Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
142
votes
11answers
184k views

What are the recommended directory permissions?

I'm gearing up to deploy a Drupal 7 site and I can't find any documentation about what the recommended security-conscious file and directory permissions should be set to. Specifically default/files/ (...
96
votes
6answers
14k views

What are the downsides of using PHP Filter code in blocks, nodes, views-args, etc?

I have seen many times people saying not to use custom PHP/PHP filter (from the Drupal UI) in blocks, nodes, views-args, rules, etc. I have searched around a bit and haven't found much, it seems like ...
51
votes
3answers
32k views

How to upgrade only core with drush?

There's a huge security leak in <7.32. So I want to upgrade all my Drupal sites asap without too much worrying about breaking stuff. But... $ drush dl drupal-7.32 It's forbidden to download ...
40
votes
7answers
13k views

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

I just updated all my sites using the patch method of resolving the Drupal SA-CORE-2014-005 exploit. I just read reports that just yesterday there is someone from a Russian IP infiltrating drupal ...
33
votes
6answers
9k views

What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?

Reading up on https://www.drupal.org/node/2357241 and the technical details at https://www.drupal.org/SA-CORE-2014-005, as well as the actual patch which is simply: diff --git a/includes/database/...
31
votes
3answers
12k views

Differences between value and safe_value

What are the differences between ['value'] and ['safe_value']?
16
votes
1answer
7k views

Is check_plain() enough?

Is check_plain() enough for re-displaying the text entered by users in the browser, or should I still filter with filter_xss()?
15
votes
1answer
3k views

is db_insert secure?

I'm using the Drupal 7 method db_insert, to insert data into a custom table in the Drupal database. I've read that this is the prefered way, however I've walked through the code and doco and I can't ...
15
votes
3answers
2k views

Drupal admin area and login, Securing them with HTTPS

I've been reading a lot about this and trying many of the methods I've found and haven't yet been able to get anything working properly. I want to be able to secure the admin area and associated ...
14
votes
6answers
8k views

How to deal with someone trying to login as admin?

During these last days, I noticed in my dblog, that someone has been trying to sneak around. The person tried finding the login url (my website isn't open for user registration) so they tried ...
13
votes
4answers
11k views

Which files should I delete after a Drupal installation?

After installing Drupal, there are files in the root directory that I should delete. I know that install.php is one of those. Which other files should I delete?
10
votes
4answers
5k views

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 — 2018 March exploit?

Just released exploit: https://www.drupal.org/sa-core-2018-002 --- Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 How can I tell if someone used this exploit to hack my site?...
10
votes
4answers
2k views

Somebody is trying to brute force the password

Looking at the site log, I found, that somebody with IP address: 91.236.74.135 is methodically sending requests to the page: /user?destination=node/add of my Drupal website. He does it once in every ...
10
votes
1answer
7k views

How and when to use filter_xss() and check_plain()?

There are lots of template files like this one views-view-fields--magazine--magazine.tpl.php in my website. how and when I should use the filter_xss() and check_plain() to improve security? for ...
9
votes
4answers
3k views

Is drupal safe against brute force login attacks?

A brute-force attack is an attempt to gain unauthorized access to a website by continually generating and inputting various combinations of a password. This task is usually done by automation software ...
8
votes
6answers
2k views

Will Drupal 6 be left in a secure state after it becomes unsupported?

I created a custom database interface using Drupal 6 + Views + CCK that works really well for my company and recently I had to migrate it to another server. I thought "Hey, why not install Drupal 7 ...
8
votes
1answer
774 views

What do blocked IP addresses see?

I have been getting a lot of failed attacks targeting my server in the last few months. I have been using the Drupal IP block to block IPs that where sniffing for vulnerabilities. I would like to know ...
8
votes
4answers
6k views

base_url for both http and https?

I have a site that is accessible both through http and https. I see the security review complains that base_url is not defined in settings.php. However when I define it as http://example.com, and ...
8
votes
2answers
384 views

Why is settings.php in the web folder?

In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a ...
7
votes
1answer
3k views

Sanitized text input for EntityMetadataWrapper set()

Through searching, I've found plenty of examples using the EntityMetadataWrapper set() function to update entity fields, and have implemented it successfully in my module. However, I haven't been able ...
6
votes
5answers
3k views

Spambots causing server crashes. How do I block them?

I have a Drupal 7 website on a shared hosting account that uses an Apache server. It is getting continuously battered by spam bots who try to post junk comments and create fake accounts. What methods ...
6
votes
2answers
769 views

Why has my security shield for my new module on Drupal.org been removed?

I have recently managed to create a module on drupal.org, by following the entire process from Sandbox->Project Application->Module Publish. However after few weeks my module lost the security ...
6
votes
1answer
4k views

How to override “This image has been removed”?

I'm using Drupal core 8.0.0-beta10. I just tried to add new basic page content that contains image to external website and while it's showing up in preview, image isn't showing up once page is ...
6
votes
3answers
4k views

Prevent Cross-site scripting

One of the security principles is sanitizing strings and variables passed from client to server. In plain PHP there are some functions to prevent XSS (Cross-site Scripting) vulnerabilities: ...
6
votes
1answer
2k views

How to place Drupal_Security_Do_Not_Remove_See_SA_* into httpd.conf instead of .htaccess

I run several Drupal 7 installations on a dedicated server with CentOS 6.4 and Apache 2 (the package httpd-2.2.15-29.el6.centos.x86_64). I wonder, how to properly configure the ...
6
votes
1answer
285 views

What security issues are involved with cross-domain logons using OpenID?

I want to implement cross-domain logons for 3 sites. Is OpenID the best tool for protecting my site and users?
6
votes
2answers
8k views

How to set up salt hash while installing Drupal 7?

I am no expert in salt hash but while I was installing Acquia Dev, I noticed a variable $drupal_hash_salt, filled with a randomly generated string, in settings.php of newly installed Drupal 7 and a ...
6
votes
2answers
116 views

Module available for forcing users to re-enter their password to view/edit certain user account fields?

My users have custom fields for their user account that can contain some sensitive information. To protect against privilege escalation vulnerabilities, I'd like to make these fields only readable and ...
6
votes
1answer
1k views

Preventing SQL injection

In Drupal 6, queries are issued with db_query(). Using %-modifiers, query arguments are substituted into the query after being filtered. Strings %s (and only strings) are ultimately run through ...
5
votes
4answers
2k views

Malware on D7 website - Blacklisted by Google

I want to tell you about the malware attack to my Drupal website. Not just for your suggestions but also to create something helpful to anybody tha could suffer for the same problems. Well... INITIAL ...
5
votes
1answer
2k views

Drupal reuses its hash salt

The instructions in default.settings.php say This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if ...
5
votes
1answer
6k views

Recommendations for security testing a Drupal site? [closed]

I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal ...
5
votes
2answers
290 views

Using modules “not covered by Drupal’s security advisory policy”

I would like to use a Drupal 7 module that is "not covered by Drupal’s security advisory policy", specifically the Conditional Fields module. It would allow me to do exactly what I need. It looks ...
5
votes
5answers
4k views

Remove the X-generator header from the response

I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header. I am using the following code, but it removes the x-...
5
votes
2answers
4k views

Remove XMLRPC to avoid vulnerability exploit

How is xmlrpc.php from Drupal core affecting functionality? Given the fact that a vulnerability was discovered for it, details in this article is it safe to remove xmlrpc.php file? Is it bad ...
5
votes
1answer
3k views

Will changing the value of $drupal_hash_salt in settings.php file break site

I was looking through a list of steps to take when there is a risk that your site has been hacked. It recommends changing the value of $drupal_hash_salt in settings.php. According to the inline ...
5
votes
4answers
4k views

Encrypting db password stored in settings.php

The db password in settings.php is stored as plain text. Is there any way to encrypt that password? My client says its a security risk even though the file permissions is as should.
5
votes
2answers
2k views

Secure Pages module is not redirecting

I installed Secure Pages on a site, where I need to secure admin and user login pages. In general, it does its job, but when the user first tries to log in, and goes to the /user page, that page is ...
5
votes
2answers
2k views

Is bypassing Drupal's #token protection against CSRF safe for search forms specifically?

I see that $form['#token'] is employed in drupal_prepare_form() and drupal_validate_form() as a protective measure against cross-site request forgery. I am wondering about the necessity of this ...
5
votes
1answer
740 views

How is password hashing/encryption performed?

I am fielding a question for a project that is asking if we use Blowfish crypt in Drupal, or, if we could. The class that performs password hashing in 8 is PhpassHashedPassword, based on https://www....
4
votes
3answers
317 views

Is CiviCRM data vulnerable to the Drupageddon bug?

Would CiviCRM data have been exposed to a Drupageddon exploit if it happened before I updated the site to Drupal 7.32? CiviCRM is in a separate MySQL database. However, the site uses Views/CiviCRM ...
4
votes
3answers
1k views

PHP in database: bad practice but

Lots of times here I've been told that using views custom php fields, filters or others is a bad practice, because putting php in the sql is dangerous. My question is, if you only call to a function, ...
4
votes
2answers
1k views

How critical is SA-CORE-2018-005?

The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability ...
4
votes
1answer
3k views

Prevent SQL injection

One of the security principles is sanitize string and variables passed from client to server; SQL injection is one of the way to hack a website. in plain PHP there are some functions to prevent SQL ...
4
votes
5answers
769 views

What are the ways/strategies to maintain Drupal sites a over period of 10-15 years?

We have started using Drupal as a PHP programming framework (and not just as a CMS). As result, we have many projects running on Drupal (6 or 7). Typically, after 2-3 years a project gets over and no ...
4
votes
1answer
511 views

My site was hacked, how can I use chmod permissions to avoid this?

To be honest, only the home page was switched (even the text that was modified bragged about this, grrrr!), but still... not pleasant at all. So the important question, and something that was on my ...
4
votes
2answers
525 views

Securing my drupal website

I'm working on my very first drupal website and it will consist of a login form which will then give the user access to a form. This next form will allow the user to query my database to show the ...
4
votes
2answers
2k views

Is allowing Full HTML (HTML filter on) input for all user roles safe?

Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?
4
votes
1answer
3k views

In Drupal 7, how to prevent *.php files from being upload to the /files folder when its required to have 777 permissions?

Hi one of the sites im working on just recently got comprised and a bunch of php files got upload somehow or someway into the files folder and started sending out alot of spam. I know during ...
4
votes
1answer
398 views

Drupal automatic “antihack” behaviour

I experience some difficulties with formalizing a question for Google, so I'm going to post it here and request real human help=) Are there any systems (modules or smth similar) in Drupal that ...