Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 199

Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.

0
votes
That security advisory is about third-party modules made for Drupal 7. If also Drupal 8 were affected, then the advisory would report Version: 7.x, 8.x. It doesn't report if Drupal 6 is affected … , since that is a unsupported version, and the Drupal.org security team doesn't fix security issues on unsupported Drupal versions. Probably, once the involved third-party modules get a security release …
answered Jul 12 '16 by kiamlaluno
26
votes
I imagine the question is about using check_plain(filter_xss($string)), or filter_xss(check_plain($string)). check_plain() and filter_xss() have two different, and in contrast, purposes: check_plai …
answered Aug 31 '11 by kiamlaluno
14
votes
better to avoid eval() because it decreases the readability of the code, the ability for you to predict the code path (and possible security implications of that) before runtime, and hence the ability to … -party module, not covered from the security advisory policy. This is probably a reason more for not using it in production servers (if the already given reasons didn't convince you). …
answered Apr 19 '11 by kiamlaluno
3
votes
It's a tentative to detect which software is used to build the site; in the specific, they are trying to understand if the site is built with Visual DataFlex, a forth generation programming language g …
answered Mar 27 by kiamlaluno
3
votes
# Force proxies to cache gzipped & non-gzipped css/js files separately. Header append Vary Accept-Encoding </FilesMatch> </IfModule> Those directives don't protect from security issues, but they …
answered Aug 8 '12 by kiamlaluno
1
vote
There are two questions being asked, here: Should I make the PHP class a module? How can I be sure it doesn't contain security issues? If you are distributing your own PHP class, or you are … reported in Writing secure code. Following the Drupal coding standards allows you to code that can be easier understood from other users (which means they can easier find security issues or other …
answered Mar 7 '11 by kiamlaluno
6
votes
EntityFieldQuery will always check the user has the permission to access the field, if "DANGEROUS_ACCESS_CHECK_OPT_OUT" is not between the tags added to the query, but that is not done directly. It is …
answered Dec 1 '12 by kiamlaluno
1
vote
that error message should be visible to a group of users that is smaller than the group of users that has access to the form. As side note, Drupal.org has a security team that investigates on security … , beta, and development snapshots). If you find a security issue in Drupal, you should report it in the project queue for Drupal core. …
answered Nov 11 '11 by kiamlaluno
1
vote
outputting an URL. // system_requirements() $requirements ['php'] = array( 'title' => $t('PHP'), 'value' => $phpversion, 'description' => $t('The phpinfo() function has been disabled for security
answered May 14 '15 by kiamlaluno
5
votes
If by escaping you mean using check_plain() or similar functions, then no; escaping is done when outputting something, not when saving it in the database, or in Drupal persistent variables. Imagine w …
answered Aug 30 '11 by kiamlaluno
2
votes
The important is being reactive in updating the modules when the security issue is made public, which normally is not done before the new security releases for the affected modules are made available … necessary. This could avoid possible exploits, but the majority of exploits happens when the security issues are made public, which is moment when you should updated the installed modules. …
answered Jul 12 '16 by kiamlaluno
1
vote
Usually, on Drupal you don't verify if the users has a specific role, but if they have a specific permission; for example, instead of checking of the user has the administrator role, you check if the …
answered Apr 19 '11 by kiamlaluno
1
vote
Is there some security feature built into Drupal to prevent submissions by scripts? Yes, there are. First off, a script that is not bootstrapping Drupal cannot submit a form that has not …
answered Jan 7 '13 by kiamlaluno
2
votes
The correct way to use db_placeholders() with page_query() is shown in taxonomy_select_nodes(). In your case, the code should be the following one. $type = array('node_type_1', 'node_type_2', 'node_t …
answered Feb 8 '13 by kiamlaluno
4
votes
On a site that is not using a mechanism like the one implemented from the Two-factor Authentication (TFA) module, letting visitors know usernames of existing accounts is giving out half of the credent …
answered Apr 24 '18 by kiamlaluno

15 30 50 per page