19
votes
Accepted
How to enable a site to be in an iframe?
Since Drupal 7.50, core is now protected against clickjacking by default (X-Frame-Options: SAMEORIGIN).
So by default, your Drupal site can only be embedded into a site on the same domain.
To change ...
- 165k
17
votes
Accepted
Prevent SQL injection
Drupal 8 (like Drupal 7) uses PDO to communicate with databases.
With PDO, the DB API makes use of prepared statements, specifically to avoid SQL injection attacks.
Practically, this means that you ...
- 165k
13
votes
Accepted
Prevent Cross-site scripting
Sanitizing on output to avoid Cross Site Scripting (XSS) attacks
Use Twig templates The Twig theme engine now auto escapes everything by default. That means that every string printed from a
...
- 30.6k
12
votes
How critical is SA-CORE-2018-005?
The specific vulnerability seems to be the ability of a requester to send one request path to the webserver, but use an HTTP header to make Drupal see a different path.
The rewrite happens early, so ...
- 2,366
11
votes
Accepted
What do blocked IP addresses see?
They see a blank 403 page with this message specifying that their IP address has been banned:
The block is done at the application level. Drupal inserts a record into the blocked_ips table which is ...
- 26.5k
10
votes
What are the recommended directory permissions?
Recommended file/directory permissions:
Drupal webroot should be world readable (see: updater.inc): 0755
for public upload directories: 0755 or 0775
for private upload directories: 0750 or 0770
for ...
- 13.9k
10
votes
How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?
How can I tell if someone used this exploit to hack my site?
Your Drupal 7 or 8 site can experience loss or theft of data, data can be removed, deleted or changed, wreaking havoc on the site in many ...
- 1,627
8
votes
Accepted
How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?
What could happen
I had a personal Drupal site hacked during Drupalgeddon, an exploit of similar severity (though of a different type). In terms of "what could happen," in that case the hacker put ...
- 404
6
votes
Accepted
Should you use check_plain() prior to inserting into database?
I downvoted Devaraj Johnson's answer because it suggests to check_plain() data before saving it to the database, which is wrong.
The idea behind check_plain, filter_xss and filter_xss_admin is to ...
- 9,514
6
votes
Accepted
How to extend flood control in a custom module?
You need to do 3 things when you validate your password entry form:
Use flood_is_allowed() to check that the user hasn't already breached their flood limit and set a form error with form_set_error() ...
- 14.7k
6
votes
Accepted
Is uploading/download executable files harmful in drupal?
You'll want to make sure that your server is not configured to execute files of the given extensions in any way.
As a general precaution, you might also configure that file field to use the Private ...
- 2,358
6
votes
Accepted
Why is settings.php in the web folder?
You are absolutely correct. I know for a fact that many developers/sysadmins do not take the risk that the PHP interpreter might fail at some point, and include the db password (and other sensitive ...
- 14.9k
6
votes
Accepted
How to get accurate information about available security updates after End-of-Life?
Have a look at the myDropWizard module, a recently released module for Drupal 6. Some more details about it (from its project page, which also includes a screenprint about it):
Reports accurate ...
- 35.8k
6
votes
Accepted
Automatically block user that access /wp-login.php
You can use autoban ip
You have to at least enable Autoban and Autoban Core Ban Provider modules from this package.
Then go to configuration > people > automatic ip address bans
and add a rule ...
- 8,185
5
votes
Accepted
Trying to make my entire site https
It's usually easier to redirect at the Apache level if you're looking to make the entire Drupal HTTPS. You can place this in your .htaccess file:
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{...
- 26.5k
5
votes
Accepted
Can a disabled module pose a security risk?
I say yes since the vulnerable code is still sitting right there in the web directory which can (will) be scanned by potential attackers. Monitoring disabled modules is certainly part of our update ...
- 1,460
5
votes
Accepted
How do I handle third-party API credentials in settings?
The key module provides a framework for abstracting key storage from modules. The module provides 2 key providers (plugins) out of the box: config and file. It is possible to implement a key provider ...
- 5,806
5
votes
How do I redirect to www and https in settings.php?
The caveat to the settings.php approach is 2 issues:
Your redirect requires that Drupal be bootstrapped to work. If there's a resource that bypasses Drupal (e.g. any hosted files), you're not going ...
- 26.5k
5
votes
Remove the X-generator header from the response
The simplest method is to remove the header in a custom EventSubscriber:
$response->headers->remove('X-Generator');
See https://drupal.stackexchange.com/a/201297/47547 for an example.
- 93.8k
5
votes
How to prevent a site from ever using experimental core modules?
This is by far not as black and white as you make it in regards to experimental modules.
First, on a mission critical production site, you don't want to do anything directly on production. Completely ...
- 82.2k
5
votes
Accepted
Is there a way to send emails when someone logs in?
A possible solution is to use the Rules module and create a custom rule like so:
Rules Event = After a user logs in.
Rules Action = Send an eMail.
That's really it (a kind of Rules 101 also if you ...
- 35.8k
5
votes
Accepted
How to set content-security-policy header?
I may be a bit biased in thinking that the Content Security Policy module is the best solution for adding a policy to your site, but here are some of the reasons for using the module:
Integration ...
- 1,544
5
votes
Accepted
How is user input sanitized?
Drupal uses Twig's autoescape feature, which in turn uses escape, which itself uses htmlspecialchars to prepare markup safe for output.
SafeMarkup::checkPlain() preceded the autoescaping (deprecated ...
- 165k
5
votes
Accepted
Using modules "not covered by Drupal’s security advisory policy"
According to the Security advisory process and permissions policy, modules that have an alpha, beta, or rc (relase candidate) status are not covered by this policy, and security advisories will not be ...
- 126
5
votes
Accepted
Make a password security check for the register form
It seems like you might want to look into the Password Policy module which probably has a lot of the features you are trying to rebuild.
I also wonder whether it makes sense to build your own user ...
- 5,212
4
votes
Accepted
Will changing the value of $drupal_hash_salt in settings.php file break site
Disruption should be minimal -- the salt value was designed to be changeable. As it says, it will invalidate one-time login links when the salt is changed. But if you suspect that you've been hacked, ...
- 2,358
4
votes
Accepted
Why did Views just jump from 3.8 to 3.10 (what happened to 3.9)?
I can't say exactly what's happened in this particular case, but:
It's fairly common practice to do a double release in the case of security updates. Core for example, does this every time, although ...
- 27.5k
4
votes
What is good way to hide update.php file?
You can add the following line:
RewriteRule ^update.php$ - [R=404,NC,L]
to your .htaccess file so the web server returns a 404 rather than bootstrapping Drupal to show access denied.
- 2,393
4
votes
Accepted
Running Drupal 6 with PHP 5.3 and Maintaining Security
Here are the patches I'm using for D6. Some of these issues will have been committed, thus they don't need a patch anymore.
Views
http://drupal.org/node/853864#comment-6465560 - ...
- 8,252
4
votes
What are the recommended directory permissions?
This shell script is found at the bottom of this page: https://www.drupal.org/node/244924
I run it occasionally to ensure that my permissions are set up correctly.
#!/bin/bash
# Help menu
...
- 469
Only top scored, non community-wiki answers of a minimum length are eligible