Skip to main content

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
0 votes
0 answers
20 views

ACCESS DENIEND showing in content area of Drupal site behind LDAP-PROXY barrier

I'm scratching my head here with an unusual problem which began only AFTER MIGRATION into Drupal 9 / Drupal 10: try to protect access to site behind proxy-Ldap barrier (so people can access it from ...
1 vote
2 answers
185 views

How can I allow users to change their email addresses without a password via REST/JSON:API?

To change the password of a user account, Drupal requires the user to input their password. I have a decoupled Drupal app using JSON:API. The Nocurrent Pass module disables the password check when ...
4 votes
1 answer
1k views

How to get accurate information about available security updates after End-of-Life?

For a Drupal 6 site that use the update module, the "Available updates" report no longer shows accurate information about available security updates. Of course, this is because after Drupal 6's End-...
0 votes
0 answers
16 views

How to make access check to be called once for all languages ​or its result is at least cached for all languages ​at the same time?

I have custom access check for custom entity: public function access(AccountInterface $account, Route $route, ?EntityInterface $product = NULL) { $requirement = $route->getRequirement('...
0 votes
0 answers
34 views

Entity upload endpoint (POST) API security

Although Drupal provides default security features, I still have a doubt related to the security of uploading a file using the file entity upload API URL. If I have set the allowed file extension and ...
0 votes
1 answer
92 views

What's the meaning of [Drupal 10.0.x will receive security coverage until December 2023.] in release note [closed]

What's the meaning of [Drupal 10.0.x will receive security coverage until December 2023.] in release note. Can I continue to use Drupal 10.0.x after December 2023, is there any problem that I need to ...
1 vote
1 answer
168 views

Implement anti-CSRF tokens into all requests to add protection from cross-site request forgery attacks

Is there any module or technique to implement anti-CSRF tokens into all requests in Drupal 9 for anonymous users?
1 vote
0 answers
495 views

Drupal not detecting updated Trusted Host Settings

I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message: TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is not configured in ...
2 votes
1 answer
116 views

Why does Drupal harden permissions of the /web/sites/default directory and files?

I understand that Drupal hardens permissions of the /web/sites/default directory and its files, each time that the system_requirements() function is called, typically after each composer require ...
0 votes
2 answers
2k views

fix-permissions.sh for Drupal 8

With Drupal 7, when I upload a project from local to server, I usually run fix-permisions shell script to change owner and permissions of folder/files. Is provided in : https://www.drupal.org/node/...
0 votes
2 answers
349 views

Am I hardening the permissions in settings.php correctly?

Last month, I encountered an issue where I could not edit settings.php as it was read-only. I asked this question and learned how to change the permissions to edit the file, and then harden them again....
1 vote
1 answer
502 views

How do I edit settings.php when it is read-only?

I have a Drupal 10 site that I just installed for the first time. I am very new to Drupal, and I haven't done anything to this site except install it and set up basic details like the site name, ...
1 vote
2 answers
2k views

How do I hide the core version to the outside world?

I was bothered in knowing with whatcms.org a version can be given for drupal 8, even a minor version - no minor version, instead, when I tried with a drupal 7. Curiously enough in my case, I got a ...
0 votes
1 answer
153 views

SQL injection POST attacks

Just found hundreds of POST requests to user registration pages on Drupal site. No users are being registered but these requests are still getting 200 status from Drupal. Are these requests doing any ...
6 votes
1 answer
3k views

Drupal reuses its hash salt

The instructions in default.settings.php say This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if ...
5 votes
6 answers
10k views

Remove the X-generator header from the response

I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header. I am using the following code, but it removes the x-...
0 votes
1 answer
185 views

Modules are not updating to the latest version

I have some websites in the drupal. I need to update the security modules in the old version to the latest version. The list of security modules I tried to attempt is as below 1)colorbox (current - v2....
4 votes
1 answer
1k views

What steps are necessary to build secure database queries from user input?

Example Drupal 6 query: $q = db_query("SELECT id FROM {table} WHERE no = %d AND name LIKE '%%%s%%'", $_GET['something'], $_GET['something_else']); Example Drupal 7 query: $q = new ...
1 vote
2 answers
60 views

How can I prevent a page with PHP content getting flagged in Security Review "Dangerous tags in content" check?

I am using Drupal 7. I have a page that has a PHP body that I know does not have any dangerous tags. According to the README.txt file in Security Review I need to add this to the "...
2 votes
1 answer
61 views

After any Composer command, does Composer or core set (or harden) the file permissions?

After any Composer command (for example, composer create-project, composer require, and composer update), does Composer or Drupal set (or harden) the file permissions?
1 vote
1 answer
34 views

Configuring Fail2ban for the r4032login module

Recently, I installed fail2ban on my server to help prevent bots from abusing the site. I have the r4032login module installed and it is writing to the log, but it is using HTTP status 302 for the ...
1 vote
2 answers
380 views

How can I control node access based on entity reference to multiple users

I have multiple uses for this functionality now but mainly for a private message system. What I want to do: Configure a content type with an entity reference to users Create nodes of that type and ...
0 votes
1 answer
161 views

Getting error "PHP files in the Drupal files directory can be executed." in Security Review v.7.x-1.3

I am on Drupal 7.92. When I run Security Review I get the error "PHP files in the Drupal files directory can be executed." in Security Review v.7.x-1.3. The sites/default/files directory is ...
1 vote
2 answers
522 views

How can I encrypt user-submitted content per user for a content type?

Let's say I have a website where people keep a personal diary (diary content type). I have configured permissions so that each user can only read, write, and view his/her own diary. Users can create ...
7 votes
5 answers
13k views

How to enable a site to be in an iframe?

How can I enable a Drupal site to be in an iframe and place it in basic html page. If I try this: <iframe src="drupal-site.com"></iframe> then it doesn't show any result. Any ...
2 votes
2 answers
809 views

How to securely authenticate content embeded in another site?

I need to embed password protected content to a second domain with an iframe. The content itself is a view which will be displayed on a third party site via an iframe and the content is prepared with ...
6 votes
1 answer
6k views

Recommendations for security testing a Drupal site? [closed]

I'm about to relaunch my company's website using Drupal 7. I'm the sole web engineer in our IT department, so I have a lot on my plate as we approach the launch date. As this is my first major Drupal ...
1 vote
2 answers
351 views

refresh form_token with refresh page

Unfortunately, the form_token does not change when I refresh the form pages. Doesn't this cause abuse and security risks? Can anyone explain what Drupal does for CSRF in all its forms? Thanks
2 votes
5 answers
876 views

What is good way to hide update.php file?

I will like to know what is the correct/better way to hide update.php file on the production server. Currently when you try to access update.php file, Drupal shows default access denied page with ...
1 vote
0 answers
84 views

For which tables should the MariaDB user have CRUD permissions for browsing the site?

I'm trying to lock down the database on my Drupal 9 install so that people can browse the website, but can't write to it. I have 2 users in MariaDB with access to the database. I want to set one ...
153 votes
10 answers
214k views

What are the recommended directory permissions?

I'm gearing up to deploy a Drupal 7 site and I can't find any documentation. What are the recommended security-conscious permissions for files and directories? I am specifically interested to the ...
1 vote
2 answers
121 views

security updates reported but not actually available (recommended==installed)

I installed Drupal 9.3.6. At /admin/reports/status, I see the error: There are security updates available for one or more of your modules or themes and at /admin/modules/update, two modules are ...
1 vote
1 answer
138 views

Drupal Commerce Product Variation SQL Injection Vulnerability

A PCI scan on my site is saying that there is a SQL Injection vulnerability. But where it seems to be indicating it is on pretty basic Commerce functionality. When visiting a product variation page ...
4 votes
3 answers
858 views

How do I go about putting standalone PHP files?

I want to add an extra cool PHP Class, where would I put it in Drupal, how do I make absolutely sure the code doesn't present a security risk, should I just make it into a module?
0 votes
1 answer
415 views

Does the login-link users receive upon registration actually expire?

I'm trying to expand the duration for the expiration of the one-time-login for the initial registration process: the user clicks on "create new account" after filling name and email and ...
1 vote
1 answer
696 views

Is it a valid approach to have a different CSP based on login state and browser?

I'm currently working on improving the security of a Drupal 8 site by implementing a Content Security Policy. As this is still new to me, I would like to get some input on my strategy. Relevant base ...
0 votes
2 answers
1k views

Malicious code on my site

I found that in all the JavaScript files on my Drupal website, there is JavaScript code with an <iframe> pointing to an external website. When I open the website through Google Chrome, the ...
2 votes
2 answers
265 views

Do I need the trusted host setting?

Do I need the trusted host setting for a Drupal 7 site? If so how do I configure it? I noticed that Backdrop CMS has it in their settings file.
1 vote
1 answer
169 views

Do I need to set up public files directory for multi-sites differently?

I had some Drupal installations which I merged into a multi-site installation. When they were single installations, I created a files in the root directory and set the system permissions for the ...
1 vote
0 answers
28 views

What is the specific security implication with the permission "Select method for cancelling account"

Below the permission "Select method for cancelling account" there is the following hint: Warning: Give to trusted roles only; this permission has security implications. I understand that ...
0 votes
3 answers
369 views

Use read-only database user to minimize security risks

I want to phase out an old, unmaintained Drupal 6 page. The website should still stay online, but should be read-only. I want to change the database user so that it only has read privileges. I don't ...
6 votes
2 answers
134 views

Module available for forcing users to re-enter their password to view/edit certain user account fields?

My users have custom fields for their user account that can contain some sensitive information. To protect against privilege escalation vulnerabilities, I'd like to make these fields only readable and ...
1 vote
1 answer
454 views

Is json_decode parse-ability proof of a safe string?

Do I need to use check_plain (or something else) when displaying a user supplied JSON string, when I have previously checked it successfully parses with json_decode?
0 votes
1 answer
512 views

How to restrict access to specific php file to only athenticated users

I manually made a php file that has the ability to connect to the database and create table entries, it works fine, but now the problem is that if I leave it there, anyone will be able to access it to ...
0 votes
1 answer
377 views

403 Error - Unable to create Paragraphs via REST with ?_format=hal_json

Trying to add paragraphs via REST to the earlier created node. I've installed the Paragraphs Type Permissions module, enabled the following permissions for my REST user's role Text: Create content ...
1 vote
0 answers
98 views

Database password revealed in PHP error_log?

Noticed some errors while updating to Drupal 8.9.11. As I'm reviewing I come across the following. Replaced the actual password with PASSWORD below. Is this intentional or a bug? I can't see why the ...
1 vote
0 answers
56 views

Decoupled Drupal - Security [closed]

I am running a Drupal 8.9.2 site as a content repository accessed via an Angular 8 app. So there is one administrator who uses the Drupal interface to write content / upload files eccc.... and ...
0 votes
2 answers
683 views

Sanitization of the q parameter

I'm using Drupal 7. My question regards the sanitization of the "q" parameter. We know about SQL injection, so I was wondering if this parameter may be a vector for this kind of security ...
0 votes
1 answer
464 views

Why am I getting an error message in my dashboard for unprotected private files?

I have a site with Drupal 8.9 Why am I getting an error message in my dashboard for unprotected private files ? When I go to the link it says this is for Drupal 6 and 7. PRIVATE FILES DIRECTORY Not ...
0 votes
1 answer
77 views

What's The Security Implications for "Send arbitrary files" in Permissions

For my webforms, I want to receive attachments, when I receive an email. I had issues receiving them until I set the permissions for Anonymous User to allow them to use "Send arbitrary files"...

1
2 3 4 5
9