12
votes
How critical is SA-CORE-2018-005?
The specific vulnerability seems to be the ability of a requester to send one request path to the webserver, but use an HTTP header to make Drupal see a different path.
The rewrite happens early, so ...
- 2,436
10
votes
How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?
How can I tell if someone used this exploit to hack my site?
Your Drupal 7 or 8 site can experience loss or theft of data, data can be removed, deleted or changed, wreaking havoc on the site in many ...
- 1,667
8
votes
Accepted
How to tell if my Drupal site is comprised from the SA-CORE-2018-002 -- 2018 March exploit?
What could happen
I had a personal Drupal site hacked during Drupalgeddon, an exploit of similar severity (though of a different type). In terms of "what could happen," in that case the hacker put ...
- 404
6
votes
Accepted
How to get accurate information about available security updates after End-of-Life?
Have a look at the myDropWizard module, a recently released module for Drupal 6. Some more details about it (from its project page, which also includes a screenprint about it):
Reports accurate ...
- 36k
6
votes
Accepted
Automatically block user that access /wp-login.php
You can use autoban ip
You have to at least enable Autoban and Autoban Core Ban Provider modules from this package.
Then go to configuration > people > automatic ip address bans
and add a rule ...
- 8,523
6
votes
Accepted
How to set content-security-policy header?
I may be a bit biased in thinking that the Content Security Policy module is the best solution for adding a policy to your site, but here are some of the reasons for using the module:
Integration ...
- 1,574
5
votes
Accepted
Is there a way to send emails when someone logs in?
A possible solution is to use the Rules module and create a custom rule like so:
Rules Event = After a user logs in.
Rules Action = Send an eMail.
That's really it (a kind of Rules 101 also if you ...
- 36k
5
votes
Remove the X-generator header from the response
The simplest method is to remove the header in a custom EventSubscriber:
$response->headers->remove('X-Generator');
See https://drupal.stackexchange.com/a/201297/47547 for an example.
- 102k
5
votes
How to prevent a site from ever using experimental core modules?
This is by far not as black and white as you make it in regards to experimental modules.
First, on a mission critical production site, you don't want to do anything directly on production. Completely ...
- 83.5k
5
votes
Accepted
How is user input sanitized?
Drupal uses Twig's autoescape feature, which in turn uses escape, which itself uses htmlspecialchars to prepare markup safe for output.
SafeMarkup::checkPlain() preceded the autoescaping (deprecated ...
- 168k
5
votes
Accepted
Using modules "not covered by Drupal’s security advisory policy"
According to the Security advisory process and permissions policy, modules that have an alpha, beta, or rc (relase candidate) status are not covered by this policy, and security advisories will not be ...
- 136
5
votes
Accepted
Make a password security check for the register form
It seems like you might want to look into the Password Policy module which probably has a lot of the features you are trying to rebuild.
I also wonder whether it makes sense to build your own user ...
- 5,280
5
votes
Accepted
Error: Private files directory not fully protected
Submit the admin form @/admin/config/media/file-system will also create this .htaccess file if your folders are setup correct.
- 424
4
votes
Accepted
How to delete first user (admin)
I doubt that's possible, or at least not without messing with a lot of core code.
User 1 is synonymous with the root user in linux. It can be disabled, hardened, made virtually impossible to access, ...
- 168k
4
votes
Accepted
Is it safe to allow domain.com/username?
On a site that is not using a mechanism like the one implemented from the Two-factor Authentication (TFA) module, letting visitors know usernames of existing accounts is giving out half of the ...
- 97.9k
4
votes
Accepted
MYSQL injections: Are they a threat?
Can somebody tell my, what these attacks are about?
They're requests from bots fishing for vulnerabilities in your website.
Was there a bug in Drupal making it vulnerable for those attacks?
...
- 168k
4
votes
Accepted
Is 8.6.18 insecure? Will there be 8.6.19 etc.?
According to the Drupal core release cycle documentation, the last month for security coverage for 8.6 was November 2019. There is no more planned security coverage for 8.6.
Security releases only ...
- 8,126
4
votes
Accepted
Understanding the Basic Context of Trusted Hosts
Trusted hosts refer to the domain that your Drupal site is hosting, not your remote PC's domain that is administering the site. For example, if your site running on Drupal was www.thedrupaldude.com, ...
- 575
4
votes
Does the login-link users receive upon registration actually expire?
Nope, new users' one-time-link do not expire. Only "forgot passwords"-links do.
Also, see this discussion. It might come in future Drupal 9 releases. https://www.drupal.org/project/drupal/...
- 3,513
4
votes
Do I need the trusted host setting?
Drupal 7 only limits the length of the host name to 1000 bytes to prevent DoS attacks, and it doesn't accepts host names containing slashes, but it doesn't restrict the allowed host names basing on a ...
- 97.9k
4
votes
Why does Drupal harden permissions of the /web/sites/default directory and files?
The settings.php file contains the database password and username in plain text and, once created, must be set so that only appropriate users can read it. That usually means removing read permissions ...
- 6,344
3
votes
Accepted
Verify that salt.txt was located and being used by Drupal?
You can check this with drush by using Settings::get('hash_salt'):
drush ev "var_dump(\Drupal\Core\Site\Settings::get('hash_salt'))"
- 102k
3
votes
Accepted
Why are there so many attempts by an anonymous user to access /wp-login.php?
As kiamlaluno said:
It's just bots scanning for exploits. You don't need to do anything,
except serving a faster 404 response for those pages, as described in
drupal.stackexchange.com/a/152732/...
- 588
3
votes
Why are anonymous visitors logged in when they visit /user/[uid] page?
This is no security hole, it's the custom code you shared.
// When you load the global user object ...
global $user;
// ... and then assign another user object to the global $user object ...
$user = ...
- 7,876
3
votes
Accepted
How to determine the code for settings.php config override based on .yml?
The first key is the name of the config object/file, so... commerce_payment.comerce_payment_gateway.stripe_test.
The rest you already figured out, it's an array that's recursively merged into the ...
- 83.5k
3
votes
Accepted
How to securely authenticate content embeded in another site?
1- build the content structure well in your first site and create a view from admin/structure/views/add that return the data needed to the second site which acts like a client consuming your first ...
- 2,010
3
votes
Accepted
Drupal 8 password retention
Out of the box, Drupal only stores the salted hash for the current password. No previous passwords are stored without the help of a contrib module such as Password Policy.
- 101
3
votes
Security issues with v7.59
Most likely there are still hacked/inserted files in your code base thats leaving an opening for the attacker to rexploit. After updating to 7.59 you need to go through the files/code and remove ...
- 3,001
3
votes
How to set up permissions for the private files directory?
Your Drupal folder is owned by daemon:daemon and your private files directory is owned by root:root.
Fix it by making your private files directory at least owned by the same group:
$ chown -R daemon:...
- 18.8k
3
votes
What does this error message mean?
Those are probably bots trying to find security holes to exploit on your server/website.
The best way to prevent them is with firewall and other security measures on your server. Most control panels ...
- 8,523
Only top scored, non community-wiki answers of a minimum length are eligible