Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

72 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2 votes
1 answer
158 views

Mixed content issue while running updates.php in Drupal 6.37

We are facing this issue again for Drupal version 6.37. We do not have jquery update module installed. In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...
Preetam's user avatar
  • 31
2 votes
1 answer
127 views

Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?

I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
ja_him's user avatar
  • 357
2 votes
0 answers
152 views

How can I conditionally insert extra header data on Drupal 6 pages?

I'm using Drupal 6 with the WebForms module, and my entire site uses https. I need to insert some cache-control statements in the page headers of only certain pages (ones with forms on them). Is ...
Steve Rothman's user avatar
1 vote
2 answers
180 views

How can I allow users to change their email addresses without a password via REST/JSON:API?

To change the password of a user account, Drupal requires the user to input their password. I have a decoupled Drupal app using JSON:API. The Nocurrent Pass module disables the password check when ...
Patrick Kenny's user avatar
1 vote
0 answers
84 views

For which tables should the MariaDB user have CRUD permissions for browsing the site?

I'm trying to lock down the database on my Drupal 9 install so that people can browse the website, but can't write to it. I have 2 users in MariaDB with access to the database. I want to set one ...
blur's user avatar
  • 67
1 vote
0 answers
26 views

What is the specific security implication with the permission "Select method for cancelling account"

Below the permission "Select method for cancelling account" there is the following hint: Warning: Give to trusted roles only; this permission has security implications. I understand that ...
Philipp Zedler's user avatar
1 vote
0 answers
98 views

Database password revealed in PHP error_log?

Noticed some errors while updating to Drupal 8.9.11. As I'm reviewing I come across the following. Replaced the actual password with PASSWORD below. Is this intentional or a bug? I can't see why the ...
Jeff's user avatar
  • 93
1 vote
0 answers
492 views

Drupal not detecting updated Trusted Host Settings

I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message: TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is not configured in ...
Steve's user avatar
  • 57
1 vote
1 answer
35 views

How to securely access the data from another Drupal instance?

I have a site setup which feels fairly unconventional so please bare with me while I try to explain. I have 2 Drupal sites based on different servers. The main site (site A) contains the front-end ...
Jimmyb_1991's user avatar
1 vote
1 answer
19 views

Entity Reference + View + security

I have this scenario in DRUPAL 7 A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian). A content type named "Reports" with a field "...
Blof's user avatar
  • 11
1 vote
2 answers
41 views

Best practice, removing admin access from many websites

hopefully this is not a repeat question, not sure how to search for this. I run over 50 websites, not all are on the same server but some do hold many users together. Not all our servers are ours, ...
S. Chedal's user avatar
1 vote
0 answers
58 views

Keeping sensitive data from appearing in cache_form table

I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the ...
Jon Paul Vivere's user avatar
1 vote
0 answers
22 views

Any security issues accessing $_POST and returning values from it in AJAX commands?

Just wondering if there needs to be any sanitization here: /** * Implements hook_ajax_render_alter(). */ function my_module_ajax_render_alter(&$commands) { if (isset($_POST['...
nerdlinger's user avatar
1 vote
1 answer
40 views

I'm using CiviContribute and need CAPTCHA

I'm new to Drupal and CiviCRM. I work mostly with Blackbaud/NetCommunity. I'm operating a website that using CiviContribute for donations. Our Payment Processor is Paypal Payments Pro. I'm trying to ...
Austin's user avatar
  • 11
1 vote
0 answers
681 views

Update database/dom after dialog button submitted with jQuery

Clicking a dialog button I want to update Drupal database using jQuery .ajax() function! I want to know if in first place is secure to do so or is another method to handle the synchronous requests? ...
Robert-Dan's user avatar
1 vote
1 answer
184 views

Using the back button after logging out shows you pages from the authenticated user's session

Using the back button after logging out shows you pages from the authenticated user's session. I found a solution for this, need to set the header like this to fix this issue- drupal_add_http_header(...
Devendra Patel's user avatar
1 vote
2 answers
151 views

Is it safe to send the unencoded JSON output?

The mobile app developers wants an api to get a list of articles from our Drupal site. It should have these fields in the output: nid title field_teaser_body The api resonse has to be in JSON format....
pachabhaiya's user avatar
1 vote
1 answer
41 views

How to apply node access rules when querying menu_links table

I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way ...
Benjen's user avatar
  • 928
1 vote
0 answers
43 views

Is Commerce Stripe any more or less secure than Commerce Paypal?

The very first thing the Commerce Stripe module states is this: As of the implementation of PCI-DSS 3.0 (January 2015), this module is intended to work within the requirements of the Self Assessment ...
Marty Jannetty's user avatar
1 vote
0 answers
211 views

Using captcha in varnish setup

Captcha and any form of page caching don't get along. I understand why this is, but i'm wondering if there might be a certain setup to use captcha even in cached environments. Post requests for ...
jan's user avatar
  • 103
1 vote
0 answers
113 views

Are HTTP headers and cookies validated against malicious input?

I'm developing a Drupal site for a government organisation and am required to fill in a security assessment form. The form asks for confirmation that the "application" (Drupal in this case) takes ...
Frank H.'s user avatar
  • 804
1 vote
0 answers
145 views

Drupal update system not detecting latest (security) releases

This morning I got e-mails about security updates and I know one of the modules, path_breadcrumb is installed on some of my sites. So I ssh into these sites, do drush pm-update --security-only and it ...
Jurriaan Roelofs's user avatar
1 vote
1 answer
136 views

How to save POST variables securely using entity api

I am creating a module that connects Drupal Commerce to Shipworks (a shipping management system). They communicate with each other using HTTP POSTs via a single endpoint URL on Drupal. One aspect I am ...
PaulJ's user avatar
  • 41
1 vote
0 answers
79 views

Drupal site blocked by Windows defender

Visiting my Drupal 7 site just now with IE 11, I get this message: Windows Defender blocked content on this website lx7pyv.dofeqilr.com Hosted by: mysite.com Recommended icon Go to ...
Matt.Rad's user avatar
1 vote
0 answers
733 views

$base_url is set in settings.php but Security Review flags it still

I get this message in Security Review report: Base URL is not set in settings.php even though my settings.php code has this: $base_url = 'https://www.mysite.com'; I cleared caches several times, ...
longboardnode's user avatar
1 vote
0 answers
298 views

Captcha on login form using the form block module

I am providing the registration form using the form block module. I also have Captcha and Hidden Captcha module enabled on mysite. However i am not getting the option to add a captcha to the ...
why's user avatar
  • 1,147
1 vote
0 answers
41 views

Are there any security implications for having the Temporary Directory inside the Drupal root folder?

I'm having trouble finding the tmp dir of a particular host and I'm wondering if there is any reason not to just stick it inside the Drupal root.
Kevin's user avatar
  • 31
0 votes
0 answers
14 views

How to make access check to be called once for all languages ​or its result is at least cached for all languages ​at the same time?

I have custom access check for custom entity: public function access(AccountInterface $account, Route $route, ?EntityInterface $product = NULL) { $requirement = $route->getRequirement('...
Pablo's user avatar
  • 1
0 votes
0 answers
33 views

Entity upload endpoint (POST) API security

Although Drupal provides default security features, I still have a doubt related to the security of uploading a file using the file entity upload API URL. If I have set the allowed file extension and ...
Tejas's user avatar
  • 1
0 votes
1 answer
132 views

SQL injection POST attacks

Just found hundreds of POST requests to user registration pages on Drupal site. No users are being registered but these requests are still getting 200 status from Drupal. Are these requests doing any ...
JM John's user avatar
  • 15
0 votes
1 answer
178 views

Modules are not updating to the latest version

I have some websites in the drupal. I need to update the security modules in the old version to the latest version. The list of security modules I tried to attempt is as below 1)colorbox (current - v2....
jayaprakash R's user avatar
0 votes
3 answers
359 views

Use read-only database user to minimize security risks

I want to phase out an old, unmaintained Drupal 6 page. The website should still stay online, but should be read-only. I want to change the database user so that it only has read privileges. I don't ...
Harold L. Brown's user avatar
0 votes
1 answer
377 views

403 Error - Unable to create Paragraphs via REST with ?_format=hal_json

Trying to add paragraphs via REST to the earlier created node. I've installed the Paragraphs Type Permissions module, enabled the following permissions for my REST user's role Text: Create content ...
Vladimir P.'s user avatar
0 votes
0 answers
99 views

Security review: Some files and directories in your install are writable by the server

I am running Drupal 8 on a vps running latest ispconfig/apache fastCGI. Security review module reports: "Some files and directories in your install are writable by the server." and basically lists ...
Morten's user avatar
  • 101
0 votes
1 answer
139 views

What is x-speed-cache-key? What is its purpose?

Our drupal site was pentested. The pentest report labeled an action involving the header X-Speed-Cache-Key as a security concern. The finding stated: Arbitrary parameters supplied to the query ...
Paul's user avatar
  • 11
0 votes
0 answers
68 views

Drupal and security hardening - PHP chmod

I am struggling with the following case with Drupal and PHP hardening on an Red Hat Linux infrastructure. For drupal installation a user has been created. All the files and directories are owned by ...
GeralexGR's user avatar
  • 101
0 votes
1 answer
101 views

Node field not sanitize on render

I have a form for users who want to add new content on my Drupal 8 website. I render node field on a twig template : {{ node_field_title.value }} But field are not sanitized by Drupal. Is it the ...
Romain's user avatar
  • 3
0 votes
0 answers
57 views

Missing config/default directory error after patching the latest critical vulnerability

After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file. drupal/core from 8.5.8 to 8.5.11 drupal/jsonapi from 1.7 to ...
The Unknown Dev's user avatar
0 votes
0 answers
353 views

Proper security for settings.php

I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
GraphicsMuncher's user avatar
0 votes
2 answers
128 views

Security model and menu access

Drupal 8.6.1 I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc. ...
Aaron's user avatar
  • 101
0 votes
1 answer
59 views

How to always require email verification before accessing a page?

I have a custom page defined by hook_menu. I want signed in users to be required to verify their email every time they want to access it. The page will have buttons on it that would allow someone to ...
gMaximus's user avatar
0 votes
1 answer
18 views

How to add registry key verification step with the key being stored in another database

I am currently learning how to use Drupal through Udemy classes; I am a complete newbie. I am building a Drupal Website, for my personal development, and when someone wants to register to the ...
Hercules Apergis's user avatar
0 votes
1 answer
37 views

Custom Module Remote Fails Checksum with Drush

Background I have several proprietary Drupal modules that my company uses. We want to update these across all our sites. To that end, I've built an endpoint that produces code according to the (ill-...
Tyler Shuster's user avatar
0 votes
0 answers
115 views

(Answered) Ajax link for anonymous users to delete node they created if $_SESSION exists. Is node's created timestamp secure enough in link?

I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away. Instead of forcing them to create an account and take ...
Niall Murphy's user avatar
  • 2,771
0 votes
1 answer
54 views

Views php field or filter to a file or module

If I already have a view with a php filter or a php field, in drupal 7, how can I convert my whole view into a page? (prevent code injections or other security risks) What is the right way to resolve ...
Carlos Solé's user avatar
0 votes
0 answers
591 views

Basic authentication for external application making requests to Drupal instance

I have a external application that makes requests for content in my Drupal 8 instance. What I want to do is to make sure Drupal is only talking go my external application to stop traffic being spoofed....
harnamc's user avatar
  • 421
0 votes
3 answers
28 views

Find the password for user admin from a replicated old version of site

I have access to a copy of an old version of a production site on a dev server, but the owner of the website on prod has lost his credentials to admin and doesn't know his ssh login credentials. The ...
Patoshi パトシ's user avatar
0 votes
0 answers
1k views

How to make all URL redirect to HTTPS

There is already a lot of links displaying videos inside my site (in node content) that are using: http://example.com/clips/2017/01/11/51706, http://www.example.com/clips/2017/01/11/51706, https://...
mamesaye's user avatar
  • 261
0 votes
0 answers
21 views

Restricted visibility and search engine

The search engine crawler, like Googlebot, doesn't index any data, which is set to be visible only particular user, right? For example, let's say I have fields named field_A & field_B on user's ...
carrotandme's user avatar
0 votes
1 answer
26 views

Is it safe to use $vars['name_raw'] instead of $vars['name']?

I ran into an issue with usernames being trimmed in articles. I found a thread here with a fix suggesting to use $vars['name_raw']: https://www.drupal.org/node/854762#comment-7614255. It works. But I'...
Bisonbleu's user avatar
  • 422