Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
1
vote
2answers
448 views

Drupal 7 Private Files - How to override security in custom module

Is there a hook to override access to images stored in the private file system when theme_image_style is used to output the image?
1
vote
1answer
456 views

Secure Pages Domain Access for Drupal 7

I ran into a problem using Secure Pages with multiple subdomains. Secure Pages only seems to allow you to put one domain for SSL and not secure pages. I found the following module in Drupal 6, but I'm ...
1
vote
1answer
142 views

How can I securely expose data through Drupal (via REST or something else)

I'm looking to use Drupal to pull in data through forms etc, probably in the form of content types, and then expose these, probably via REST, to other things. I've had a look at the services module, ...
1
vote
2answers
81 views

Insecure fmath editor

fmath is an extremely powerful plug-in library for wysiwyg editors. It provides an editor for mathematical formulas, which generates images that can be used in drupal sites. It processes mathml and ...
1
vote
2answers
145 views

“Administer Taxonomy” is needed to make a user select a term

I need a user to select a term from a given vocabulary but the field is only available to a normal user if I enable "Administer Taxonomy" for them. Is there a way around this? Shouldn't I be using ...
1
vote
2answers
1k views

Secure Login not Working

I'm running drupal 7 with the secure login module and login toboggan. After installing it, going to http://site.com I see the usual site, with the login button. The login form action has not changed, ...
1
vote
3answers
58 views

How to place a role-aware “Add new” link at the top of a Views listing of media

I've created a view that provides a listing of a particular media type on my site. I'd like to place an "Add new" link at the top of this view and have it visible only to users who can actually add ...
1
vote
1answer
110 views

Extended Audit logs

I am using Audit log module for Drupal 8.5. But it looks the audits are very limited - i.e it audits only user updates and node updates. Not for creating templates, changing configurations, changing ...
1
vote
1answer
69 views

What is the best way to update Drupal periodically using a cron job? [closed]

Previously I periodically updated Drupal sites by using a cron-job with a "drush up -y" script running every Wednesday 15,16,17,18,19,20,21,22 hours UTC. which is when "Security releases happen" ...
1
vote
1answer
97 views

Drupal form_state sanitization

I'm new to Drupal and I am doing some module development for a Drupal 7 install. I've done development outside of Drupal and normally its best to always sanitize user input. I've seen different ...
1
vote
1answer
72 views

How sensitive is a site's UUID?

I have set up continuous integration for a Drupal site. After every git push the site is built remotely from scratch in a Docker container. It runs a site install, sets the site's UUID to import the ...
1
vote
1answer
45 views

Services Views module no longer maintaines. What are my options? [closed]

My site relies heavily on the Services and Services Views modules. The Services Views module is no longer being maintained and it has a security vulnerability in it. Could someone help me either ...
1
vote
1answer
26 views

Best way to log clicks on a link of a custom content type

I have a custom content type (bundle, drupal 7) which has a link (rules link module) and I want to log the number of clicks on this link. At the moment I've an integer field in the bundle and I use ...
1
vote
1answer
1k views

CSS and Js not loading with https

I'm trying to put my entire website under https connexion, but my css and js are not loaded. I don't know why. I had this code to the htaccess at the root of the website : # Force HTTPS and WWW ...
1
vote
1answer
120 views

PCI compatible recipe?

I've struggled to find a really straight answer that makes me super comfortable to this question after searching SE, PCI basics, drupal.org, AWS resources, and reading the Drupal PCI Compliance White ...
1
vote
1answer
123 views

Increase security on logon

I am using Logintoboggan module but by chance by playing around with Wireshark packet sniffing tools I can see all login details and passwords when users login/register on my site! Is there a way to ...
1
vote
1answer
41 views

Secure file download from other server

This is an unusual one. Let's say I have two web servers A and B. How would I go about making a link to a file from a Drupal website on server A to a file on server B such that the link is secure (the ...
1
vote
1answer
53 views

How can I evaluate the security of a contrib module?

Are there security standards for each stage of a module on Drupal.org? Create sandbox project > full project with dev version only > official release What is the process for the security of ...
1
vote
1answer
14 views

How can I monitor for bot accounts accessing drupal paths without permission?

On my site, users do not have permission to create content. However, looking through the watchdog logs, I found several accounts that were attempting to access node/add/article node/add/page and so ...
1
vote
2answers
123 views

Is this block safe from code injection exploit?

Thanks good people here, I have create a simple module which generate two blocks as follows: function myblockmodule_block_info(){ $block['myadblocks'] = array( 'info' => t('My first ...
1
vote
1answer
49 views

Is it safe and fine to block external access to sites/all/modules folder and all its subfolders and files? [closed]

That's to say block all except 127.0.0.1?
1
vote
1answer
52 views

Site affected by PSA-2014-003, revoke all public keys?

I didn't patch my website right after PSA-2014-003, it run about one week unpatched. Now, I'm moving my website to a new server, using an old database backup. In my old server, I used an passphrase ...
1
vote
1answer
115 views

Aegir and SA-CORE-2014-005

Case: - Aegir server 2.1 on Drupal 6.31 -- Platform Hostmaster: Drupal 6.31 --- Hostmaster: ? -- Platform 1: Drupal 7.31 --- Site 1: HACKED --- Site 2: HACKED -- Platform 2: Drupal 7.32 --- Site 3: ? ...
1
vote
1answer
106 views

How to hide username displayed in code with Omega 3 theme

Drupal 7 with Omega version 3 theme generates a username class for the article tag in the HTML code, something like : class="node node-page node-published node-not-promoted node-not-sticky author-...
1
vote
1answer
113 views

Where does field help text get filtered?

Drupal 7 fields, by default, have a nice text box beneath them for Help Text. This is set up with field_ui_field_edit_form(): $form['instance']['description'] = array( '#type' => 'textarea', '...
1
vote
1answer
373 views

Security issues while using external javascript and php files to access mysql database in drupal nodes

I have created a search_interface node which asks for filters and onClick event of the submit button, I have called an external search.js script. My search_interface node is of a custom content type ...
1
vote
1answer
244 views

One-time link without valid email address Spam Registrations

I have a D6 site that gets a lot of SPAM account registration and they all follow a pattern, however from different IP addresses (often during the following process): 1) User account is created 2) ...
1
vote
1answer
398 views

in multi-site do you set base url for each sites settings?

Have just enabled security review module and it's alerting to base url not being uncommented and set. This is a multi-site so do I need to set the base url in each settings file for each site? I set ...
1
vote
2answers
503 views

Drupal security ACL

I have a client having website in Drupal . He need to create user and want to assign rights for edit and delete on every column displayed in webpage. I have tried ACL but that didn't work, so Iam ...
1
vote
1answer
739 views

Decode entities in node titles

I have a few node titles that are being saved with & and displaying that way too. Is there any way to not encode them while being saved? I tried: $node = node_load(727); $node->title = ...
1
vote
1answer
14 views

Configuring Fail2ban for the r4032login module

Recently, I installed fail2ban on my server to help prevent bots from abusing the site. I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the ...
1
vote
0answers
51 views

Distribution Commerce Kickstart 1.x - is possbile run Drupal Core 7.61 / PHP 7.2 ? And how [closed]

I have small and very simple Drupal 7 site based on Commerce Kickstart 1.x distribution (originally instalation profile, now "distribution"). The version of distribution is 7.x-1.53. It is last ...
1
vote
1answer
107 views

Is media-7.x-1.x vulnerable to SA-CONTRIB-2018-020

The Drupal Media module version 7.x-2.x contains a remote code execution vulnerability which was patched with: https://cgit.drupalcode.org/media/commit/?id=1cd77ffa9c2cf96d80b76d47318179a8a82f0d46 1....
1
vote
1answer
193 views

security kit module settings are blocking own site jQuery calls

I am using Security kit module to enhance security for my website. In that I have enabled Enable JavaScript + CSS + Noscript protection option. This setting is blocking one of Jquery call that is ....
1
vote
0answers
258 views

Drupal not detecting updated Trusted Host Settings

I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message: TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is not configured in ...
1
vote
1answer
202 views

How to add security questions in Drupal 8?

I need to add security questions while user creating his account in Drupal 8. I need to use those security questions to retrieve his password, when user forgets his password. Any suggestions ?
1
vote
1answer
28 views

How to securely access the data from another Drupal instance?

I have a site setup which feels fairly unconventional so please bare with me while I try to explain. I have 2 Drupal sites based on different servers. The main site (site A) contains the front-end ...
1
vote
1answer
16 views

Entity Reference + View + security

I have this scenario in DRUPAL 7 A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian). A content type named "Reports" with a field "...
1
vote
2answers
41 views

Best practice, removing admin access from many websites

hopefully this is not a repeat question, not sure how to search for this. I run over 50 websites, not all are on the same server but some do hold many users together. Not all our servers are ours, ...
1
vote
0answers
54 views

Keeping sensitive data from appearing in cache_form table

I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the ...
1
vote
0answers
21 views

Any security issues accessing $_POST and returning values from it in AJAX commands?

Just wondering if there needs to be any sanitization here: /** * Implements hook_ajax_render_alter(). */ function my_module_ajax_render_alter(&$commands) { if (isset($_POST['...
1
vote
1answer
26 views

I'm using CiviContribute and need CAPTCHA

I'm new to Drupal and CiviCRM. I work mostly with Blackbaud/NetCommunity. I'm operating a website that using CiviContribute for donations. Our Payment Processor is Paypal Payments Pro. I'm trying to ...
1
vote
0answers
595 views

Update database/dom after dialog button submitted with jQuery

Clicking a dialog button I want to update Drupal database using jQuery .ajax() function! I want to know if in first place is secure to do so or is another method to handle the synchronous requests? ...
1
vote
0answers
17 views

site hacked: ctolls cercoincontri [duplicate]

one of the web site (in Drupal 7.43) I am looking after (apparently not that well, although updates have always been applied) has been hacked. There's now extra text in the footer pointing to an ...
1
vote
1answer
371 views

What to do for “Login attempt failed for admin.” and “Access denied” to path admin?

In Watchdog, I started seeing several entries like this: Login attempt failed for admin. And access denied 2016/04/04 - 15:06 admin These are generating a fair number of log entries. The IP ...
1
vote
1answer
112 views

Using the back button after logging out shows you pages from the authenticated user's session

Using the back button after logging out shows you pages from the authenticated user's session. I found a solution for this, need to set the header like this to fix this issue- drupal_add_http_header(...
1
vote
2answers
100 views

Is it safe to send the unencoded JSON output?

The mobile app developers wants an api to get a list of articles from our Drupal site. It should have these fields in the output: nid title field_teaser_body The api resonse has to be in JSON format....
1
vote
1answer
31 views

How to apply node access rules when querying menu_links table

I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way ...
1
vote
1answer
87 views

Updating drupal commons issue [duplicate]

Security Update for drupal All other updates are being done smoothly thorugh drush I have a multi site installation if drupal so i worried to remove the sites folder and update that the general way. ...
1
vote
0answers
41 views

Is Commerce Stripe any more or less secure than Commerce Paypal?

The very first thing the Commerce Stripe module states is this: As of the implementation of PCI-DSS 3.0 (January 2015), this module is intended to work within the requirements of the Self ...