Questions tagged [security]
Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.
434
questions
2
votes
2
answers
774
views
Secure pages and installing new modules (AJAX error)
I've just configured my website to work with secure pages and everything seems to be working fine except for the ability to install a new module. Whenever I try, I get this error:
An AJAX HTTP ...
- 23
2
votes
1
answer
60
views
How I get notified every time their is an *new* update and not every day for the sames updates?
The update module can send you email when a new release is available for a module you installed. The problem is I get a email everyday. Some security update are very minor and unreachable for an ...
- 682
2
votes
1
answer
376
views
Overriding default hashing mechanism: cannot redeclare user_hash_password()
I have a project that requires a change in the default password encryption mechanism.
The documentation of password.inc states that this can be overridden using the password_inc variable. I followed ...
- 6,924
2
votes
0
answers
148
views
How can I conditionally insert extra header data on Drupal 6 pages?
I'm using Drupal 6 with the WebForms module, and my entire site uses https.
I need to insert some cache-control statements in the page headers of only certain pages (ones with forms on them). Is ...
2
votes
2
answers
945
views
Disappearing Content [closed]
I just inherited a Drupal 7 website from another agency. The site was fairing well in our DEV and STAGE environments. The problem started occurring when we switched DNS over to our PRODUCTION site.
...
- 41
1
vote
7
answers
8k
views
Insecure content warning with D7 and SSL
I'm running Drupal 7 with Drupal Commerce module. I have SSL enabled on my server. I've confirmed that the SSL is properly enabled (If I replace Drupal's index.php with a simple index.html, Chrome ...
- 946
1
vote
2
answers
2k
views
Drupal security measures
I have got a list of security violations for my website from security team. It says
Cookie without HttpOnly flag set
Autocomplete Password Enabled
So, what is this basically? Can I overcome ...
- 3,024
1
vote
2
answers
218
views
Is there any security or operational problems if I do not have any .htaccess file in drupal root?
I realise that having the .htaccess file in the root of my installation is probably the way the program is designed to run, but I was having some difficulties accessing the site, and then fixed the ...
- 417
1
vote
2
answers
704
views
Unattended automatic security updates / upgrades [duplicate]
What is the best way to get Drupal to automatically perform security updates? And are people commonly employing such a method?
For motivation, consider this: Drupal just released a PSA about a ...
- 123
1
vote
1
answer
141
views
Drupal Commerce Authorize.net gateway and POODLE
I got a notice today that Authorize.net is going to shut off their SSLv3 protocol on November 4 (7 days from today) in response to the POODLE threat. I'm using Drupal Commerce's commerce_authnet ...
- 186
1
vote
2
answers
4k
views
How to disable PHP files from being run in the sites/default/files directory?
By default does drupal 7's sites/default/files directory disables running of PHP files?
- 8,731
1
vote
2
answers
116
views
What security should I double-check before opening my site to being multi-user?
I've been using my D7 installation as a single-user blog, and operated assuming that would always be the case. In the process, I may have been sloppy with permissions in various places, such as ...
- 333
1
vote
2
answers
1k
views
Error: Private files directory not fully protected
I received the following error in my Drupal 8 status report:
PRIVATE FILES DIRECTORY Not fully protected See
https://www.drupal.org/SA-CORE-2013-003 for information about the
recommended .htaccess ...
- 575
1
vote
2
answers
1k
views
Automatically block user that access /wp-login.php
Is it possible to block any users IP if they try to access a specific URL such as /wp-login.php page which does not exist on Drupal.
Basically to automatically blacklist the user, for days or even ...
- 619
1
vote
2
answers
2k
views
How do I redirect to www and https in settings.php?
I want to include code in settings.php which would handle redirects to the www alias and also https.
Because it is for a distribution I would prefer not to have hard-coded URLs and I would also ...
- 1,027
1
vote
1
answer
822
views
How to extend flood control in a custom module?
I would like to use Drupal's flood control capability in another module. I have a resource I'm protecting with a password.
Can I simply call flood_register_event() and otherwise use the variables as ...
- 1,591
1
vote
2
answers
294
views
refresh form_token with refresh page
Unfortunately, the form_token does not change when I refresh the form pages.
Doesn't this cause abuse and security risks?
Can anyone explain what Drupal does for CSRF in all its forms?
Thanks
- 61
1
vote
1
answer
1k
views
How do I handle third-party API credentials in settings? [closed]
I am building a module that will need to integrate credentials for the 3rd party service in Drupal 8. The module's admin panel should remember the credentials and use them to interact with the service,...
- 925
1
vote
4
answers
530
views
How to recover content/configuration from a hacked site
I have a situation where I am faced with two sites which were vulnerable to the Drupageddon SQL injection exploit. I am looking at what is the best strategy for recovering these websites. Given that ...
- 918
1
vote
1
answer
157
views
Is someone trying to hack my site?
I was looking at my drupal site log messages and I´ve been having very weird ones as the ones attached.
I was wondering if someone is trying to hack my site, if so, how can I prevent that? I have all ...
- 29
1
vote
1
answer
3k
views
Prevent site from being indexed by search engines?
I have two requirements for my site
I don't want my site to be indexed by search engines
Anonymous users should not be able to see any content of the site
I would have been satisfied with ip ...
- 1,194
1
vote
1
answer
60
views
Is there a recognized practice for keeping security details in files excluded from version control?
As settings.php also contains the database connection details and the site key among others, it is excluded from version control in .gitignore.
But there some modules, APC for instance that require ...
- 1,269
1
vote
1
answer
75
views
Why does Drupal harden permissions of the /web/sites/default directory and files?
I understand that Drupal hardens permissions of the /web/sites/default directory and its files, each time that the system_requirements() function is called, typically after each composer require ...
- 1
1
vote
1
answer
69
views
MYSQL injections: Are they a threat?
For a while now, all my Drupal 7 and Drupal 8 instances have been under constant attack from South America or Asia, where the attacker is trying to infiltrate Drupal with MySQL injections.
The ...
- 2,018
1
vote
3
answers
11k
views
How to set up permissions for the private files directory?
I'm trying to set up the private files directory and I'm getting the following error.
The backup file could not be saved to 'private://backup_migrate/'
because the directory could not be created ...
- 141
1
vote
2
answers
102
views
Is it safe to use $_SESSION to store temporarily a user provided value under multi-step form processing
I have a form which contains an AJAX button press callback. Upon pressing this AJAX button, I want to store temporarily a form element's value before fully processing all the data upon pressing main ...
- 726
1
vote
1
answer
453
views
Is json_decode parse-ability proof of a safe string?
Do I need to use check_plain (or something else) when displaying a user supplied JSON string, when I have previously checked it successfully parses with json_decode?
- 413
1
vote
2
answers
87
views
Removing potentially malicious code from template
Our drupal site was hacked at some point recently, and I've been tasked to clean it up because nobody knows much about drupal here. I think I've taken care of most of the glaring security holes, and ...
- 143
1
vote
1
answer
457
views
Weird activites in my site. Is my site hacked?
Since long time I have been noticing some weird activity going on on my website.
For example:
The includes folder was deleted
CSS files were modified
Node edit access was given to anonymous users
I ...
- 274
1
vote
1
answer
789
views
Files security - files folder hacked
For the second time in a short while my files/ folder has been hacked. Permissions are set as 755 all accross the folder.
I tried to set it up as 750, 754 but it breaks the website.
What happens is ...
- 11
1
vote
1
answer
1k
views
Would disabling these following functions in PHP.INI affect Drupal 7?
If i disabled the following php functions:
disable_functions = escapeshellarg,escapeshellcmd,exec,ini_alter,parse_ini_file,passthru,pcntl_exec,popen,proc_close,proc_get_status,proc_nice,proc_open,...
- 8,731
1
vote
3
answers
652
views
Advice - Forms and Credit Card Security
I'm working on a website for a client where he wants a order form created and e-mailed back to him. Because of the nature of the business, the card cannot be charged until the order is verified that ...
1
vote
1
answer
1k
views
Restrict IFRAME and OBJECT embeds certain domains
I would like to allow my users to embed certain IFRAME and OBJECT tags in nodes and comments. Is there a way to restrict them to certain domains, for example maps.google.com to allow embedding Google ...
- 12k
1
vote
1
answer
1k
views
What is the suitable file permission for 'files'?
I have written this small bash script to rebuild D6.22 file permissions:
#!/bin/bash
cd /path/to/drupal
chown -R bob:www-data .
find . -type d -exec chmod u=rwx,g=rx,o= {} \;
find . -type f -exec ...
- 1,947
1
vote
2
answers
51
views
How can I prevent a page with PHP content getting flagged in Security Review "Dangerous tags in content" check?
I am using Drupal 7. I have a page that has a PHP body that I know does not have any dangerous tags. According to the README.txt file in Security Review I need to add this to the "...
- 291
1
vote
1
answer
135
views
Drupal Commerce Product Variation SQL Injection Vulnerability
A PCI scan on my site is saying that there is a SQL Injection vulnerability. But where it seems to be indicating it is on pretty basic Commerce functionality. When visiting a product variation page ...
- 495
1
vote
1
answer
534
views
Is it a valid approach to have a different CSP based on login state and browser?
I'm currently working on improving the security of a Drupal 8 site by implementing a Content Security Policy. As this is still new to me, I would like to get some input on my strategy.
Relevant base ...
- 2,844
1
vote
2
answers
347
views
Drupal 8 password retention
I am currently reviewing Drupal 8's security features and was wondering about how Drupal stores user passwords. I know Drupal uses salted hashes to store the password in the database, but does Drupal ...
- 1,487
1
vote
1
answer
905
views
Verify that salt.txt was located and being used by Drupal?
In my settings file in Drupal 8, I am specifying a location for hash-salt to a file outside of the docroot.
Example:
$settings['hash_salt'] = file_get_contents('/salt.txt');
I don't see anything in ...
- 27.7k
1
vote
2
answers
893
views
Why are there so many attempts by an anonymous user to access /wp-login.php?
I looked at /admin/reports/dblog today. There were five request in two minutes by an anonymous user to view /wp-login.php. These requests have been happening for an hour at least and continue 2-3 ...
- 588
1
vote
3
answers
73
views
Why are anonymous visitors logged in when they visit /user/[uid] page?
This seems to be a massive security floor in Drupal. I have the following display suite code in a Block which is added as a custom field to the User account display:-
<?php
global $user;
$uid =...
- 293
1
vote
1
answer
1k
views
How to add 'style="width:100px"' in Global Custom Text field in a view?
It seems that the Global Custom Text field in a view delete part of my text.
I write this:
<div class="my-class" style="width:100px">Hello</div>
but get this:
<div class="my-class"&...
- 6,227
1
vote
1
answer
247
views
How Encrypt module actually works?
I installed the Drupal Encrypt module and enabled it. However, I wonder how this module actually works. Does it encrypt all the submissions from the browser that the user/admin key in like 1) Login 2)...
- 641
1
vote
1
answer
1k
views
$drupal_hash_salt is empty in my installations
This is the code in settings.php
$drupal_hash_salt = '';
From what I know it should be a random string and I shouldn't change it at all and it has a direct effect on the website security. But why ...
- 3,862
1
vote
2
answers
1k
views
Security considerations for special characters in usernames?
I would like to create some users on a Drupal site where the usernames are actually company names and some of those company names contain ampersands or other non-alphanumeric characters.
I have read ...
- 653
1
vote
1
answer
63
views
Security issues after authenticated user has been logged out
I have a profile information page that is being displayed for an authenticated users. But after I log-out as that specific user,and then i click the back button of the browser,I could find the ...
- 21
1
vote
2
answers
2k
views
Webform + reCaptcha - still lot of SPAM
Few months ago I installed reCaptcha module to use with webform. It worked perfectly: I can't submit form if I didn't provide correct captcha code. It worked even if I disable JavaScript. Problem is ...
- 589
1
vote
1
answer
151
views
Authenticate against a Drupal Instance
Is it possible for an application (e.g. a Java Web app) to authenticate against the Drupal users table? I know they use an SHA512 encryption, but I am wondering if there is any way to expose this ...
- 113
1
vote
1
answer
454
views
Adding Additional login security
Considering login security for user logins, I would like an additional option such as a PIN option for all aspects of user login. This seems quite common now across a number of portals out there such ...
- 579
1
vote
1
answer
193
views
How to secure Drupal website
I have Drupal CMS and I need to protect it from sensitive data leak, which are the customer names, addresses, the payments and order information.
I am new to Drupal, so my question is, is it possible ...
- 111