Questions tagged [security]
Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.
47
questions
98
votes
7
answers
15k
views
What are the downsides of using PHP Filter code in blocks, nodes, views-args, etc?
I have seen many times people saying not to use custom PHP/PHP filter (from the Drupal UI) in blocks, nodes, views-args, rules, etc. I have searched around a bit and haven't found much, it seems like ...
- 6,815
153
votes
10
answers
213k
views
What are the recommended directory permissions?
I'm gearing up to deploy a Drupal 7 site and I can't find any documentation. What are the recommended security-conscious permissions for files and directories?
I am specifically interested to the ...
- 2,149
40
votes
7
answers
14k
views
Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?
I just updated all my sites using the patch method of resolving the Drupal SA-CORE-2014-005 exploit. I just read reports that just yesterday there is someone from a Russian IP infiltrating drupal ...
- 8,731
57
votes
3
answers
34k
views
How to upgrade only core with drush?
There's a huge security leak in <7.32. So I want to upgrade all my Drupal sites asap without too much worrying about breaking stuff.
But...
$ drush dl drupal-7.32
It's forbidden to download ...
- 1,704
33
votes
6
answers
10k
views
What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?
Reading up on https://www.drupal.org/node/2357241 and the technical details at https://www.drupal.org/SA-CORE-2014-005, as well as the actual patch which is simply:
diff --git a/includes/database/...
- 4,604
4
votes
3
answers
1k
views
PHP in database: bad practice but
Lots of times here I've been told that using views custom php fields, filters or others is a bad practice, because putting php in the sql is dangerous.
My question is, if you only call to a function, ...
- 2,214
2
votes
1
answer
780
views
How can I exclude API keys, passwords, and so on from configuration management?
I am using Drupal 8 and drush cex to commit my configuration to my repository.
However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive ...
- 28.1k
31
votes
3
answers
13k
views
Differences between value and safe_value
What are the differences between ['value'] and ['safe_value']?
- 7,904
16
votes
1
answer
8k
views
Is check_plain() enough?
Is check_plain() enough for re-displaying the text entered by users in the browser, or should I still filter with filter_xss()?
- 7,904
8
votes
2
answers
459
views
Why is settings.php in the web folder?
In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a ...
- 932
6
votes
1
answer
3k
views
Drupal reuses its hash salt
The instructions in default.settings.php say
This variable will be set to a random value by the installer. All one-time
login links will be invalidated if the value is changed. Note that if ...
- 9,087
6
votes
5
answers
3k
views
Spambots causing server crashes. How do I block them? [closed]
I have a Drupal 7 website on a shared hosting account that uses an Apache server. It is getting continuously battered by spam bots who try to post junk comments and create fake accounts. What methods ...
- 502
2
votes
3
answers
2k
views
How to remove malicious scripts from admin pages after being hacked?
The site running Drupal 7 was hacked and every administration page, e.g.
http://www.anysite.com/en/admin/dashboard
contains script tag in head section with malicious src attribute, e.g.
<head>...
- 199
2
votes
2
answers
3k
views
Protect site from flooding when user login is attacked by brute force
I've been experiencing issues with bots trying to force their way into the website I manage. It seems to be a daily occurrence the the flood system is being triggered (I'm on D7).
I'm happy the the ...
- 2,409
2
votes
2
answers
247
views
Is there a way to send emails when someone logs in?
Logins on my sites are very infrequent and are normally done by myself. I would like a way of getting email notification when someone logs in. This way I might be able to spot someone hacking into the ...
- 125
1
vote
2
answers
249
views
How can I control node access based on entity reference to multiple users
I have multiple uses for this functionality now but mainly for a private message system.
What I want to do:
Configure a content type with an entity reference to users
Create nodes of that type and ...
- 362
11
votes
1
answer
9k
views
How and when to use filter_xss() and check_plain()?
There are lots of template files like this one views-view-fields--magazine--magazine.tpl.php in my website. how and when I should use the filter_xss() and check_plain() to improve security? for ...
- 3,862
8
votes
3
answers
8k
views
Prevent Cross-site scripting
One of the security principles is sanitizing strings and variables passed from client to server. In plain PHP there are some functions to prevent XSS (Cross-site Scripting) vulnerabilities:
...
- 21.8k
7
votes
5
answers
12k
views
How to enable a site to be in an iframe?
How can I enable a Drupal site to be in an iframe and place it in basic html page.
If I try this:
<iframe src="drupal-site.com"></iframe>
then it doesn't show any result.
Any ...
- 143
6
votes
1
answer
3k
views
How to place Drupal_Security_Do_Not_Remove_See_SA_* into httpd.conf instead of .htaccess
I run several Drupal 7 installations on a dedicated server with CentOS 6.4 and Apache 2 (the package httpd-2.2.15-29.el6.centos.x86_64).
I wonder, how to properly configure the ...
- 884
4
votes
5
answers
782
views
What are the ways/strategies to maintain Drupal sites a over period of 10-15 years?
We have started using Drupal as a PHP programming framework (and not just as a CMS). As result, we have many projects running on Drupal (6 or 7).
Typically, after 2-3 years a project gets over and no ...
- 1,446
4
votes
3
answers
857
views
How do I go about putting standalone PHP files?
I want to add an extra cool PHP Class, where would I put it in Drupal, how do I make absolutely sure the code doesn't present a security risk, should I just make it into a module?
- 1,367
4
votes
1
answer
731
views
How safely allow untrusted users to use img tag?
Following this question, I'm wondering how can I allow users of a social site (which obviously are not all trusted) to upload images while avoiding XSS threats?
- 1,947
4
votes
2
answers
2k
views
Is allowing Full HTML (HTML filter on) input for all user roles safe?
Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?
- 1,368
4
votes
1
answer
1k
views
How to get accurate information about available security updates after End-of-Life?
For a Drupal 6 site that use the update module, the "Available updates" report no longer shows accurate information about available security updates.
Of course, this is because after Drupal 6's End-...
- 35.8k
4
votes
3
answers
1k
views
How can I stop Drupal from tracking or collecting IP addresses?
Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (...
- 141
4
votes
5
answers
3k
views
How secure are variable_get and variable_set?
I have a custom module that saves variables with FTP usernames and passwords. Is variable_get secure? Ie. Can it be accessed outside of the module.
Is variable_set equally secure?
Obviously they are ...
- 1,209
3
votes
2
answers
983
views
How to update Drupal securely using GUI/web interface
The admin/reports/updates/update page lists updates, and there's what looks like a handy button Download these updates at the bottom.
And then you're asked for your SSH user and password.
Now unless ...
- 3,989
3
votes
1
answer
124
views
Trying to make my entire site https
I am trying to make an entire Drupal site https.
I tried enabling secure pages, and this seems to work for every authenticated user.
However any anonymous user either gets only http, or possibly an ...
- 2,297
3
votes
1
answer
4k
views
How to set content-security-policy header?
I want to set Content-Security-Policy header in my site.
I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.
- 363
3
votes
1
answer
218
views
What is the best way to restrict website's direct access through node urls? [duplicate]
How can I prevent a node from being accessible on its own page, through node/xxx, but still be accessible through node description eg: /homepage?
I tried using the Rabbit Hole module, which ...
- 31
3
votes
2
answers
530
views
Should Drupal 6 be considered insecure?
After reading the post about linkedin on IT security and this issue I would think that having a default Drupal 6 installation without, for example, the phpass module should be considered quite ...
- 2,501
3
votes
2
answers
692
views
What are the alternatives for storing client side encrypted data?
I want to store client side encrypted data in Drupal 7, so that it is encrypted on the client end, and stored and transmitted in encrypted form. The password is never transmitted or stored on the ...
- 1,269
2
votes
1
answer
754
views
Will forcing validation on a node save result in security issues or data integrity loss?
I have a content type containing lots of required and conditional fields. Because it can take a bit of time to properly create these nodes, and not all information will always be available to the end-...
- 4,604
2
votes
1
answer
1k
views
In what cases should I personally sanitize input & output when using the Database Abstraction Layer
I'm trying to get a clearer sense of where security vulnerabilities on my site may lie. At no point in my code do I ever query the MySQL database directly; I always use the Database Abstraction Layer (...
- 1,231
2
votes
1
answer
4k
views
What's the best file permission to drupal's files and directories? [duplicate]
Possible Duplicate:
What are the recommended directory permissions?
I want to know what's the best file permission under a linux system to my drupal's files and directories including the files ...
2
votes
2
answers
787
views
Drupal Commons 3 and Original Drupal Core Updates
I'm may be planning to switch over to Drupal Commons 3. When the original Drupal core gets security updates, will I be able to get those updates in the Drupal Commons or do I have to wait for Drupal ...
- 23
2
votes
2
answers
3k
views
How to get rid of 'security updates available' warnings?
I am using the ShareThis module on my website. Unfortunately, recent release 2.3 is flagged as a security update, but it is has a major bug (settings can't be saved). I have reverted to release 2.2.
...
- 1,359
1
vote
2
answers
1k
views
Automatically block user that access /wp-login.php
Is it possible to block any users IP if they try to access a specific URL such as /wp-login.php page which does not exist on Drupal.
Basically to automatically blacklist the user, for days or even ...
- 619
1
vote
2
answers
4k
views
How to disable PHP files from being run in the sites/default/files directory?
By default does drupal 7's sites/default/files directory disables running of PHP files?
- 8,731
1
vote
2
answers
134
views
Is this block safe from code injection exploit?
Thanks good people here, I have create a simple module which generate two blocks as follows:
function myblockmodule_block_info(){
$block['myadblocks'] = array(
'info' => t('My first ...
- 145
1
vote
7
answers
8k
views
Insecure content warning with D7 and SSL
I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome ...
- 946
1
vote
1
answer
1k
views
What is the suitable file permission for 'files'?
I have written this small bash script to rebuild D6.22 file permissions:
#!/bin/bash
cd /path/to/drupal
chown -R bob:www-data .
find . -type d -exec chmod u=rwx,g=rx,o= {} \;
find . -type f -exec ...
- 1,947
0
votes
1
answer
449
views
Understanding the Basic Context of Trusted Hosts [duplicate]
I got the trusted host settings error.
The trusted_host_patterns setting is not configured in settings.php. This can lead to security vulnerabilities. It is highly recommended that you configure ...
- 575
0
votes
1
answer
710
views
Confusion about files permission
Accrding to drupal docs:
The following is an example file listing of a safe configuration showing two files in a site where uploaded files are stored in the "files" directory. In order to see the ...
- 1,947
0
votes
1
answer
263
views
How allowing img tag in formats can be dangerous?
I get this recommendation form Security review module:
It is recommended you remove the following tags from roles accessible
by untrusted users: img
I am wondering what real world threats can ...
- 1,947
0
votes
1
answer
204
views
Can't access my website
I can't access my website. I guess it has been hacked. Some drupaldev user is already been created and is in admin list. I have blocked that user multiple times, but it reappears again and again in my ...
- 105