Questions tagged [security]
Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.
71
questions with no upvoted or accepted answers
2
votes
1
answer
153
views
Mixed content issue while running updates.php in Drupal 6.37
We are facing this issue again for Drupal version 6.37.
We do not have jquery update module installed.
In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...
- 31
2
votes
1
answer
127
views
Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?
I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
- 347
2
votes
0
answers
148
views
How can I conditionally insert extra header data on Drupal 6 pages?
I'm using Drupal 6 with the WebForms module, and my entire site uses https.
I need to insert some cache-control statements in the page headers of only certain pages (ones with forms on them). Is ...
1
vote
0
answers
122
views
How can I allow users to change their email addresses without a password with JSON:API?
I have an Ionic React app and I want to allow users to change their email addresses.
However, when I try to change the email address in a PATCH request, I get the following error:
{
"jsonapi&...
- 28.1k
1
vote
0
answers
74
views
For which tables should the MariaDB user have CRUD permissions for browsing the site?
I'm trying to lock down the database on my Drupal 9 install so that people can browse the website, but can't write to it.
I have 2 users in MariaDB with access to the database. I want to set one ...
- 67
1
vote
0
answers
26
views
What is the specific security implication with the permission "Select method for cancelling account"
Below the permission "Select method for cancelling account" there is the following hint:
Warning: Give to trusted roles only; this permission has security implications.
I understand that ...
- 599
1
vote
0
answers
92
views
Database password revealed in PHP error_log?
Noticed some errors while updating to Drupal 8.9.11. As I'm reviewing I come across the following. Replaced the actual password with PASSWORD below.
Is this intentional or a bug? I can't see why the ...
- 93
1
vote
0
answers
486
views
Drupal not detecting updated Trusted Host Settings
I've installed Drupal 8 via Softaculous, and after I logged in for the first time, I see a message:
TRUSTED HOST SETTINGS Not enabled The trusted_host_patterns setting is
not configured in ...
- 57
1
vote
1
answer
34
views
How to securely access the data from another Drupal instance?
I have a site setup which feels fairly unconventional so please bare with me while I try to explain.
I have 2 Drupal sites based on different servers.
The main site (site A) contains the front-end ...
- 672
1
vote
1
answer
19
views
Entity Reference + View + security
I have this scenario in DRUPAL 7
A content type named "Students" with a field "Legal guardian" that references to a User (her/his legal guardian).
A content type named "Reports" with a field "...
- 11
1
vote
2
answers
41
views
Best practice, removing admin access from many websites
hopefully this is not a repeat question, not sure how to search for this.
I run over 50 websites, not all are on the same server but some do hold many users together. Not all our servers are ours, ...
- 11
1
vote
0
answers
58
views
Keeping sensitive data from appearing in cache_form table
I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the ...
1
vote
0
answers
22
views
Any security issues accessing $_POST and returning values from it in AJAX commands?
Just wondering if there needs to be any sanitization here:
/**
* Implements hook_ajax_render_alter().
*/
function my_module_ajax_render_alter(&$commands) {
if (isset($_POST['...
- 148
1
vote
1
answer
38
views
I'm using CiviContribute and need CAPTCHA
I'm new to Drupal and CiviCRM. I work mostly with Blackbaud/NetCommunity. I'm operating a website that using CiviContribute for donations. Our Payment Processor is Paypal Payments Pro.
I'm trying to ...
- 11
1
vote
0
answers
678
views
Update database/dom after dialog button submitted with jQuery
Clicking a dialog button I want to update Drupal database using jQuery .ajax() function! I want to know if in first place is secure to do so or is another method to handle the synchronous requests?
...
- 141
1
vote
1
answer
184
views
Using the back button after logging out shows you pages from the authenticated user's session
Using the back button after logging out shows you pages from the authenticated user's session.
I found a solution for this, need to set the header like this to fix this issue-
drupal_add_http_header(...
1
vote
2
answers
146
views
Is it safe to send the unencoded JSON output?
The mobile app developers wants an api to get a list of articles from our Drupal site.
It should have these fields in the output:
nid
title
field_teaser_body
The api resonse has to be in JSON format....
- 31
1
vote
1
answer
41
views
How to apply node access rules when querying menu_links table
I am creating a custom block which displays a menu. The menu is constructed by retrieving certain menu links from the menu_links table in the database. It has occurred to me that building it this way ...
- 918
1
vote
0
answers
43
views
Is Commerce Stripe any more or less secure than Commerce Paypal?
The very first thing the Commerce Stripe module states is this:
As of the implementation of PCI-DSS 3.0 (January 2015), this module is
intended to work within the requirements of the Self Assessment
...
1
vote
0
answers
206
views
Using captcha in varnish setup
Captcha and any form of page caching don't get along. I understand why this is, but i'm wondering if there might be a certain setup to use captcha even in cached environments.
Post requests for ...
- 103
1
vote
0
answers
112
views
Are HTTP headers and cookies validated against malicious input?
I'm developing a Drupal site for a government organisation and am required to fill in a security assessment form. The form asks for confirmation that the "application" (Drupal in this case) takes ...
- 804
1
vote
0
answers
145
views
Drupal update system not detecting latest (security) releases
This morning I got e-mails about security updates and I know one of the modules, path_breadcrumb is installed on some of my sites. So I ssh into these sites, do drush pm-update --security-only and it ...
- 173
1
vote
1
answer
136
views
How to save POST variables securely using entity api
I am creating a module that connects Drupal Commerce to Shipworks (a shipping management system). They communicate with each other using HTTP POSTs via a single endpoint URL on Drupal. One aspect I am ...
- 41
1
vote
0
answers
78
views
Drupal site blocked by Windows defender
Visiting my Drupal 7 site just now with IE 11, I get this message:
Windows Defender blocked content on this website lx7pyv.dofeqilr.com
Hosted by: mysite.com
Recommended icon Go to ...
- 15
1
vote
0
answers
733
views
$base_url is set in settings.php but Security Review flags it still
I get this message in Security Review report:
Base URL is not set in settings.php
even though my settings.php code has this:
$base_url = 'https://www.mysite.com';
I cleared caches several times, ...
- 1,237
1
vote
0
answers
298
views
Captcha on login form using the form block module
I am providing the registration form using the form block module. I also have Captcha and Hidden Captcha module enabled on mysite. However i am not getting the option to add a captcha to the ...
- 1,147
1
vote
0
answers
41
views
Are there any security implications for having the Temporary Directory inside the Drupal root folder?
I'm having trouble finding the tmp dir of a particular host and I'm wondering if there is any reason not to just stick it inside the Drupal root.
- 31
0
votes
0
answers
25
views
Impossible to change admin password, script gives me different hash every time (???)
Context: Drupal 9.14 installed on a small EC2 server for testing
After a composer update, my admin password stopped working (first strange event).
I decided to use the password-hash.sh to recreate one ...
- 1
0
votes
1
answer
74
views
SQL injection POST attacks
Just found hundreds of POST requests to user registration pages on Drupal site. No users are being registered but these requests are still getting 200 status from Drupal.
Are these requests doing any ...
- 15
0
votes
1
answer
129
views
Modules are not updating to the latest version
I have some websites in the drupal. I need to update the security modules in the old version to the latest version. The list of security modules I tried to attempt is as below
1)colorbox (current - v2....
0
votes
3
answers
302
views
Use read-only database user to minimize security risks
I want to phase out an old, unmaintained Drupal 6 page. The website should still stay online, but should be read-only.
I want to change the database user so that it only has read privileges. I don't ...
- 143
0
votes
1
answer
355
views
403 Error - Unable to create Paragraphs via REST with ?_format=hal_json
Trying to add paragraphs via REST to the earlier created node.
I've installed the Paragraphs Type Permissions module, enabled the following permissions for my REST user's role
Text: Create content
...
- 11
0
votes
0
answers
82
views
Security review: Some files and directories in your install are writable by the server
I am running Drupal 8 on a vps running latest ispconfig/apache fastCGI.
Security review module reports: "Some files and directories in your install are writable by the server." and basically lists ...
- 101
0
votes
1
answer
125
views
What is x-speed-cache-key? What is its purpose?
Our drupal site was pentested. The pentest report labeled an action involving the header X-Speed-Cache-Key as a security concern.
The finding stated:
Arbitrary parameters supplied to the query ...
- 11
0
votes
0
answers
66
views
Drupal and security hardening - PHP chmod
I am struggling with the following case with Drupal and PHP hardening on an Red Hat Linux infrastructure.
For drupal installation a user has been created. All the files and directories are owned by ...
- 101
0
votes
1
answer
91
views
Node field not sanitize on render
I have a form for users who want to add new content on my Drupal 8 website.
I render node field on a twig template :
{{ node_field_title.value }}
But field are not sanitized by Drupal. Is it the ...
- 3
0
votes
0
answers
57
views
Missing config/default directory error after patching the latest critical vulnerability
After hearing about the latest Drupal Critical Security warning, I went ahead and updated the following packages in my composer.json file.
drupal/core from 8.5.8 to 8.5.11
drupal/jsonapi from 1.7 to ...
- 577
0
votes
0
answers
323
views
Proper security for settings.php
I've been developing my Drupal site locally and am planning to migrate it to a proper live host server. When going through the guide to track Drupal with Git, I noticed that it says to put settings....
- 111
0
votes
2
answers
128
views
Security model and menu access
Drupal 8.6.1
I have some menu items I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc.
...
- 101
0
votes
1
answer
56
views
How to always require email verification before accessing a page?
I have a custom page defined by hook_menu.
I want signed in users to be required to verify their email every time they want to access it. The page will have buttons on it that would allow someone to ...
- 95
0
votes
1
answer
18
views
How to add registry key verification step with the key being stored in another database
I am currently learning how to use Drupal through Udemy classes; I am a complete newbie.
I am building a Drupal Website, for my personal development, and when someone wants to register to the ...
- 101
0
votes
1
answer
35
views
Custom Module Remote Fails Checksum with Drush
Background
I have several proprietary Drupal modules that my company uses. We want to update these across all our sites. To that end, I've built an endpoint that produces code according to the (ill-...
- 111
0
votes
0
answers
115
views
(Answered) Ajax link for anonymous users to delete node they created if $_SESSION exists. Is node's created timestamp secure enough in link?
I'm allowing anonymous users the ability to create nodes using a form. But I want to allow them the ability to delete them again straight away.
Instead of forcing them to create an account and take ...
- 2,761
0
votes
1
answer
54
views
Views php field or filter to a file or module
If I already have a view with a php filter or a php field, in drupal 7, how can I convert my whole view into a page? (prevent code injections or other security risks)
What is the right way to resolve ...
- 125
0
votes
0
answers
581
views
Basic authentication for external application making requests to Drupal instance
I have a external application that makes requests for content in my Drupal 8 instance. What I want to do is to make sure Drupal is only talking go my external application to stop traffic being spoofed....
- 421
0
votes
3
answers
28
views
Find the password for user admin from a replicated old version of site
I have access to a copy of an old version of a production site on a dev server, but the owner of the website on prod has lost his credentials to admin and doesn't know his ssh login credentials. The ...
- 8,731
0
votes
0
answers
998
views
How to make all URL redirect to HTTPS
There is already a lot of links displaying videos inside my site (in node content) that are using:
http://example.com/clips/2017/01/11/51706, http://www.example.com/clips/2017/01/11/51706, https://...
- 261
0
votes
0
answers
20
views
Restricted visibility and search engine
The search engine crawler, like Googlebot, doesn't index any data, which is set to be visible only particular user, right?
For example, let's say I have fields named field_A & field_B on user's ...
- 177
0
votes
1
answer
26
views
Is it safe to use $vars['name_raw'] instead of $vars['name']?
I ran into an issue with usernames being trimmed in articles. I found a thread here with a fix suggesting to use $vars['name_raw']: https://www.drupal.org/node/854762#comment-7614255. It works.
But I'...
- 422
0
votes
1
answer
29
views
Web forms senders to make their email secure
Make Web forms secure- can we have an option for senders to make their email secure when sending private information back like account numbers, is there an option for this in Drupal or is it possible ...
