Skip to main content

Questions tagged [security]

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

Filter by
Sorted by
Tagged with
2 votes
1 answer
127 views

Advice on latest drupal security advisory having followed most of the instructions do I rebuild the server?

I was unfortunately on holiday on the week of drupageddon / drupalgeddon / security advisory SA-CORE-2014-005. So my site was a week without having core updated/ patch applied at all. I started off ...
ja_him's user avatar
  • 357
2 votes
2 answers
775 views

Secure pages and installing new modules (AJAX error)

I've just configured my website to work with secure pages and everything seems to be working fine except for the ability to install a new module. Whenever I try, I get this error: An AJAX HTTP ...
user32223's user avatar
2 votes
1 answer
61 views

How I get notified every time their is an *new* update and not every day for the sames updates?

The update module can send you email when a new release is available for a module you installed. The problem is I get a email everyday. Some security update are very minor and unreachable for an ...
gagarine's user avatar
  • 682
2 votes
1 answer
377 views

Overriding default hashing mechanism: cannot redeclare user_hash_password()

I have a project that requires a change in the default password encryption mechanism. The documentation of password.inc states that this can be overridden using the password_inc variable. I followed ...
Bart's user avatar
  • 6,934
2 votes
0 answers
152 views

How can I conditionally insert extra header data on Drupal 6 pages?

I'm using Drupal 6 with the WebForms module, and my entire site uses https. I need to insert some cache-control statements in the page headers of only certain pages (ones with forms on them). Is ...
Steve Rothman's user avatar
2 votes
2 answers
949 views

Disappearing Content [closed]

I just inherited a Drupal 7 website from another agency. The site was fairing well in our DEV and STAGE environments. The problem started occurring when we switched DNS over to our PRODUCTION site. ...
Shane's user avatar
  • 41
1 vote
7 answers
8k views

Insecure content warning with D7 and SSL

I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome ...
starsinmypockets's user avatar
1 vote
2 answers
2k views

Drupal security measures

I have got a list of security violations for my website from security team. It says Cookie without HttpOnly flag set Autocomplete Password Enabled So, what is this basically? Can I overcome ...
Hacker's user avatar
  • 3,024
1 vote
2 answers
218 views

Is there any security or operational problems if I do not have any .htaccess file in drupal root?

I realise that having the .htaccess file in the root of my installation is probably the way the program is designed to run, but I was having some difficulties accessing the site, and then fixed the ...
Q Beat's user avatar
  • 417
1 vote
2 answers
705 views

Unattended automatic security updates / upgrades [duplicate]

What is the best way to get Drupal to automatically perform security updates? And are people commonly employing such a method? For motivation, consider this: Drupal just released a PSA about a ...
Sean's user avatar
  • 123
1 vote
1 answer
142 views

Drupal Commerce Authorize.net gateway and POODLE

I got a notice today that Authorize.net is going to shut off their SSLv3 protocol on November 4 (7 days from today) in response to the POODLE threat. I'm using Drupal Commerce's commerce_authnet ...
Ken Williams's user avatar
1 vote
2 answers
4k views

How to disable PHP files from being run in the sites/default/files directory?

By default does drupal 7's sites/default/files directory disables running of PHP files?
Patoshi パトシ's user avatar
1 vote
2 answers
116 views

What security should I double-check before opening my site to being multi-user?

I've been using my D7 installation as a single-user blog, and operated assuming that would always be the case. In the process, I may have been sloppy with permissions in various places, such as ...
Mittenchops's user avatar
1 vote
2 answers
2k views

Error: Private files directory not fully protected

I received the following error in my Drupal 8 status report: PRIVATE FILES DIRECTORY Not fully protected See https://www.drupal.org/SA-CORE-2013-003 for information about the recommended .htaccess ...
glenviewjeff's user avatar
1 vote
2 answers
1k views

Automatically block user that access /wp-login.php

Is it possible to block any users IP if they try to access a specific URL such as /wp-login.php page which does not exist on Drupal. Basically to automatically blacklist the user, for days or even ...
Progonat's user avatar
  • 629
1 vote
2 answers
2k views

How do I redirect to www and https in settings.php?

I want to include code in settings.php which would handle redirects to the www alias and also https. Because it is for a distribution I would prefer not to have hard-coded URLs and I would also ...
MrPaulDriver's user avatar
  • 1,027
1 vote
1 answer
849 views

How to extend flood control in a custom module?

I would like to use Drupal's flood control capability in another module. I have a resource I'm protecting with a password. Can I simply call flood_register_event() and otherwise use the variables as ...
digitgopher's user avatar
  • 1,592
1 vote
2 answers
351 views

refresh form_token with refresh page

Unfortunately, the form_token does not change when I refresh the form pages. Doesn't this cause abuse and security risks? Can anyone explain what Drupal does for CSRF in all its forms? Thanks
reza's user avatar
  • 61
1 vote
3 answers
11k views

How to set up permissions for the private files directory?

I'm trying to set up the private files directory and I'm getting the following error. The backup file could not be saved to 'private://backup_migrate/' because the directory could not be created ...
lacuna's user avatar
  • 141
1 vote
1 answer
1k views

How do I handle third-party API credentials in settings? [closed]

I am building a module that will need to integrate credentials for the 3rd party service in Drupal 8. The module's admin panel should remember the credentials and use them to interact with the service,...
Alexei Rayu's user avatar
1 vote
4 answers
534 views

How to recover content/configuration from a hacked site

I have a situation where I am faced with two sites which were vulnerable to the Drupageddon SQL injection exploit. I am looking at what is the best strategy for recovering these websites. Given that ...
Benjen's user avatar
  • 928
1 vote
1 answer
160 views

Is someone trying to hack my site?

I was looking at my drupal site log messages and I´ve been having very weird ones as the ones attached. I was wondering if someone is trying to hack my site, if so, how can I prevent that? I have all ...
gjanet83's user avatar
1 vote
1 answer
3k views

Prevent site from being indexed by search engines?

I have two requirements for my site I don't want my site to be indexed by search engines Anonymous users should not be able to see any content of the site I would have been satisfied with ip ...
devunder's user avatar
  • 1,194
1 vote
1 answer
60 views

Is there a recognized practice for keeping security details in files excluded from version control?

As settings.php also contains the database connection details and the site key among others, it is excluded from version control in .gitignore. But there some modules, APC for instance that require ...
vfclists's user avatar
  • 1,269
1 vote
1 answer
70 views

MYSQL injections: Are they a threat?

For a while now, all my Drupal 7 and Drupal 8 instances have been under constant attack from South America or Asia, where the attacker is trying to infiltrate Drupal with MySQL injections. The ...
user5950's user avatar
  • 2,048
1 vote
2 answers
103 views

Is it safe to use $_SESSION to store temporarily a user provided value under multi-step form processing

I have a form which contains an AJAX button press callback. Upon pressing this AJAX button, I want to store temporarily a form element's value before fully processing all the data upon pressing main ...
W.M.'s user avatar
  • 726
1 vote
1 answer
454 views

Is json_decode parse-ability proof of a safe string?

Do I need to use check_plain (or something else) when displaying a user supplied JSON string, when I have previously checked it successfully parses with json_decode?
Paul's user avatar
  • 413
1 vote
2 answers
88 views

Removing potentially malicious code from template

Our drupal site was hacked at some point recently, and I've been tasked to clean it up because nobody knows much about drupal here. I think I've taken care of most of the glaring security holes, and ...
Mordred's user avatar
  • 143
1 vote
1 answer
457 views

Weird activites in my site. Is my site hacked?

Since long time I have been noticing some weird activity going on on my website. For example: The includes folder was deleted CSS files were modified Node edit access was given to anonymous users I ...
Dudepal's user avatar
  • 274
1 vote
1 answer
791 views

Files security - files folder hacked

For the second time in a short while my files/ folder has been hacked. Permissions are set as 755 all accross the folder. I tried to set it up as 750, 754 but it breaks the website. What happens is ...
user7695's user avatar
1 vote
1 answer
1k views

Would disabling these following functions in PHP.INI affect Drupal 7?

If i disabled the following php functions: disable_functions = escapeshellarg,escapeshellcmd,exec,ini_alter,parse_ini_file,passthru,pcntl_exec,popen,proc_close,proc_get_status,proc_nice,proc_open,...
Patoshi パトシ's user avatar
1 vote
3 answers
652 views

Advice - Forms and Credit Card Security

I'm working on a website for a client where he wants a order form created and e-mailed back to him. Because of the nature of the business, the card cannot be charged until the order is verified that ...
everaftergraphics's user avatar
1 vote
1 answer
1k views

Restrict IFRAME and OBJECT embeds certain domains

I would like to allow my users to embed certain IFRAME and OBJECT tags in nodes and comments. Is there a way to restrict them to certain domains, for example maps.google.com to allow embedding Google ...
uwe's user avatar
  • 12k
1 vote
1 answer
1k views

What is the suitable file permission for 'files'?

I have written this small bash script to rebuild D6.22 file permissions: #!/bin/bash cd /path/to/drupal chown -R bob:www-data . find . -type d -exec chmod u=rwx,g=rx,o= {} \; find . -type f -exec ...
alfish's user avatar
  • 1,947
1 vote
2 answers
60 views

How can I prevent a page with PHP content getting flagged in Security Review "Dangerous tags in content" check?

I am using Drupal 7. I have a page that has a PHP body that I know does not have any dangerous tags. According to the README.txt file in Security Review I need to add this to the "...
MrSnrub's user avatar
  • 285
1 vote
1 answer
138 views

Drupal Commerce Product Variation SQL Injection Vulnerability

A PCI scan on my site is saying that there is a SQL Injection vulnerability. But where it seems to be indicating it is on pretty basic Commerce functionality. When visiting a product variation page ...
Delford Chaffin's user avatar
1 vote
1 answer
696 views

Is it a valid approach to have a different CSP based on login state and browser?

I'm currently working on improving the security of a Drupal 8 site by implementing a Content Security Policy. As this is still new to me, I would like to get some input on my strategy. Relevant base ...
berliner's user avatar
  • 2,854
1 vote
2 answers
349 views

Drupal 8 password retention

I am currently reviewing Drupal 8's security features and was wondering about how Drupal stores user passwords. I know Drupal uses salted hashes to store the password in the database, but does Drupal ...
user5013's user avatar
  • 1,497
1 vote
1 answer
965 views

Verify that salt.txt was located and being used by Drupal?

In my settings file in Drupal 8, I am specifying a location for hash-salt to a file outside of the docroot. Example: $settings['hash_salt'] = file_get_contents('/salt.txt'); I don't see anything in ...
Kevin's user avatar
  • 27.9k
1 vote
2 answers
946 views

Why are there so many attempts by an anonymous user to access /wp-login.php?

I looked at /admin/reports/dblog today. There were five request in two minutes by an anonymous user to view /wp-login.php. These requests have been happening for an hour at least and continue 2-3 ...
Lincoln Bergeson's user avatar
1 vote
3 answers
73 views

Why are anonymous visitors logged in when they visit /user/[uid] page?

This seems to be a massive security floor in Drupal. I have the following display suite code in a Block which is added as a custom field to the User account display:- <?php global $user; $uid =...
Darren's user avatar
  • 293
1 vote
1 answer
1k views

How to add 'style="width:100px"' in Global Custom Text field in a view?

It seems that the Global Custom Text field in a view delete part of my text. I write this: <div class="my-class" style="width:100px">Hello</div> but get this: <div class="my-class"&...
chefnelone's user avatar
  • 6,257
1 vote
1 answer
249 views

How Encrypt module actually works?

I installed the Drupal Encrypt module and enabled it. However, I wonder how this module actually works. Does it encrypt all the submissions from the browser that the user/admin key in like 1) Login 2)...
Adamtan's user avatar
  • 651
1 vote
1 answer
1k views

$drupal_hash_salt is empty in my installations

This is the code in settings.php $drupal_hash_salt = ''; From what I know it should be a random string and I shouldn't change it at all and it has a direct effect on the website security. But why ...
M a m a D's user avatar
  • 3,837
1 vote
2 answers
1k views

Security considerations for special characters in usernames?

I would like to create some users on a Drupal site where the usernames are actually company names and some of those company names contain ampersands or other non-alphanumeric characters. I have read ...
morbiD's user avatar
  • 653
1 vote
1 answer
63 views

Security issues after authenticated user has been logged out

I have a profile information page that is being displayed for an authenticated users. But after I log-out as that specific user,and then i click the back button of the browser,I could find the ...
arteta's user avatar
  • 21
1 vote
2 answers
2k views

Webform + reCaptcha - still lot of SPAM

Few months ago I installed reCaptcha module to use with webform. It worked perfectly: I can't submit form if I didn't provide correct captcha code. It worked even if I disable JavaScript. Problem is ...
Filip Górczyński's user avatar
1 vote
1 answer
152 views

Authenticate against a Drupal Instance

Is it possible for an application (e.g. a Java Web app) to authenticate against the Drupal users table? I know they use an SHA512 encryption, but I am wondering if there is any way to expose this ...
EdgeCase's user avatar
  • 113
1 vote
1 answer
455 views

Adding Additional login security

Considering login security for user logins, I would like an additional option such as a PIN option for all aspects of user login. This seems quite common now across a number of portals out there such ...
Paul B's user avatar
  • 589
1 vote
1 answer
193 views

How to secure Drupal website

I have Drupal CMS and I need to protect it from sensitive data leak, which are the customer names, addresses, the payments and order information. I am new to Drupal, so my question is, is it possible ...
Andrew Smith's user avatar

1 2 3
4
5
9