Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
2
votes
1answer
116 views

Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?

I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
2
votes
2answers
660 views

Secure pages and installing new modules (AJAX error)

I've just configured my website to work with secure pages and everything seems to be working fine except for the ability to install a new module. Whenever I try, I get this error: An AJAX HTTP ...
2
votes
1answer
53 views

How I get notified every time their is an *new* update and not every day for the sames updates?

The update module can send you email when a new release is available for a module you installed. The problem is I get a email everyday. Some security update are very minor and unreachable for an ...
2
votes
1answer
368 views

Overriding default hashing mechanism: cannot redeclare user_hash_password()

I have a project that requires a change in the default password encryption mechanism. The documentation of password.inc states that this can be overridden using the password_inc variable. I followed ...
2
votes
0answers
139 views

How can I conditionally insert extra header data on Drupal 6 pages?

I'm using Drupal 6 with the WebForms module, and my entire site uses https. I need to insert some cache-control statements in the page headers of only certain pages (ones with forms on them). Is ...
1
vote
7answers
7k views

Insecure content warning with D7 and SSL

I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome ...
1
vote
2answers
2k views

Drupal security measures

I have got a list of security violations for my website from security team. It says Cookie without HttpOnly flag set Autocomplete Password Enabled So, what is this basically? Can I overcome ...
1
vote
2answers
206 views

Is there any security or operational problems if I do not have any .htaccess file in drupal root?

I realise that having the .htaccess file in the root of my installation is probably the way the program is designed to run, but I was having some difficulties accessing the site, and then fixed the ...
1
vote
2answers
689 views

Unattended automatic security updates / upgrades [duplicate]

What is the best way to get Drupal to automatically perform security updates? And are people commonly employing such a method? For motivation, consider this: Drupal just released a PSA about a ...
1
vote
1answer
139 views

Drupal Commerce Authorize.net gateway and POODLE

I got a notice today that Authorize.net is going to shut off their SSLv3 protocol on November 4 (7 days from today) in response to the POODLE threat. I'm using Drupal Commerce's commerce_authnet ...
1
vote
2answers
4k views

How to disable PHP files from being run in the sites/default/files directory?

By default does drupal 7's sites/default/files directory disables running of PHP files?
1
vote
2answers
115 views

What security should I double-check before opening my site to being multi-user?

I've been using my D7 installation as a single-user blog, and operated assuming that would always be the case. In the process, I may have been sloppy with permissions in various places, such as ...
1
vote
2answers
1k views

How do I redirect to www and https in settings.php?

I want to include code in settings.php which would handle redirects to the www alias and also https. Because it is for a distribution I would prefer not to have hard-coded URLs and I would also ...
1
vote
2answers
512 views

Automatically block user that access /wp-login.php

Is it possible to block any users IP if they try to access a specific URL such as /wp-login.php page which does not exist on Drupal. Basically to automatically blacklist the user, for days or even ...
1
vote
1answer
706 views

How do I handle third-party API credentials in settings? [closed]

I am building a module that will need to integrate credentials for the 3rd party service in Drupal 8. The module's admin panel should remember the credentials and use them to interact with the service,...
1
vote
1answer
480 views

How to extend flood control in a custom module?

I would like to use Drupal's flood control capability in another module. I have a resource I'm protecting with a password. Can I simply call flood_register_event() and otherwise use the variables as ...
1
vote
4answers
507 views

How to recover content/configuration from a hacked site

I have a situation where I am faced with two sites which were vulnerable to the Drupageddon SQL injection exploit. I am looking at what is the best strategy for recovering these websites. Given that ...
1
vote
1answer
137 views

Is someone trying to hack my site?

I was looking at my drupal site log messages and I´ve been having very weird ones as the ones attached. I was wondering if someone is trying to hack my site, if so, how can I prevent that? I have all ...
1
vote
1answer
2k views

Prevent site from being indexed by search engines?

I have two requirements for my site I don't want my site to be indexed by search engines Anonymous users should not be able to see any content of the site I would have been satisfied with ip ...
1
vote
1answer
57 views

Is there a recognized practice for keeping security details in files excluded from version control?

As settings.php also contains the database connection details and the site key among others, it is excluded from version control in .gitignore. But there some modules, APC for instance that require ...
1
vote
3answers
864 views

Can we create a core PHP file inside the files folder?

As per Drupal's folder structure, custom code is always in sites/modules or in the theme folder. One of my colleagues created a custom PHP file in the files folder. Is this OK or are there any ...
1
vote
2answers
81 views

Is it safe to use $_SESSION to store temporarily a user provided value under multi-step form processing

I have a form which contains an AJAX button press callback. Upon pressing this AJAX button, I want to store temporarily a form element's value before fully processing all the data upon pressing main ...
1
vote
1answer
343 views

Is json_decode parse-ability proof of a safe string?

Do I need to use check_plain (or something else) when displaying a user supplied JSON string, when I have previously checked it successfully parses with json_decode?
1
vote
2answers
80 views

Removing potentially malicious code from template

Our drupal site was hacked at some point recently, and I've been tasked to clean it up because nobody knows much about drupal here. I think I've taken care of most of the glaring security holes, and ...
1
vote
1answer
453 views

Weird activites in my site. Is my site hacked?

Since long time I have been noticing some weird activity going on on my website. For example: The includes folder was deleted CSS files were modified Node edit access was given to anonymous users I ...
1
vote
1answer
766 views

Files security - files folder hacked

For the second time in a short while my files/ folder has been hacked. Permissions are set as 755 all accross the folder. I tried to set it up as 750, 754 but it breaks the website. What happens is ...
1
vote
1answer
993 views

Would disabling these following functions in PHP.INI affect Drupal 7?

If i disabled the following php functions: disable_functions = escapeshellarg,escapeshellcmd,exec,ini_alter,parse_ini_file,passthru,pcntl_exec,popen,proc_close,proc_get_status,proc_nice,proc_open,...
1
vote
3answers
644 views

Advice - Forms and Credit Card Security

I'm working on a website for a client where he wants a order form created and e-mailed back to him. Because of the nature of the business, the card cannot be charged until the order is verified that ...
1
vote
1answer
885 views

Restrict IFRAME and OBJECT embeds certain domains

I would like to allow my users to embed certain IFRAME and OBJECT tags in nodes and comments. Is there a way to restrict them to certain domains, for example maps.google.com to allow embedding Google ...
1
vote
1answer
1k views

What is the suitable file permission for 'files'?

I have written this small bash script to rebuild D6.22 file permissions: #!/bin/bash cd /path/to/drupal chown -R bob:www-data . find . -type d -exec chmod u=rwx,g=rx,o= {} \; find . -type f -exec ...
1
vote
2answers
177 views

Drupal 8 password retention

I am currently reviewing Drupal 8's security features and was wondering about how Drupal stores user passwords. I know Drupal uses salted hashes to store the password in the database, but does Drupal ...
1
vote
2answers
494 views

Why are there so many attempts by an anonymous user to access /wp-login.php?

I looked at /admin/reports/dblog today. There were five request in two minutes by an anonymous user to view /wp-login.php. These requests have been happening for an hour at least and continue 2-3 ...
1
vote
3answers
68 views

Why are anonymous visitors logged in when they visit /user/[uid] page?

This seems to be a massive security floor in Drupal. I have the following display suite code in a Block which is added as a custom field to the User account display:- <?php global $user; $uid =...
1
vote
4answers
2k views

How to have a secure HTTPS login form?

I have Drupal site with a login form on my home page. How do I go about posting to a HTTPS url, and then after a successful authentication, redirect back to HTTP admin page?
1
vote
1answer
957 views

How to add 'style=“width:100px”' in Global Custom Text field in a view?

It seems that the Global Custom Text field in a view delete part of my text. I write this: <div class="my-class" style="width:100px">Hello</div> but get this: <div class="my-class"&...
1
vote
1answer
215 views

How Encrypt module actually works?

I installed the Drupal Encrypt module and enabled it. However, I wonder how this module actually works. Does it encrypt all the submissions from the browser that the user/admin key in like 1) Login 2)...
1
vote
1answer
1k views

$drupal_hash_salt is empty in my installations

This is the code in settings.php $drupal_hash_salt = ''; From what I know it should be a random string and I shouldn't change it at all and it has a direct effect on the website security. But why ...
1
vote
2answers
870 views

Security considerations for special characters in usernames?

I would like to create some users on a Drupal site where the usernames are actually company names and some of those company names contain ampersands or other non-alphanumeric characters. I have read ...
1
vote
1answer
58 views

Security issues after authenticated user has been logged out

I have a profile information page that is being displayed for an authenticated users. But after I log-out as that specific user,and then i click the back button of the browser,I could find the ...
1
vote
2answers
1k views

Webform + reCaptcha - still lot of SPAM

Few months ago I installed reCaptcha module to use with webform. It worked perfectly: I can't submit form if I didn't provide correct captcha code. It worked even if I disable JavaScript. Problem is ...
1
vote
1answer
150 views

Authenticate against a Drupal Instance

Is it possible for an application (e.g. a Java Web app) to authenticate against the Drupal users table? I know they use an SHA512 encryption, but I am wondering if there is any way to expose this ...
1
vote
1answer
442 views

Adding Additional login security

Considering login security for user logins, I would like an additional option such as a PIN option for all aspects of user login. This seems quite common now across a number of portals out there such ...
1
vote
1answer
191 views

How to secure Drupal website

I have Drupal CMS and I need to protect it from sensitive data leak, which are the customer names, addresses, the payments and order information. I am new to Drupal, so my question is, is it possible ...
1
vote
1answer
115 views

is it a security hole to verify an uploaded supposed-to-be-zip file as a zip with zip_open()?

Question's subject is pretty much it. I have an upload widget on a custom content type that is for users to provide a zip file. I want to verify the file they provide is indeed a zip file, and ...
1
vote
2answers
264 views

node_load_multiple does not respect node access grants

I used $nodes = node_load_multiple(NULL, array("title" => "Foo Bar")); to fetch nodes by titles. But after going through Drupal security standards, node_load_multiple is not the right way to load ...
1
vote
1answer
1k views

How do I modify the “has_js” cookie?

I have a web application deployed through Drupal 7.43. I need to modify the has_js cookie that is set by Drupal to make it both Http-only and Secure for a site security review. What are pros and cons ...
1
vote
1answer
274 views

How to apply xss filter on a csv file

I have a CSV file from which I am importing some data. Should I need to apply XSS filter? How do I achieve this? while (!feof($handle)) { $data = fgetcsv($handle); $path[] = $data[0]; $...
1
vote
1answer
63 views

Users with no roles are getting onto my system

I am having an issue with my site, there are users accessing it and creating accounts without having a role. Here we can see user roles is blank. From my understanding someone has found a weakness in ...
1
vote
1answer
34 views

Securing folder in Custom Module for Drupal 6

I wrote a custom module, which logs errors to an external text file. The files are kept in /sites/all/modules/custom/my_module/logging/ The problem is, if the user know the name of the file, they ...
1
vote
1answer
5k views

security report there is no .htaccess file in private:// directory

I have this security report that is constantly saying: Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your private:// directory which contains the following ...