Questions tagged [security]
Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.
434
questions
0
votes
0
answers
27
views
Front page full of invisible spam links [duplicate]
This morning i noticed that wherever i want to click on menu and above menu i have invisible links leading to spam websites.
It looks to me that they are hard coded but i have no idea where to delete ...
- 749
0
votes
1
answer
17
views
Is necessary any sanitization functions if I use the database layer correctly
In Writing secure code said:
Use the database abstraction layer to avoid SQL injection attacks
Then, my question:
When I get value for a user form is necessary pass to check_plain() or others ...
- 3,581
0
votes
1
answer
36
views
Are spam registrations a threat to a Drupal 7 site
Yesterday, as I was explaining to a client that someone would need to remove spam registrations, the client asked me what difference it made if they are in the system because we can just turn off all ...
0
votes
1
answer
34
views
Two concerns: Available for security updates / Image captions
I am looking at revamping a set of sites from ASP to Drupal. I like a lot of what I see in Drupal, but have two concerns:
In reading about Drupalgeddon, it seems that the problem was that many people ...
- 437
0
votes
0
answers
51
views
Prevent image uploads with embedded code
I have a site which allows anonymous users to create a node with an image (the site allows people to submit images with quote memes so that the authenticity of the quote can be verified, quotefail.com)...
- 3,058
0
votes
1
answer
141
views
How to edit module file to make layout changes?
I have installed module Security Questions to allow users to answer security question while retrieving the password.
It works fine. But I'm facing layout issue with it.
How can I edit this module so ...
- 326
0
votes
1
answer
53
views
Panopoly WYSIWYG exclude buttons configurations
Can anyone tell me if it's possible to configure the Panopoly wysiwyg to we can have different buttons available to different roles?
At the moment, without have to create a module, I can't find a ...
- 1,710
0
votes
1
answer
30
views
Boost Security_review compatibility
I had security_review warning for boost cache folder.
I've changed cache folder location to "sites/default/files/cache"
And now I have no warning.
Is this solution correct and safe?
- 430
0
votes
1
answer
194
views
Is there a possible/safe way to do a sub-request
In Drupal 8 the Symfony HttpKernel Component offers a nice way to make an internal sub-request (forward a request to another page without changing the URL). I'm wondering if there is an ad hoc way to ...
- 2,369
0
votes
1
answer
587
views
Temporary files directory not fully protected .htaccess
I've been getting this error on my status page since I updated to 7.24 (I'm on 7.34 now).
I do have my other files directories protected. I just am having a real hard time figuring how to shut this ...
- 2,409
0
votes
0
answers
32
views
Is my Drupal website hacked? [duplicate]
So I am running this Drupal 7 website, I just checked users list and got surprised with this:
As you can see the usernames are spam and their emails are also spam. But I do not get it how they did ...
- 447
0
votes
0
answers
30
views
All the sudden my site show rare characters and links doesn't work.Help [duplicate]
All the sudden my site (drupal 7) shows rare characters like �0�1�0�
Also, the links doesn't work. All links in the site reload the home page.
I can't access example.com/user neither.
Please help. ...
- 6,227
0
votes
1
answer
125
views
How to skip "Checked available update data for" all modules when I just want to update core or a specific module?
I'm upgrading a lot of my Drupal sites to 7.32. Unfortunately it takes a lot of time for each site because of some update check that I don't need.
On How to upgrade only core with drush? I learned I ...
- 1,704
0
votes
0
answers
427
views
How to automatically put your site into maintenance mode if at least a critical security update is available?
I think I'm craving for this functionality.
What I want is, if after a CRON run, Drupal detects that such a security update is available, the site would be taken down for maintenance mode to avoid ...
- 17
0
votes
0
answers
114
views
Drupal 7 multisite password protect single site
I am running a Drupal 7 multisite platform in which sites will be added at a later date to a live version of the website. During the testing process I need the new sites to be on their final live ...
- 223
0
votes
0
answers
52
views
What are the appropriate file security settings and Apache settings for Drupal sites running on a VPS?
I would be grateful for some help on this one - I have looked at the other posts on this subject with interest, but they don't seem quite to fit my situation. I'm not a great Unix expert, but there ...
- 199
0
votes
1
answer
124
views
How to block the user after a few failed logins
modules like login security deny the user IP after afew failed logins. there are softwares that randomly generate new IP for user so it makes such modules useless. sending cookie to the user browser ...
- 3,862
0
votes
0
answers
53
views
How to externally register a new user without accessing /user/register?
I have a (Drupal 7) site which uses LDAP to authenticate logins according to an Active Directory groups only.
In the Apache config file, the URLs '/user' and '/admin' are both blocked externally. ...
0
votes
0
answers
38
views
How to delete or hide any trace of drupal in source code [duplicate]
Well I'm working on a government website that needs a lot of security insurances! the security thingy guys keep saying that there are couple of Drupal name in the source that shouldn't be there!
So ...
- 1,544
0
votes
0
answers
697
views
Access denied for image urls created via image style although derivative token is appended?
I want to apply an image style to an image and use it via CSS:
if (isset($node->field_images_image['und'][0]['filename'])) $vars['blurred_background'] = image_style_url('background_blurred', '...
- 2,493
0
votes
0
answers
392
views
D7 Organic groups and securing private files
I'm looking for a current solution for private file protection in D7 (so files uploaded without a node can be hidden from unauthorized users). I saw this question, organic groups and private files, ...
- 334
0
votes
1
answer
25
views
Conditional based field security
Is there any condition based field security in Drupal? E.g. An administrator can only edit user details users who are from the same Country?
user5681
0
votes
1
answer
687
views
what actions to take when someone uploaded php files in random drupal folders and sending out spam
I'm not sure how this happened, but my server techs notified me about some php files inside the includes folder sending out 50k worth of emails. I'm not sure how anyone would be able to upload that. I ...
- 8,731
0
votes
0
answers
67
views
Strange behaviour,it may be an attack
I have a political website, and I expect attacks anytime. Yesterday, someone told me on my Facebook page that he will hacker me; I blocked him immediately.
Today, when I tried to create a user on the ...
0
votes
2
answers
53
views
Placing Drupal core/modules code outside public_html
I've been trying to improve my sites security as I build a Drupal 8 update for my page. One thing I've seen recently is keeping your core code outside the web accessible docroot folder. I've also ...
- 385
0
votes
2
answers
1k
views
Security Review - Untrusted users are allowed to input dangerous HTML tags
I am getting the following error in my security review:
Untrusted users are allowed to input dangerous HTML tags.
Is this because in my text formats I've got the following:
Plain text All roles may ...
- 1,153
-1
votes
2
answers
55
views
What does this error message mean?
My website is getting too slow. When I checked the journal entries, I found many errors like the following.
What is it? What are they trying to do?
-1
votes
2
answers
60
views
Safety of letting user define javascript paths in fields
I have a module that uses the Fields API to insert a HTML5 canvas element and allows users to define paths to user scripts to be loaded with the page:
The scripts are relative to a hard-coded path ...
- 365
-1
votes
1
answer
87
views
Security issues with v7.59 [closed]
I have updated various Drupal 7 sites to version 7.59 (and included all relevant updates) because of the security update. However I've still experienced issues with sites being hacked, there were ...
- 121
-1
votes
1
answer
948
views
How do I fix the following security issue that were reported from a security check?
After running some security checks on my website with Detectify & Tinfoil, I'm faced with some concerns.
There seem to be a lot of security issues that I thought were covered by Drupal, and I'm ...
- 99
-1
votes
1
answer
103
views
How to write custom node_access that works with searchapi?
I'm trying to write a custom node access module, implementing hook_node_access.
I have a searchapi index of all my nodes, which I would like to return results that obey the hook_node_access ...
- 122
-1
votes
1
answer
32
views
code change alert/email [closed]
Is there a module to help me receive email for any change in drupal site ?
https://www.drupal.org/project/logging_alerts this module help a lot in log in / log out and add content .. but I need to ...
- 3
-1
votes
2
answers
130
views
Hardening Drupal server running the Update Manager
We are going to do the hardening on one of our Linux server running SELinux and Drupal 7 with firewall; on the Drupal Update Manager, if we want only to get periodic emails / notifications on modules ...
-2
votes
1
answer
168
views
Is this way safe to bootstrap Drupal from an external PHP script? [duplicate]
I want to bootstrap Drupal from an external PHP file located in Drupal's root directory. The following code will do the job.
error_reporting(E_ALL);
ini_set("display_errors", 1);
define('DRUPAL_ROOT',...
- 74