Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
4 votes
1 answer
119 views

How can I secure a custom module that contains sensitive data?

I have made a custom module that contains my backup_migrate module profiles as described in this post. Inside the array are my keys to log in to Amazon S3, which I certainly want to keep secret. ...
Patrick Kenny's user avatar
4 votes
1 answer
1k views

How to get accurate information about available security updates after End-of-Life?

For a Drupal 6 site that use the update module, the "Available updates" report no longer shows accurate information about available security updates. Of course, this is because after Drupal 6's End-...
Pierre.Vriens's user avatar
4 votes
2 answers
2k views

Do I need to sanitize a user input textfield used in a mail body?

I have a feature on my site where a user is allowed to edit a textfield is a Drupal form (built using the D7 Form API) and then send the contents of that textfield as (part of) the body of an email to ...
Free Radical's user avatar
  • 15.1k
4 votes
2 answers
834 views

Is theme_pager() vulnerable to HTTP Parameter Pollution?

I'm currently running vulnerability scans against my application, which is based on Drupal. One "High" vulnerability is HTTP Parameter Pollution (HPP), and it has to do with pages that make use of ...
rcourtna's user avatar
  • 895
4 votes
3 answers
1k views

How to hook into adding watchdog entries by other modules?

Is it possible to write some code to intercept the process of adding Watchdog entries and filter them before adding to the log? Or is there a module that allows for watchdog filtering before adding to ...
camcam's user avatar
  • 2,111
4 votes
1 answer
1k views

What steps are necessary to build secure database queries from user input?

Example Drupal 6 query: $q = db_query("SELECT id FROM {table} WHERE no = %d AND name LIKE '%%%s%%'", $_GET['something'], $_GET['something_else']); Example Drupal 7 query: $q = new ...
Madis's user avatar
  • 4,108
4 votes
2 answers
264 views

Why did Views just jump from 3.8 to 3.10 (what happened to 3.9)?

There was a security advisory issued for Views yesterday, but the new version is two ahead of the last (3.10 to 3.8). What happened to 3.9? The Views release page doesn't list a 3.9, or a reason why ...
Patrick Kenny's user avatar
4 votes
2 answers
762 views

If I use node_save() to create a new node, do I need to manually escape user input?

I am writing a custom module for Drupal 6 that programmatically creates a node using node_save(). The various custom node fields come from user input - is it necessary to manually escape these fields,...
John McCollum's user avatar
4 votes
3 answers
857 views

How do I go about putting standalone PHP files?

I want to add an extra cool PHP Class, where would I put it in Drupal, how do I make absolutely sure the code doesn't present a security risk, should I just make it into a module?
palbakulich's user avatar
  • 1,367
4 votes
1 answer
905 views

Running Drupal 6 with PHP 5.3 and Maintaining Security [closed]

I have a number of Drupal 6 sites that I can't upgrade at this time due to sheer lack of time to do so (it would be a major overhaul). Therefore, I am required to continue running PHP 5.3 on my server,...
Evan Donovan's user avatar
4 votes
1 answer
731 views

How safely allow untrusted users to use img tag?

Following this question, I'm wondering how can I allow users of a social site (which obviously are not all trusted) to upload images while avoiding XSS threats?
alfish's user avatar
  • 1,947
4 votes
1 answer
2k views

why some PDOException errors are displayed in details on users screen and some other not

A user reported to me seeing the following error on his screen: The watchdog entry for this error looks like this: PDOException: SQLSTATE[HY000]: General error: 1205 Lock wait timeout exceeded; try ...
camcam's user avatar
  • 2,111
4 votes
1 answer
476 views

Drush or Drupal console command to list modules with security updates?

Is there a command for Drupal 8.x that shows available updates? I added forms_steps 1.1 that has an SA and a security update required in the Web UI, which is saying to update to 1.2 I tried drush pm:...
Eric B.'s user avatar
  • 193
4 votes
1 answer
2k views

Multiple login attempts from different IP Addresses

My website has been getting about 25 login attempts per hour for the past few days for usernames admin, administrator and our website name. The attacker seems to be using differing IP addresses and ...
Robert Lee's user avatar
4 votes
2 answers
1k views

After Drupal 7.32 should sql injection attempts create PDOExceptions?

I have the Logging and Alerts module installed on a few of my sites. Yesterday I noticed a series of notification emails with the following data. These produced PDOException exceptions and so far as I ...
tenken's user avatar
  • 18.4k
4 votes
2 answers
2k views

HTTP Basic auth on specific Drupal paths?

I want to use HTTP Basic authentication on a group of paths in my Drupal site (e.g. /folder/*). The paths are all menu callbacks that don't have actual page content. I tried to use Secure Site but I ...
beth's user avatar
  • 9,087
4 votes
3 answers
1k views

How can I stop Drupal from tracking or collecting IP addresses?

Is there a way to stop Drupal from tracking or collecting IP addresses of visitors? The specific need case is for a site that wishes to be able to say no identifying information is kept of visitors (...
Ryan's user avatar
  • 141
3 votes
4 answers
2k views

Will the PHP filter prevent SQL injection attacks?

I had trouble getting the form API to work though I am considering re doing all my forms with it. I have some custom html/php forms however I directly insert into the DB using pg_query. I am looking ...
Tom's user avatar
  • 233
3 votes
3 answers
885 views

Alternative, more secure user registration process wanted

I don't like that Drupal 7 exposes at the registration page whether the provided e-mail is known by displaying a "The e-mail address [email protected] is already registered. Have you forgotten your password?" ...
Wabbitseason's user avatar
3 votes
2 answers
530 views

Should Drupal 6 be considered insecure?

After reading the post about linkedin on IT security and this issue I would think that having a default Drupal 6 installation without, for example, the phpass module should be considered quite ...
mojzis's user avatar
  • 2,501
3 votes
2 answers
983 views

How to update Drupal securely using GUI/web interface

The admin/reports/updates/update page lists updates, and there's what looks like a handy button Download these updates at the bottom. And then you're asked for your SSH user and password. Now unless ...
artfulrobot's user avatar
  • 3,989
3 votes
1 answer
247 views

Is uploading/download executable files harmful in drupal? [closed]

In my site design, I have a field that is designed to hold an executable file (.exe, .bat, etc), for users to upload and download. I took pause as I was typing these extensions into the Allowed file ...
digitgopher's user avatar
  • 1,591
3 votes
2 answers
1k views

OWASP security and drupal

Recently, To improve our site security we implemented and enabled OWASP security in our server using mod_security. After we enabled the OWASP security, whenever I try to create or edit contents in my ...
Hitesh's user avatar
  • 576
3 votes
2 answers
692 views

What are the alternatives for storing client side encrypted data?

I want to store client side encrypted data in Drupal 7, so that it is encrypted on the client end, and stored and transmitted in encrypted form. The password is never transmitted or stored on the ...
vfclists's user avatar
  • 1,269
3 votes
1 answer
2k views

How is user input sanitized?

I had to develop a Drupal 8 based website for a client. This client has a quite strict configuration for its firewall and filters the characters used in POST values. It happens to be a bit too ...
zif's user avatar
  • 35
3 votes
1 answer
4k views

How to set content-security-policy header?

I want to set Content-Security-Policy header in my site. I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.
siddiq's user avatar
  • 363
3 votes
2 answers
110 views

How can I ensure I retain access to a Drupal site after handing it over to a client?

Does Drupal have a mechanism which will allow me to keep control over a site after handing it over to a client? If things go wrong with the client relationship, I need to be sure I still have control ...
Salaktarus's user avatar
3 votes
1 answer
124 views

Trying to make my entire site https

I am trying to make an entire Drupal site https. I tried enabling secure pages, and this seems to work for every authenticated user. However any anonymous user either gets only http, or possibly an ...
Jack Ryan's user avatar
  • 2,297
3 votes
1 answer
4k views

What code should .htaccess of files directory hold in drupal 7.25?

The module Security Review gives the report my .htaccess in files directory is a security risk because says it has insufficient code to protect the site from anyone wanting to make php edits. However, ...
cea's user avatar
  • 563
3 votes
3 answers
1k views

DB log message: login failed for user xxx

Does anyone ever get "Login failed by user xxx" messages in their recent log entries? I have been getting the same message over and over for the past several days, always from the same IP address and ...
filmoreha's user avatar
  • 711
3 votes
1 answer
488 views

Would using hash_pbkdf2() be more secure than the actual code used from Drupal 7?

Drupal 7 allows a module to implement a different way to create a password hash. It is sufficient the module changes the content of the Drupal variable password_inc, and implement the required ...
apaderno's user avatar
  • 97k
3 votes
1 answer
679 views

Why does default.settings.php suggest writing the value of the hash salt in an external file?

The default.settings.php file contains the following comment: For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that this ...
apaderno's user avatar
  • 97k
3 votes
1 answer
350 views

un-escaped _server variable in settings.php - bad idea right?

I recently started working for a new company hosting drupal sites that is using a switch statement within the settings.php for multiple environments. I am accustomed to using multi-site and am ...
Daniel Baker's user avatar
3 votes
1 answer
884 views

What are the possible exploits if settings.php is writable?

I have recently had to set up Drupal on shared hosting using suPHP. This is a first for me, an install where all the files are writable by the user by default. All the Drupal documentation and the ...
lolcode's user avatar
  • 874
3 votes
1 answer
7k views

How to edit files without changing the last modified date?

One of my sites recently got hacked with the dreaded pharma-hack. The hacker inserted base64_decode'd code into includes/bootstrap.inc Initially I thought the FTP password was discovered since the ...
Beebee's user avatar
  • 6,851
3 votes
1 answer
2k views

Drupal's built-in xss filters vs. HTML purifier module

Does the htmlpurifier module for Drupal provide better security against xss (and possibly other vulnerabilities) than Drupal's built in functionality such as filter_xss? Looking for some guidance on ...
nmc's user avatar
  • 2,077
3 votes
1 answer
304 views

Why should the Hacked! module not be used on a production server?

In the source code of the Hacked! module, it says it should never be used on a production server. /** * @file * The Hacked! module, shows which project have been changed since download. * * We ...
iconoclast's user avatar
  • 1,809
3 votes
1 answer
976 views

HTTPS and SecurePages Infinite Redirect - How do I reset which pages are always HTTPS?

Using Secure Pages, I checked the option to have the site always be using HTTPS when logged in as an administrator, but now I have an infinite redirection issue, and I cannot log-in and navigate the ...
Nathan Lutterman's user avatar
3 votes
4 answers
862 views

Mollom and Spamicide are not slowing down spam registrations

I have a drupal 6 site. I'm using both Mollom and Spamicide. Mollom is doing a great job at stopping spam comments but spambots are registering at an extremely high rate over 6 per minute. ...
Nick's user avatar
  • 163
3 votes
2 answers
216 views

What are the potential security issues when importing an entity type?

I'm working on a module. If the module is enabled, there would be an overview page showing the field structure of different content types. The visitor could then click a button to get a copy of the ...
linclark's user avatar
  • 213
3 votes
1 answer
218 views

What is the best way to restrict website's direct access through node urls? [duplicate]

How can I prevent a node from being accessible on its own page, through node/xxx, but still be accessible through node description eg: /homepage? I tried using the Rabbit Hole module, which ...
rita's user avatar
  • 31
3 votes
1 answer
257 views

Are there any security concerns with getting the UID by simply querying the sessions table against the visitor's cookie?

In the High Performance JavaScript Callback Handler I'm attempting to use my own code to get the current user's ID. To give a quick rundown, by returning data at a much lower bootstrap level (...
Charlie Schliesser's user avatar
3 votes
1 answer
588 views

When is it necessary to check_url()?

When is it necessary to use check_url()? For instance, if I create a login link by putting the code below in the body of a block, which of the 3 check_url() calls are necesssary and which ones are not?...
user13104's user avatar
2 votes
1 answer
553 views

What are the 'todos' when your database is hacked?

I want to plan for the terrible nightmare of my database being stolen. I feel I am secure, and I am not holding much actual data, but... if it does get taken - what do we do, is there a standard way ...
Paul's user avatar
  • 413
2 votes
2 answers
206 views

Drupal 7, Is there a module that detects file structure changes? [closed]

Recently one of my clients sites was hacked and hackers uploaded a few directories and files into the web root folder. I'm looking for a module or a method that has the ability detect file structure ...
Patoshi パトシ's user avatar
2 votes
2 answers
3k views

How to get rid of 'security updates available' warnings?

I am using the ShareThis module on my website. Unfortunately, recent release 2.3 is flagged as a security update, but it is has a major bug (settings can't be saved). I have reverted to release 2.2. ...
Jérôme Verstrynge's user avatar
2 votes
3 answers
2k views

How to remove malicious scripts from admin pages after being hacked?

The site running Drupal 7 was hacked and every administration page, e.g. http://www.anysite.com/en/admin/dashboard contains script tag in head section with malicious src attribute, e.g. <head>...
Petr Felzmann's user avatar
2 votes
3 answers
384 views

Is Drupal secure?

I want to respond to this: "Drupal is listed as limited use, not generally available because of the licensing and security issues related to various modules that people want to use." I have two ...
user864404's user avatar
2 votes
3 answers
1k views

How to prevent a site from ever using experimental core modules?

Quote from Experimental modules in Drupal 8: Drupal 8 core introduces the concept of experimental modules. These are modules that are provided with Drupal core for testing purposes, but that are ...
Pierre.Vriens's user avatar
2 votes
2 answers
3k views

Protect site from flooding when user login is attacked by brute force

I've been experiencing issues with bots trying to force their way into the website I manage. It seems to be a daily occurrence the the flood system is being triggered (I'm on D7). I'm happy the the ...
Jance's user avatar
  • 2,409

1
2
3 4 5
9