Questions tagged [security]
Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.
433
questions
2
votes
2
answers
457
views
Code for page access
I would like to use PHP code in nodes of a specific content type. I can check the user's permission with the global $user if the user can access the node.
Is there any module to set view for created ...
- 1,029
2
votes
3
answers
574
views
How can i get prepared for DRUPAL-PSA-2016-001?
The PSA for tomorrow left me a bit uncomfortable. Quote:
The Drupal Security Team urges you to reserve time for module updates
at that time because exploits are expected to be developed within
...
- 1,360
2
votes
1
answer
422
views
Should you use check_plain() prior to inserting into database?
I am currently using check_plain() etc on displaying user entered data in HTML, and I am also using check_plain() etc prior to inserting the user data into my custom tables.
When inserting or ...
- 413
2
votes
3
answers
5k
views
My drupal 7.22 site got hacked
When I tried logging in to my Drupal site this morning, I got an error.
When I took a look at the log files, I found a error about the template.php file used by the theme currently set:
[Sat Sep ...
- 231
2
votes
2
answers
389
views
prompt in IE8 for secure pages produces altered layout
My Drupal 7 website looks fine in most browsers, but in IE8 I am getting the prompt:
"Do you want to view only the webpage content that was delivered securely? This webpage contains content ...
- 55
2
votes
1
answer
83
views
Site's settings file return blank screen
I'm looking through a few of my drupal sites since the recent DRUPAL-SA-CORE-2012-003 security update. I noticed that on a few of them, if I navigate to the settings.php file location through the url. ...
- 829
2
votes
2
answers
3k
views
Drupal Database Encryption
I am seriously looking for a solution to encrypt at least some of the tables in my Drupal 7 database.
I'm totally suspicious about my hosting providers, I really don't want my user's data and also my ...
- 183
2
votes
2
answers
4k
views
Easiest way to hack Drupal 6.22 installation for security audit
I am doing a security audit for a client. Their installation is Drupal 6.22. I need to show them it's unsafe. What is the easiest way to hack it as an example?
I would need to directly show them ...
2
votes
2
answers
162
views
How do I receive security updates?
On my client(s) website, I turned the update module on. From time to time, they receive an error message on every page about a security update. They complain about this message, and they don't want ...
- 43
2
votes
2
answers
235
views
Do I need the trusted host setting?
Do I need the trusted host setting for a Drupal 7 site? If so how do I configure it?
I noticed that Backdrop CMS has it in their settings file.
- 31
2
votes
2
answers
247
views
Is there a way to send emails when someone logs in?
Logins on my sites are very infrequent and are normally done by myself. I would like a way of getting email notification when someone logs in. This way I might be able to spot someone hacking into the ...
- 125
2
votes
5
answers
784
views
What is good way to hide update.php file?
I will like to know what is the correct/better way to hide update.php file on the production server.
Currently when you try to access update.php file, Drupal shows default access denied page with ...
- 198
2
votes
1
answer
8k
views
security report there is no .htaccess file in private:// directory
I have this security report that is constantly saying:
Security warning: Couldn't write .htaccess file. Please create a .htaccess file in your private:// directory which contains the following ...
- 53
2
votes
1
answer
177
views
Is 8.6.18 insecure? Will there be 8.6.19 etc.?
I have a custom module that I think requires Drupal 8.6.x.
Is Drupal core 8.6.18 insecure? Will more 8.6.x versions be released?
- 141
2
votes
1
answer
92
views
Is it safe to allow domain.com/username?
Are there any security risks if we create pathauto roule so that the user account pages are at domain.com/username
- 619
2
votes
1
answer
486
views
How to delete first user (admin)
For security reason, I want to delete the first user (which has all rights, event without the admin role) and login only with the drush uli command. How can I do that? From the backoffice it say I can'...
- 173
2
votes
1
answer
780
views
How can I exclude API keys, passwords, and so on from configuration management?
I am using Drupal 8 and drush cex to commit my configuration to my repository.
However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive ...
- 28.1k
2
votes
2
answers
787
views
Drupal Commons 3 and Original Drupal Core Updates
I'm may be planning to switch over to Drupal Commons 3. When the original Drupal core gets security updates, will I be able to get those updates in the Drupal Commons or do I have to wait for Drupal ...
- 23
2
votes
1
answer
53
views
After any Composer command, does Composer or core set (or harden) the file permissions?
After any Composer command (for example, composer create-project, composer require, and composer update), does Composer or Drupal set (or harden) the file permissions?
- 45
2
votes
2
answers
763
views
How to securely authenticate content embeded in another site?
I need to embed password protected content to a second domain with an iframe. The content itself is a view which will be displayed on a third party site via an iframe and the content is prepared with ...
- 1,172
2
votes
1
answer
373
views
How to determine the code for settings.php config override based on .yml?
I am trying to put my API keys in a separate file instead of storing them in config management.
For example, I installed the Commerce Stripe module.
When I export the config, it looks like this:
...
- 28.1k
2
votes
2
answers
122
views
Is this a possible attack on database?
In the logs (Drupal 7), I have seen the next entry (I have edited some compromised info). It seems a failed (only I hope it actually failed) attempt to access the login account. I have tried to ...
- 932
2
votes
1
answer
55
views
Can I temporarily stop update notifications for one project only? [duplicate]
Is there a way I can tell Drupal not to notify me about a particular version of a module? For example, if it isn't security related and I choose not to update one module but would like to receive ...
- 1,850
2
votes
1
answer
185
views
My site is hacked [duplicate]
It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code:
$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$...
- 209
2
votes
1
answer
3k
views
Annoying hack keeps changing bootstrap.inc and writing cryptic files to sites/default/files/styles
I'm having huge issues with a massive hack of our website. It was running Drupal 7.32 last year, when a big security issue was announced. Unfortunately we came too late and the site was hacked.
For ...
- 168
2
votes
2
answers
114
views
What file or data I should NOT give outsourcing developer for security when they need a copy site of my site?
I'm asking a outsourcing developer to modify some part of my site and then he needs the copy of my site as a test site.
My site is already working site and has users registered. What comes in mind ...
- 1,021
2
votes
1
answer
640
views
How to prevent login if a condition is not met
I am working on a Drupal 6 site (which I did not make and am not in charge of the general IT architecture at this company).
The site is on an intranet and they regularly import all users from an ...
- 21
2
votes
2
answers
365
views
drupal module secure pages toggles between http and https on reload
I am using the secure pages drupal module to enable https for some of the pages , but i have noticed one bug in this , each time i reload the page its toggling between http and https, and if i go from ...
- 2,304
2
votes
1
answer
251
views
Drupal form_state sanitization
I'm new to Drupal and I am doing some module development for a Drupal 7 install. I've done development outside of Drupal and normally its best to always sanitize user input. I've seen different ...
- 21
2
votes
1
answer
141
views
Add Encryption to Images
Is there a way to add encryption to images once they are uploaded on the website and stored on the server?
- 165
2
votes
2
answers
3k
views
How do I set the private file system path's permissions?
There is an option in Configuration > File system which let you define a path for private files. After setting a path in this field, the access for all users is restricted (including admin). I need ...
- 589
2
votes
2
answers
484
views
How to get update status of multiple Drupal sites
I have several servers each with numerous Drupal sites on.
Not all of them are developed by me.
How would you keep on top of the sites to make sure they are all up to date security wise.
In an ideal ...
- 21
2
votes
3
answers
62
views
Avoid username output as a class of an article tag
Drupal 7 generates a username class for the article tag, something like : class="node node-page node-published node-not-promoted node-not-sticky author-username odd clearfix".
I'd like to avoid to ...
- 661
2
votes
1
answer
2k
views
Best practices for protecting from injection on form fields
I am building a form in Drupal 7. I have a textarea field and would like to know if it is safe to get the field content ($form['values']['field_name']) and save it to the database using something like ...
- 1,766
2
votes
2
answers
78
views
Markup filtering at theme level (security)
Please could someone advise if any sort of sanitization/filtering is required for the #markup below i.e. check_markup(), check_plain(), etc
The $title variable is basically just from drupal_get_title(...
- 3,432
2
votes
1
answer
4k
views
What's the best file permission to drupal's files and directories? [duplicate]
Possible Duplicate:
What are the recommended directory permissions?
I want to know what's the best file permission under a linux system to my drupal's files and directories including the files ...
2
votes
1
answer
206
views
How to deny access to invalid $_GET parameters
For example, there is a pager with 10 pages. How to deny access if $_GET['page'] is bigger than 9 or is not numeric?
- 101
2
votes
1
answer
1k
views
In what cases should I personally sanitize input & output when using the Database Abstraction Layer
I'm trying to get a clearer sense of where security vulnerabilities on my site may lie. At no point in my code do I ever query the MySQL database directly; I always use the Database Abstraction Layer (...
- 1,231
2
votes
2
answers
33
views
Session API Security Advisory
I'm working on a website that is interested in adding chat features. I did some research, and ended up installing the DrupalChat module, and its dependencies. After configuring the module, I realized ...
- 31
2
votes
2
answers
129
views
Secure Pages Module or force HTTPS Across Whole Site?
I understand that the Secure Pages module allows you to let some pages use http and force others to use https. Assuming that is correct, is there any reason for me to use Secure Pages if I'm already ...
- 21
2
votes
1
answer
53
views
How do I secure pages and related media files?
I would like to password protect Drupal pages (solved) and media files related to these pages (solved, but not optimally). Currently the Drupal pages are secured via Drupal and the media files via ...
- 121
2
votes
1
answer
110
views
Maintaining Old Drupal Versions [closed]
Is there a list of best practices (or anything on drupal.org) for maintaining Drupal versions after end-of-life, specifically, when upgrading isn't an option? The best solution, of course, is to ...
- 26.8k
2
votes
1
answer
116
views
Is there any sensitive data in the Configuration Management Export?
I noticed in default.settings.php this comment:
Location of the site configuration files.
The $config_directories array specifies the location of file system
directories used for ...
- 967
2
votes
2
answers
291
views
Deleting users who have created content can lead to access bypass?
The statement below appears in several places on the Internet about Drupal security. Is it the case that someone once wrote this and people repeat it in the their '10 Drupal security tips' posts ...
- 4,734
2
votes
1
answer
224
views
Recommended tools/techniques for monitoring for spam attacks on multi-site and shared servers
I'm managing a number of servers with dozens of Drupal sites, some with a single multi-site Drupal installation and others with dozens of separate Drupal installations. We're constantly running into ...
- 5,339
2
votes
1
answer
754
views
Will forcing validation on a node save result in security issues or data integrity loss?
I have a content type containing lots of required and conditional fields. Because it can take a bit of time to properly create these nodes, and not all information will always be available to the end-...
- 4,604
2
votes
1
answer
388
views
Is there any security consideration with webform and Salesforce API?
We are implementing the Salesforce webform module for our client and they are asking us if there are any security issues to consider by having SOAP installed on their server.
(The Salesforce API ...
- 3,612
2
votes
0
answers
33
views
How to handle user 1 with PCI compliance [closed]
PCI compliance states there can be no shared accounts. Typically between developers user 1 is shared and utilized for things that require user 1, but that would violate the PCI rules.
Is there a way ...
- 273
2
votes
1
answer
153
views
Mixed content issue while running updates.php in Drupal 6.37
We are facing this issue again for Drupal version 6.37.
We do not have jquery update module installed.
In our case the progress bar just hangs but the functionality is accomplished.The Drupal core ...
- 31
2
votes
1
answer
127
views
Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?
I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
- 347