user 1, but that would violate the PCI rules. Is there a way ...
2
votes
1answer
106 views

Mixed content issue while running updates.php in Drupal 6.37

We are facing this issue again for Drupal version 6.37. We do not have jquery update module installed. In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...