Questions tagged [security]
Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.
433
questions
0
votes
1
answer
86
views
What's the meaning of [Drupal 10.0.x will receive security coverage until December 2023.] in release note [closed]
What's the meaning of [Drupal 10.0.x will receive security coverage until December 2023.] in release note. Can I continue to use Drupal 10.0.x after December 2023, is there any problem that I need to ...
- 5,557
1
vote
1
answer
47
views
Implement anti-CSRF tokens into all requests to add protection from cross-site request forgery attacks
Is there any module or technique to implement anti-CSRF tokens into all requests in Drupal 9 for anonymous users?
- 11
1
vote
0
answers
486
views
Drupal not detecting updated Trusted Host Settings
I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message:
TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is
not configured in ...
- 1
1
vote
1
answer
75
views
Why does Drupal harden permissions of the /web/sites/default directory and files?
I understand that Drupal hardens permissions of the /web/sites/default directory and its files, each time that the system_requirements() function is called, typically after each composer require ...
- 97k
0
votes
2
answers
2k
views
fix-permissions.sh for Drupal 8
With Drupal 7, when I upload a project from local to server, I usually run fix-permisions shell script to change owner and permissions of folder/files.
Is provided in :
https://www.drupal.org/node/...
- 6,981
0
votes
2
answers
95
views
Am I hardening the permissions in settings.php correctly?
Last month, I encountered an issue where I could not edit settings.php as it was read-only.
I asked this question and learned how to change the permissions to edit the file, and then harden them again....
- 97k
1
vote
1
answer
230
views
How do I edit settings.php when it is read-only?
I have a Drupal 10 site that I just installed for the first time. I am very new to Drupal, and I haven't done anything to this site except install it and set up basic details like the site name, ...
- 5,557
4
votes
1
answer
1k
views
How to get accurate information about available security updates after End-of-Life?
For a Drupal 6 site that use the update module, the "Available updates" report no longer shows accurate information about available security updates.
Of course, this is because after Drupal 6's End-...
CommunityBot
- 1
1
vote
2
answers
1k
views
How do I hide the core version to the outside world?
I was bothered in knowing with whatcms.org a version can be given for drupal 8, even a minor version - no minor version, instead, when I tried with a drupal 7.
Curiously enough in my case, I got a ...
- 97k
0
votes
1
answer
70
views
SQL injection POST attacks
Just found hundreds of POST requests to user registration pages on Drupal site. No users are being registered but these requests are still getting 200 status from Drupal.
Are these requests doing any ...
- 97k
6
votes
1
answer
3k
views
Drupal reuses its hash salt
The instructions in default.settings.php say
This variable will be set to a random value by the installer. All one-time
login links will be invalidated if the value is changed. Note that if ...
- 97k
5
votes
6
answers
10k
views
Remove the X-generator header from the response
I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header.
I am using the following code, but it removes the x-...
- 9
0
votes
1
answer
126
views
Modules are not updating to the latest version
I have some websites in the drupal. I need to update the security modules in the old version to the latest version. The list of security modules I tried to attempt is as below
1)colorbox (current - v2....
- 97k
4
votes
1
answer
1k
views
What steps are necessary to build secure database queries from user input?
Example Drupal 6 query:
$q = db_query("SELECT id FROM {table} WHERE no = %d AND name LIKE '%%%s%%'",
$_GET['something'], $_GET['something_else']);
Example Drupal 7 query:
$q = new ...
- 97k
1
vote
2
answers
51
views
How can I prevent a page with PHP content getting flagged in Security Review "Dangerous tags in content" check?
I am using Drupal 7. I have a page that has a PHP body that I know does not have any dangerous tags. According to the README.txt file in Security Review I need to add this to the "...
- 17.8k
2
votes
1
answer
53
views
After any Composer command, does Composer or core set (or harden) the file permissions?
After any Composer command (for example, composer create-project, composer require, and composer update), does Composer or Drupal set (or harden) the file permissions?
- 45
1
vote
1
answer
29
views
Configuring Fail2ban for the r4032login module
Recently, I installed fail2ban on my server to help prevent bots from abusing the site.
I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the ...
- 97k
1
vote
2
answers
247
views
How can I control node access based on entity reference to multiple users
I have multiple uses for this functionality now but mainly for a private message system.
What I want to do:
Configure a content type with an entity reference to users
Create nodes of that type and ...
- 17.8k
0
votes
1
answer
149
views
Getting error "PHP files in the Drupal files directory can be executed." in Security Review v.7.x-1.3
I am on Drupal 7.92. When I run Security Review I get the error "PHP files in the Drupal files directory can be executed." in Security Review v.7.x-1.3. The sites/default/files directory is ...
- 5,557
1
vote
2
answers
306
views
How can I encrypt user-submitted content per user for a content type?
Let's say I have a website where people keep a personal diary (diary content type). I have configured permissions so that each user can only read, write, and view his/her own diary.
Users can create ...
- 28.1k
7
votes
5
answers
12k
views
How to enable a site to be in an iframe?
How can I enable a Drupal site to be in an iframe and place it in basic html page.
If I try this:
<iframe src="drupal-site.com"></iframe>
then it doesn't show any result.
Any ...
- 97k
2
votes
2
answers
764
views
How to securely authenticate content embeded in another site?
I need to embed password protected content to a second domain with an iframe. The content itself is a view which will be displayed on a third party site via an iframe and the content is prepared with ...
- 97k
6
votes
1
answer
6k
views
Recommendations for security testing a Drupal site? [closed]
I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal ...
- 97k
1
vote
2
answers
292
views
refresh form_token with refresh page
Unfortunately, the form_token does not change when I refresh the form pages.
Doesn't this cause abuse and security risks?
Can anyone explain what Drupal does for CSRF in all its forms?
Thanks
- 21.8k
2
votes
5
answers
785
views
What is good way to hide update.php file?
I will like to know what is the correct/better way to hide update.php file on the production server.
Currently when you try to access update.php file, Drupal shows default access denied page with ...
- 17.8k
1
vote
0
answers
74
views
For which tables should the MariaDB user have CRUD permissions for browsing the site?
I'm trying to lock down the database on my Drupal 9 install so that people can browse the website, but can't write to it.
I have 2 users in MariaDB with access to the database. I want to set one ...
- 97k
153
votes
10
answers
212k
views
What are the recommended directory permissions?
I'm gearing up to deploy a Drupal 7 site and I can't find any documentation. What are the recommended security-conscious permissions for files and directories?
I am specifically interested to the ...
- 97k
1
vote
2
answers
109
views
security updates reported but not actually available (recommended==installed)
I installed Drupal 9.3.6.
At /admin/reports/status, I see the error:
There are security updates available for one or more of your modules or themes
and at /admin/modules/update, two modules are ...
- 97k
1
vote
1
answer
135
views
Drupal Commerce Product Variation SQL Injection Vulnerability
A PCI scan on my site is saying that there is a SQL Injection vulnerability. But where it seems to be indicating it is on pretty basic Commerce functionality. When visiting a product variation page ...
- 97k
4
votes
3
answers
857
views
How do I go about putting standalone PHP files?
I want to add an extra cool PHP Class, where would I put it in Drupal, how do I make absolutely sure the code doesn't present a security risk, should I just make it into a module?
- 97k
1
vote
0
answers
121
views
How can I allow users to change their email addresses without a password with JSON:API?
I have an Ionic React app and I want to allow users to change their email addresses.
However, when I try to change the email address in a PATCH request, I get the following error:
{
"jsonapi&...
- 28.1k
0
votes
1
answer
334
views
Does the login-link users receive upon registration actually expire?
I'm trying to expand the duration for the expiration of the one-time-login for the initial registration process:
the user clicks on "create new account"
after filling name and email and ...
- 3,313
1
vote
1
answer
531
views
Is it a valid approach to have a different CSP based on login state and browser?
I'm currently working on improving the security of a Drupal 8 site by implementing a Content Security Policy. As this is still new to me, I would like to get some input on my strategy.
Relevant base ...
- 131
0
votes
2
answers
1k
views
Malicious code on my site
I found that in all the JavaScript files on my Drupal website, there is JavaScript code with an <iframe> pointing to an external website. When I open the website through Google Chrome, the ...
- 97k
2
votes
2
answers
235
views
Do I need the trusted host setting?
Do I need the trusted host setting for a Drupal 7 site? If so how do I configure it?
I noticed that Backdrop CMS has it in their settings file.
- 97k
1
vote
1
answer
138
views
Do I need to set up public files directory for multi-sites differently?
I had some Drupal installations which I merged into a multi-site installation.
When they were single installations, I created a files in the root directory and set the system permissions for the ...
- 74
1
vote
0
answers
26
views
What is the specific security implication with the permission "Select method for cancelling account"
Below the permission "Select method for cancelling account" there is the following hint:
Warning: Give to trusted roles only; this permission has security implications.
I understand that ...
- 599
0
votes
3
answers
302
views
Use read-only database user to minimize security risks
I want to phase out an old, unmaintained Drupal 6 page. The website should still stay online, but should be read-only.
I want to change the database user so that it only has read privileges. I don't ...
- 97k
6
votes
2
answers
134
views
Module available for forcing users to re-enter their password to view/edit certain user account fields?
My users have custom fields for their user account that can contain some sensitive information. To protect against privilege escalation vulnerabilities, I'd like to make these fields only readable and ...
- 35.8k
1
vote
1
answer
453
views
Is json_decode parse-ability proof of a safe string?
Do I need to use check_plain (or something else) when displaying a user supplied JSON string, when I have previously checked it successfully parses with json_decode?
- 97k
0
votes
1
answer
394
views
How to restrict access to specific php file to only athenticated users
I manually made a php file that has the ability to connect to the database and create table entries, it works fine, but now the problem is that if I leave it there, anyone will be able to access it to ...
- 166k
0
votes
1
answer
355
views
403 Error - Unable to create Paragraphs via REST with ?_format=hal_json
Trying to add paragraphs via REST to the earlier created node.
I've installed the Paragraphs Type Permissions module, enabled the following permissions for my REST user's role
Text: Create content
...
- 11
1
vote
0
answers
92
views
Database password revealed in PHP error_log?
Noticed some errors while updating to Drupal 8.9.11. As I'm reviewing I come across the following. Replaced the actual password with PASSWORD below.
Is this intentional or a bug? I can't see why the ...
- 93
1
vote
0
answers
55
views
Decoupled Drupal - Security [closed]
I am running a Drupal 8.9.2 site as a content repository accessed via an Angular 8 app.
So there is one administrator who uses the Drupal interface to write content / upload files eccc.... and ...
- 97k
0
votes
2
answers
563
views
Sanitization of the q parameter
I'm using Drupal 7. My question regards the sanitization of the "q" parameter. We know about SQL injection, so I was wondering if this parameter may be a vector for this kind of security ...
- 97k
0
votes
1
answer
396
views
Why am I getting an error message in my dashboard for unprotected private files?
I have a site with Drupal 8.9
Why am I getting an error message in my dashboard for unprotected private files ?
When I go to the link it says this is for Drupal 6 and 7.
PRIVATE FILES DIRECTORY
Not ...
- 97k
0
votes
1
answer
76
views
What's The Security Implications for "Send arbitrary files" in Permissions
For my webforms, I want to receive attachments, when I receive an email. I had issues receiving them until I set the permissions for Anonymous User to allow them to use "Send arbitrary files"...
- 6,981
1
vote
1
answer
471
views
What to do for "Login attempt failed for admin." and "Access denied" to path admin?
In Watchdog, I started seeing several entries like this:
Login attempt failed for admin.
And
access denied 2016/04/04 - 15:06 admin
These are generating a fair number of log entries. The IP ...
CommunityBot
- 1
1
vote
2
answers
1k
views
Error: Private files directory not fully protected
I received the following error in my Drupal 8 status report:
PRIVATE FILES DIRECTORY Not fully protected See
https://www.drupal.org/SA-CORE-2013-003 for information about the
recommended .htaccess ...
- 575
0
votes
1
answer
449
views
Understanding the Basic Context of Trusted Hosts [duplicate]
I got the trusted host settings error.
The trusted_host_patterns setting is not configured in settings.php. This can lead to security vulnerabilities. It is highly recommended that you configure ...
- 575