66 votes
Accepted

How to upgrade only core with drush?

In this case, it looks like you need to do drush rf # pm-refresh before you do drush up drupal This will refresh the list of available updates so Drush knows there is a new release for Drupal.
38 votes

How to upgrade only core with drush?

Worth mentioning is $ drush up --security-only Only update modules that have security updates available. That includes Drupal core.
  • 2,626
29 votes

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

If you're reading this article and hoping to check a Drupal 7 site more than a month after the exploit landed, your site quite likely already got hacked. Your best bet is to restore a backup from ...
24 votes

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

Some checks for common attacks are (this is not an exhaustive list, but are some of the attacks seen in the wild so far): Check your user 1 account to make sure its user name, email address or ...
  • 14.5k
20 votes

What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?

Whats going on with 7.32 By checking the testing module. You can see the following test was added to 7.32; + + /** + * Test SQL injection via database query array arguments. + */ + public ...
19 votes
Accepted

How to enable a site to be in an iframe?

Since Drupal 7.50, core is now protected against clickjacking by default (X-Frame-Options: SAMEORIGIN). So by default, your Drupal site can only be embedded into a site on the same domain. To change ...
  • 164k
18 votes
Accepted

What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?

The company that found the bug has some examples on Advisory 01/2014: Drupal - pre Auth SQL Injection Vulnerability : Extract: The function assumes that it is called with an array which has no ...
17 votes
Accepted

Prevent SQL injection

Drupal 8 (like Drupal 7) uses PDO to communicate with databases. With PDO, the DB API makes use of prepared statements, specifically to avoid SQL injection attacks. Practically, this means that you ...
  • 164k
16 votes

What kind of attacks does the patch for SA-CORE-2014-005 (Drupal 7.32) prevent?

The researchers who found the bug have a proof of concept. Others have developed proofs of concept as well. However, they are purposefully not posting them to try to reduce the likelihood that it will ...
  • 5,182
14 votes
Accepted

Drupal reuses its hash salt

I have migrated other CMS's to Drupal and had experience moving user accounts. Drupal's password algorithm is extremely good. The salt you are referring to in the settings.php is not used for ...
  • 1,094
12 votes

How critical is SA-CORE-2018-005?

The specific vulnerability seems to be the ability of a requester to send one request path to the webserver, but use an HTTP header to make Drupal see a different path. The rewrite happens early, so ...
11 votes
Accepted

What do blocked IP addresses see?

They see a blank 403 page with this message specifying that their IP address has been banned: The block is done at the application level. Drupal inserts a record into the blocked_ips table which is ...
  • 26.4k
11 votes
Accepted

Prevent Cross-site scripting

Sanitizing on output to avoid Cross Site Scripting (XSS) attacks Use Twig templates The Twig theme engine now auto escapes everything by default. That means that every string printed from a ...
  • 29.8k
10 votes

What are the recommended directory permissions?

Recommended file/directory permissions: Drupal webroot should be world readable (see: updater.inc): 0755 for public upload directories: 0755 or 0775 for private upload directories: 0750 or 0770 for ...
  • 13.7k
10 votes

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

I think I would go with the advice drupal.org "You should proceed under the assumption that every Drupal 7 website was compromised unless updated or patched before Oct 15th, 11pm UTC, that is 7 hours ...
  • 2,230
10 votes

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?

How can I tell if someone used this exploit to hack my site? Your Drupal 7 or 8 site can experience loss or theft of data, data can be removed, deleted or changed, wreaking havoc on the site in many ...
  • 1,617
9 votes

How to upgrade only core with drush?

drush up drupal Appending the project you want to update makes drush to only update that project.
  • 6,926
8 votes

Is CiviCRM data vulnerable to the Drupageddon bug?

Since a potential attacker got access to the database, and through the evil php module, could execute code, everything on the same server must be considered compromised.
  • 27.5k
8 votes
Accepted

How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?

What could happen I had a personal Drupal site hacked during Drupalgeddon, an exploit of similar severity (though of a different type). In terms of "what could happen," in that case the hacker put ...
7 votes
Accepted

Drupal Commerce Authorize.net gateway and POODLE

The commerce_authnet module is using the PHP curl() functions to communicate with Authorize.net, and it does not explicitly requests the SSLv3 protocol in the curl options (see file commerce_authnet....
7 votes

Unattended automatic security updates / upgrades

Please also keep in mind there are '0-day' vulnerabilities out there, which can be used to compromise your website even before Drupal publishes a security advisory and corresponding patch. And that ...
7 votes
Accepted

Is CiviCRM data vulnerable to the Drupageddon bug?

I probably would guess, yes to this one especially if you have added the civicrm db to the drupal settings file and/or share the civicrm tables in the same drupal db. the primary reason for this is, ...
6 votes
Accepted

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

Here are some SQL queries that can be run against your site DB's to check for users with admin privileges, and which of those have accessed the site post 15th Oct. http://www.drupalden.co.uk/sql-...
6 votes
Accepted

Should you use check_plain() prior to inserting into database?

I downvoted Devaraj Johnson's answer because it suggests to check_plain() data before saving it to the database, which is wrong. The idea behind check_plain, filter_xss and filter_xss_admin is to ...
  • 9,473
6 votes
Accepted

How to extend flood control in a custom module?

You need to do 3 things when you validate your password entry form: Use flood_is_allowed() to check that the user hasn't already breached their flood limit and set a form error with form_set_error() ...
  • 14.5k
6 votes
Accepted

Is uploading/download executable files harmful in drupal?

You'll want to make sure that your server is not configured to execute files of the given extensions in any way. As a general precaution, you might also configure that file field to use the Private ...
  • 2,358
6 votes
Accepted

Why is settings.php in the web folder?

You are absolutely correct. I know for a fact that many developers/sysadmins do not take the risk that the PHP interpreter might fail at some point, and include the db password (and other sensitive ...
  • 14.9k
6 votes
Accepted

How to get accurate information about available security updates after End-of-Life?

Have a look at the myDropWizard module, a recently released module for Drupal 6. Some more details about it (from its project page, which also includes a screenprint about it): Reports accurate ...
6 votes
Accepted

Automatically block user that access /wp-login.php

You can use autoban ip You have to at least enable Autoban and Autoban Core Ban Provider modules from this package. Then go to configuration > people > automatic ip address bans and add a rule ...
  • 7,982
5 votes

base_url for both http and https?

You probably need to do something like this: $protocol = (!empty($_SERVER['HTTPS'])) ? 'https' : 'http'; $base_url = $protocol . '://mysite.com'; ...so that Drupal knows which protocol to use ...
  • 1,990

Only top scored, non community-wiki answers of a minimum length are eligible