Questions tagged [security]
Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.
437
questions
1
vote
1
answer
132
views
is it a security hole to verify an uploaded supposed-to-be-zip file as a zip with zip_open()?
Question's subject is pretty much it.
I have an upload widget on a custom content type that is for users to provide a zip file.
I want to verify the file they provide is indeed a zip file, and ...
- 1,505
1
vote
2
answers
278
views
Implement anti-CSRF tokens into all requests to add protection from cross-site request forgery attacks
Is there any module or technique to implement anti-CSRF tokens into all requests in Drupal 9 for anonymous users?
- 11
1
vote
1
answer
638
views
How do I edit settings.php when it is read-only?
I have a Drupal 10 site that I just installed for the first time. I am very new to Drupal, and I haven't done anything to this site except install it and set up basic details like the site name, ...
- 157
1
vote
2
answers
479
views
How can I control node access based on entity reference to multiple users
I have multiple uses for this functionality now but mainly for a private message system.
What I want to do:
Configure a content type with an entity reference to users
Create nodes of that type and ...
- 414
1
vote
2
answers
613
views
How can I encrypt user-submitted content per user for a content type?
Let's say I have a website where people keep a personal diary (diary content type). I have configured permissions so that each user can only read, write, and view his/her own diary.
Users can create ...
- 29k
1
vote
3
answers
372
views
How to place a role-aware "Add new" link at the top of a Views listing of media
I've created a view that provides a listing of a particular media type on my site. I'd like to place an "Add new" link at the top of this view and have it visible only to users who can actually add ...
- 61
1
vote
2
answers
423
views
node_load_multiple does not respect node access grants
I used $nodes = node_load_multiple(NULL, array("title" => "Foo Bar")); to fetch nodes by titles. But after going through Drupal security standards, node_load_multiple is not the right way to load ...
- 3,444
1
vote
1
answer
2k
views
How do I modify the "has_js" cookie?
I have a web application deployed through Drupal 7.43. I need to modify the has_js cookie that is set by Drupal to make it both Http-only and Secure for a site security review.
What are pros and cons ...
1
vote
2
answers
452
views
Which Drupal versions are affected by the vulnerabilities in advisory PSA-2016-001?
There is an PSA about the 2016-July-13 Security Advisory of several critical updates:
View online: https://www.drupal.org/node/2764899
Advisory ID: DRUPAL-PSA-2016-001
Project: Drupal ...
- 1,187
1
vote
1
answer
448
views
How to apply xss filter on a csv file
I have a CSV file from which I am importing some data. Should I need to apply XSS filter? How do I achieve this?
while (!feof($handle)) {
$data = fgetcsv($handle);
$path[] = $data[0];
$...
- 63
1
vote
1
answer
146
views
Users with no roles are getting onto my system
I am having an issue with my site, there are users accessing it and creating accounts without having a role.
Here we can see user roles is blank. From my understanding someone has found a weakness in ...
- 129
1
vote
1
answer
42
views
Securing folder in Custom Module for Drupal 6
I wrote a custom module, which logs errors to an external text file. The files are kept in
/sites/all/modules/custom/my_module/logging/
The problem is, if the user know the name of the file, they ...
- 185
1
vote
2
answers
537
views
Drupal 7 Private Files - How to override security in custom module
Is there a hook to override access to images stored in the private file system when theme_image_style is used to output the image?
- 293
1
vote
1
answer
461
views
Secure Pages Domain Access for Drupal 7
I ran into a problem using Secure Pages with multiple subdomains. Secure Pages only seems to allow you to put one domain for SSL and not secure pages. I found the following module in Drupal 6, but I'm ...
- 357
1
vote
1
answer
151
views
How can I securely expose data through Drupal (via REST or something else)
I'm looking to use Drupal to pull in data through forms etc, probably in the form of content types, and then expose these, probably via REST, to other things. I've had a look at the services module, ...
user20078
1
vote
2
answers
87
views
Insecure fmath editor
fmath is an extremely powerful plug-in library for wysiwyg editors.
It provides an editor for mathematical formulas, which generates images that can be used in drupal sites. It processes mathml and ...
- 513
1
vote
2
answers
1k
views
Secure Login not Working
I'm running drupal 7 with the secure login module and login toboggan. After installing it, going to http://site.com I see the usual site, with the login button.
The login form action has not changed, ...
- 233
1
vote
2
answers
123
views
security updates reported but not actually available (recommended==installed)
I installed Drupal 9.3.6.
At /admin/reports/status, I see the error:
There are security updates available for one or more of your modules or themes
and at /admin/modules/update, two modules are ...
- 149
1
vote
1
answer
171
views
Do I need to set up public files directory for multi-sites differently?
I had some Drupal installations which I merged into a multi-site installation.
When they were single installations, I created a files in the root directory and set the system permissions for the ...
- 167
1
vote
2
answers
2k
views
How do I hide the core version to the outside world?
I was bothered in knowing with whatcms.org a version can be given for drupal 8, even a minor version - no minor version, instead, when I tried with a drupal 7.
Curiously enough in my case, I got a ...
- 31
1
vote
1
answer
50
views
How do I implement access checks based on referring nodes in the grants system?
Following a suggestion in another thread here I'm trying to rewrite the access restrictions that I developed using hook_node_access (and that are working well, so far) in Drupal's grant system (i.e. ...
- 289
1
vote
2
answers
869
views
Where can we store 3rd party application passwords?
I've written a Drupal 8 custom module that communicates with 3rd party APIs which need authentication. I have an application username and password for those APIs which I need to store somewhere. I can ...
1
vote
1
answer
502
views
Extended Audit logs
I am using Audit log module for Drupal 8.5. But it looks the audits are very limited - i.e it audits only user updates and node updates. Not for creating templates, changing configurations, changing ...
1
vote
1
answer
327
views
What is the best way to update Drupal periodically using a cron job? [closed]
Previously I periodically updated Drupal sites by using a cron-job with a "drush up -y" script running every Wednesday 15,16,17,18,19,20,21,22 hours UTC. which is when "Security releases happen" ...
- 161
1
vote
1
answer
124
views
How sensitive is a site's UUID?
I have set up continuous integration for a Drupal site. After every git push the site is built remotely from scratch in a Docker container. It runs a site install, sets the site's UUID to import the ...
- 18.6k
1
vote
1
answer
48
views
Services Views module no longer maintaines. What are my options? [closed]
My site relies heavily on the Services and Services Views modules. The Services Views module is no longer being maintained and it has a security vulnerability in it. Could someone help me either ...
- 19
1
vote
1
answer
36
views
Best way to log clicks on a link of a custom content type
I have a custom content type (bundle, drupal 7) which has a link (rules link module) and I want to log the number of clicks on this link. At the moment I've an integer field in the bundle and I use ...
- 69
1
vote
1
answer
111
views
best way to restrict endpoints such as /node or /filter/tips
I am looking for the best way to restrict access to drupal pages such as /node, /filter/tips and /filter/tips/plain_text etc.
Do I add rewrite rules to the .htaccess file?
- 403
1
vote
1
answer
2k
views
CSS and Js not loading with https
I'm trying to put my entire website under https connexion, but my css and js are not loaded. I don't know why.
I had this code to the htaccess at the root of the website :
# Force HTTPS and WWW
...
- 365
1
vote
1
answer
176
views
PCI compatible recipe?
I've struggled to find a really straight answer that makes me super comfortable to this question after searching SE, PCI basics, drupal.org, AWS resources, and reading the Drupal PCI Compliance White ...
- 121
1
vote
1
answer
475
views
What to do for "Login attempt failed for admin." and "Access denied" to path admin?
In Watchdog, I started seeing several entries like this:
Login attempt failed for admin.
And
access denied 2016/04/04 - 15:06 admin
These are generating a fair number of log entries. The IP ...
- 29k
1
vote
1
answer
188
views
Increase security on logon
I am using Logintoboggan module but by chance by playing around with Wireshark packet sniffing tools I can see all login details and passwords when users login/register on my site!
Is there a way to ...
- 51
1
vote
1
answer
47
views
Secure file download from other server
This is an unusual one. Let's say I have two web servers A and B. How would I go about making a link to a file from a Drupal website on server A to a file on server B such that the link is secure (the ...
- 1,191
1
vote
1
answer
56
views
How can I evaluate the security of a contrib module?
Are there security standards for each stage of a module on Drupal.org?
Create sandbox project > full project with dev version only > official release
What is the process for the security of ...
- 1,592
1
vote
1
answer
21
views
How can I monitor for bot accounts accessing drupal paths without permission?
On my site, users do not have permission to create content.
However, looking through the watchdog logs, I found several accounts that were attempting to access
node/add/article
node/add/page
and so ...
- 29k
1
vote
2
answers
134
views
Is this block safe from code injection exploit?
Thanks good people here, I have create a simple module which generate two blocks as follows:
function myblockmodule_block_info(){
$block['myadblocks'] = array(
'info' => t('My first ...
- 145
1
vote
1
answer
50
views
Is it safe and fine to block external access to sites/all/modules folder and all its subfolders and files? [closed]
That's to say block all except 127.0.0.1?
- 726
1
vote
1
answer
55
views
Site affected by PSA-2014-003, revoke all public keys?
I didn't patch my website right after PSA-2014-003, it run about one week unpatched.
Now, I'm moving my website to a new server, using an old database backup. In my old server, I used an passphrase ...
- 23
1
vote
1
answer
121
views
Aegir and SA-CORE-2014-005
Case:
- Aegir server 2.1 on Drupal 6.31
-- Platform Hostmaster: Drupal 6.31
--- Hostmaster: ?
-- Platform 1: Drupal 7.31
--- Site 1: HACKED
--- Site 2: HACKED
-- Platform 2: Drupal 7.32
--- Site 3: ?
...
- 352
1
vote
1
answer
113
views
How to hide username displayed in code with Omega 3 theme
Drupal 7 with Omega version 3 theme generates a username class for the article tag in the HTML code, something like :
class="node node-page node-published node-not-promoted node-not-sticky author-...
- 58
1
vote
1
answer
117
views
Where does field help text get filtered?
Drupal 7 fields, by default, have a nice text box beneath them for Help Text. This is set up with field_ui_field_edit_form():
$form['instance']['description'] = array(
'#type' => 'textarea',
'...
- 38.1k
1
vote
1
answer
382
views
Security issues while using external javascript and php files to access mysql database in drupal nodes
I have created a search_interface node which asks for filters and onClick event of the submit button, I have called an external search.js script. My search_interface node is of a custom content type ...
- 161
1
vote
1
answer
286
views
One-time link without valid email address Spam Registrations
I have a D6 site that gets a lot of SPAM account registration and they all follow a pattern, however from different IP addresses (often during the following process):
1) User account is created
2) ...
- 133
1
vote
1
answer
467
views
in multi-site do you set base url for each sites settings?
Have just enabled security review module and it's alerting to base url not being uncommented and set. This is a multi-site so do I need to set the base url in each settings file for each site? I set ...
- 501
1
vote
2
answers
534
views
Drupal security ACL
I have a client having website in Drupal . He need to create user and want to assign rights for edit and delete on every column displayed in webpage. I have tried ACL but that didn't work, so Iam ...
user1635914
1
vote
2
answers
154
views
"Administer Taxonomy" is needed to make a user select a term
I need a user to select a term from a given vocabulary but the field is only available to a normal user if I enable "Administer Taxonomy" for them. Is there a way around this? Shouldn't I be using ...
- 111
1
vote
1
answer
764
views
Decode entities in node titles
I have a few node titles that are being saved with & and displaying that way too.
Is there any way to not encode them while being saved? I tried:
$node = node_load(727);
$node->title = ...
- 28k
1
vote
2
answers
208
views
How can I allow users to change their email addresses without a password via REST/JSON:API?
To change the password of a user account, Drupal requires the user to input their password.
I have a decoupled Drupal app using JSON:API.
The Nocurrent Pass module disables the password check when ...
- 29k
1
vote
0
answers
88
views
For which tables should the MariaDB user have CRUD permissions for browsing the site?
I'm trying to lock down the database on my Drupal 9 install so that people can browse the website, but can't write to it.
I have 2 users in MariaDB with access to the database. I want to set one ...
- 67
1
vote
0
answers
28
views
What is the specific security implication with the permission "Select method for cancelling account"
Below the permission "Select method for cancelling account" there is the following hint:
Warning: Give to trusted roles only; this permission has security implications.
I understand that ...
- 609