Questions tagged [security]
Use it for questions related to site security, in particular those focused on protecting a Drupal site from unauthorized access.
439 questions
3 votes
0 answers
41 views
CSP: Nonce value appearing on script but not policy
I'm using the CSP module on my site and attempting to add a nonce to my GTM script. I'm able to get a nonce value on the script element, e.g. <script nonce="zRaBCyoyymExSEt4jIfolw"> ...
- 633
1 vote
1 answer
129 views
Does the Webform module take care of input sanitization of text fields to prevent SQL injection?
I am new to Drupal and need to know if the Webform module would take care of input sanitization of text area by default to prevent against SQL injection. I use it for public forms where users can fill ...
- 11
0 votes
1 answer
61 views
Put CAPTCHA round entire site [closed]
Our site (D10) is being hammered by AI bots to the point it's virtually unusable. One option we have is to wrap the entire site in a CAPTCHA - so no access (even to public pages) without passing a ...
- 430
0 votes
0 answers
112 views
Webforms file upload automatic saving to /tmp (_sid_) causes vulnerability?
We've recently encountered a potential security issue with Webforms file upload field automatically saving any selected file to /tmp (/_sid_), even when the filesystem is private. The current file ...
- 11
0 votes
0 answers
70 views
ACCESS DENIEND showing in content area of Drupal site behind LDAP-PROXY barrier
I'm scratching my head here with an unusual problem which began only AFTER MIGRATION into Drupal 9 / Drupal 10: try to protect access to site behind proxy-Ldap barrier (so people can access it from ...
0 votes
0 answers
68 views
Entity upload endpoint (POST) API security
Although Drupal provides default security features, I still have a doubt related to the security of uploading a file using the file entity upload API URL. If I have set the allowed file extension and ...
- 1
0 votes
1 answer
118 views
What's the meaning of [Drupal 10.0.x will receive security coverage until December 2023.] in release note [closed]
What's the meaning of [Drupal 10.0.x will receive security coverage until December 2023.] in release note. Can I continue to use Drupal 10.0.x after December 2023, is there any problem that I need to ...
- 21
1 vote
2 answers
653 views
Implement anti-CSRF tokens into all requests to add protection from cross-site request forgery attacks
Is there any module or technique to implement anti-CSRF tokens into all requests in Drupal 9 for anonymous users?
- 11
2 votes
1 answer
203 views
Why does Drupal harden permissions of the /web/sites/default directory and files?
I understand that Drupal hardens permissions of the /web/sites/default directory and its files, each time that the system_requirements() function is called, typically after each composer require ...
- 69
1 vote
2 answers
2k views
Am I hardening the permissions in settings.php correctly?
Last month, I encountered an issue where I could not edit settings.php as it was read-only. I asked this question and learned how to change the permissions to edit the file, and then harden them again....
- 177
1 vote
1 answer
1k views
How do I edit settings.php when it is read-only?
I have a Drupal 10 site that I just installed for the first time. I am very new to Drupal, and I haven't done anything to this site except install it and set up basic details like the site name, ...
- 177
0 votes
1 answer
631 views
SQL injection POST attacks
Just found hundreds of POST requests to user registration pages on Drupal site. No users are being registered but these requests are still getting 200 status from Drupal. Are these requests doing any ...
- 15
0 votes
1 answer
361 views
Modules are not updating to the latest version
I have some websites in the drupal. I need to update the security modules in the old version to the latest version. The list of security modules I tried to attempt is as below 1)colorbox (current - v2....
- 129
2 votes
1 answer
83 views
After any Composer command, does Composer or core set (or harden) the file permissions?
After any Composer command (for example, composer create-project, composer require, and composer update), does Composer or Drupal set (or harden) the file permissions?
- 45
1 vote
2 answers
94 views
How can I prevent a page with PHP content getting flagged in Security Review "Dangerous tags in content" check?
I am using Drupal 7. I have a page that has a PHP body that I know does not have any dangerous tags. According to the README.txt file in Security Review I need to add this to the "...
- 285