4 votes

Why does Drupal harden permissions of the /web/sites/default directory and files?

The settings.php file contains the database password and username in plain text and, once created, must be set so that only appropriate users can read it. That usually means removing read permissions ...
cilefen's user avatar
  • 5,830
2 votes
Accepted

How do I edit settings.php when it is read-only?

This is explained in core/INSTALL.txt. This will make the file editable: chmod a+w sites/default/settings.php It is recommended to harden the permissions after editing: chmod go-w sites/default/...
cilefen's user avatar
  • 5,830
1 vote

What's the meaning of [Drupal 10.0.x will receive security coverage until December 2023.] in release note

Security bugs in 10.0.x will no longer be fixed after that date. That version will be “end-of-life”.
cilefen's user avatar
  • 5,830
1 vote

Implement anti-CSRF tokens into all requests to add protection from cross-site request forgery attacks

Drupal already has CSRF protection for authenticated users. One day core may add support to protect anonymous users as well. In the meantime, you could look at the anonymous token module, or force all ...
Patrick Kenny's user avatar
1 vote

fix-permissions.sh for Drupal 8

Here you can find a script that fixes permissions on Drupal installations: https://github.com/Metadrop/drupal-fix-permissions-script Permissions scheme: The scripts tries to secure the site using the ...
sanzante's user avatar
  • 6,981

Only top scored, non community-wiki answers of a minimum length are eligible