Questions tagged [security]

The tag has no usage guidance.

2
votes
1answer
75 views

How do I prevent secrets beeing logged in the PHP error log?

Background: I'm running Craft Pro 3.1.19 on PHP 7.2.15 Craft CMS, by default, uses vlucas/phpdotenv to get the configuration (containing secrets / credentials and lots of other stuff) from .env ...
2
votes
2answers
396 views

Does Craft Have a URL Rewrite Vulnerability?

We could use some help tracking down a consistent error on our Craft installs according to Acunetix Security Audits. URL Rewrite Vulnerability It was identified that this application supports the ...
1
vote
1answer
34 views

hashing form fields to prevent tampering

I have a front end form for entry creation. I have a few options I don't want tampered with. The docs for |hash say "Prefixes the given string with a keyed-hash message authentication code (HMAC), for ...
1
vote
2answers
149 views

Manually creating Security Key gives PHP error

I'm going on 5 days of banging my head on my desk here. I'm simply not getting how to install it on my production server. I have Craft working beautifully locally...but getting it to my server is a ...
1
vote
1answer
341 views

Craft 3 Database Backup

Why do I have to activate the PHP functions: "proc_open" and "proc_close" to backup the database? I got the error logs: [error][yii\base\Exception] yii\base\Exception: Could not create backup: ...
2
votes
1answer
921 views

Security Key and Boilerplate

We have set up a Craft 3 installation with composer to serve as boilerplate for a number of upcoming projects. The installation sits in a private git repository and the plan is to clone it when we ...
0
votes
1answer
132 views

Hiding Craft's admin folder from search engines

I am trying to hide our website's admin directory from public view as best as possible and have read the Securing Craft article. I am pleased at how easy it is to make a directory that isn't easy to ...
2
votes
1answer
41 views

Temporarily access to an entry

I have an entry that is currently password protected and I am looking for a way to give access to this entry to non-craft users temporarily access either by a token or something else. Anyone know how ...
2
votes
1answer
117 views

Does Craft CMS support 'encryption at rest' / 'data at rest' encryption?

Does Craft CMS support 'encryption at rest' / 'data at rest' encryption? I've looked here, here, and here - but can't find any info on this. Explain like I'm 5. Thanks.
6
votes
1answer
2k views

How to handle the SECURITY_KEY?

1) Where To Put It I’m wondering how I should proceed with the SECURITY_KEY which is now mandatory in Craft 3 (RC2). It has to be the same for one project, right? So it should be shared across ...
4
votes
1answer
196 views

Content Security Policy CSP

On Craft 2.x, is it a known limitation that we must allow unsafe-inline for script-src in the Content-Security-Policy? My admin dashboard fails to load when I don't allow it. ...Trying to get a high ...
1
vote
1answer
334 views

Adding reCAPTCHA to the admin login page

Is there any plugin or relatively straightforward and accepted way to add a recaptcha to the login for the admin page? My research so far has come up with nothing. I'm curious if others have looked ...
1
vote
1answer
240 views

How can I make Sprout Invisible Captcha plugin works using AJAX submission?

I set up a custom form template using Sprout Forms and added {{ craft.sproutInvisibleCaptcha.protect() }} inside the <form> tag. I can see there are several captcha tags added by the plugin, ...
1
vote
1answer
193 views

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

I'm using the MailChimp Subscribe for Craft plugin to embed several subscription forms on a website I'm building. The following code appears via my master _layout.html file: <form action="" ...
0
votes
2answers
921 views

Security Headers in htaccess Don't Work

We have an issue on our server when our Security Headers are not working. We added the following to our htaccess file after installing Craft CMS: - <IfModule mod_headers.c> Header always ...
1
vote
1answer
53 views

Is Craft's Email Service Protected Against Mail Header Injection Attacks?

We have a client website using Sprout Forms for a contact form. The client has queried a number of security topics with us, one of which is about Mail Header Injection attack protection (https://www....
1
vote
0answers
329 views

CSRF token creation and Content-Security-Policy header

I've just updated my site with setting my Content-Security-Policy Header and after fixing the slew of errors which popped up in the console, I am now down to one. The relevant part of my .htaccess ...
2
votes
1answer
231 views

How long does a CSRF token lasts?

I did at some point believe that the CSRF token my plugin requests was using expired in the middle of a request, but it turns out that they were never included in the first place. Still curious, I ...
2
votes
1answer
329 views

Delete CSRF cookie on submit form success

I need to delete the CRAFT_CSRF_TOKEN cookie when a form submission reaches certain/success page. I'm using CSRF stripped cookie's value to store entry title like this: {% set token = craft.request....
2
votes
1answer
437 views

“Purify HTML” on plain text fields

Recently we've had someone/something trying to perform a XSS attack using a form which saves all data into sessionStorage and then sends it to a custom craft plugin to pair it with a user. A solution ...
4
votes
1answer
200 views

What are useful guidelines for Craft CMS security on VPS (virtual private servers)?

We have the choice of engaging services like Forge and ServerPilot, or rolling our own. Besides pricing, the opacity of what the services are actually providing can be a question -- just how well do ...
0
votes
1answer
500 views

Problems Securing Database Connection Over SSL

I used to connect to my database over SSL by directly modifying the createDbConnection method in Craft's AppBehavior.php: $dbConnection = new DbConnection(); $dbConnection->connectionString = $...
2
votes
1answer
102 views

Any cloud providers hosting and securing Craft as a service

Are there any PaaS providers out there delivering Craft as a platform continuously updated and secured?
1
vote
1answer
62 views

Why is a “Brute Force Protection” dialog appearing on login? How to remove? [closed]

After successfully logging into admin I seem to be getting this message in a browser auth dialog: Brute force protection, Please use these credentials: User = 'u' and Password is the answer to 1+1” ...
2
votes
0answers
566 views

Content-Security-Policy Header vs. CSRF Token and login.html

My company would use the current version of the Content-Security-Policy header. We have problems with inline JavaScript and would not use MD5 checksums with the policy. Eg: CSRF Token support ...
3
votes
2answers
1k views

Is it safe to have PHP files in the public directory of a craft cms website?

I just ‘discovered’ that the developer on my client’s craft website has been migrating his old landing pages to the new setup by cramming the older static pages into the public directory instead of ...
9
votes
3answers
2k views

Creating partials outside of the templates folder

I'm interested in building a highly modular Craft site in which my folder structure might look something like this: - craft/ - modules/ - hero-banner/ index.html scripts.js styles....
2
votes
2answers
153 views

Restrict entry editing to category / topic

How can I implement security which allows members to only publish an entry in an assigned category / topic? Example: The site is a business directory. Business listings are published in cities: New ...
3
votes
2answers
693 views

Encrypt ID on front-end and decrypt on back-end

I have a front-end form that posts through the ID of a particular element/entry to a back-end controller. Is there any way to encrypt/hash that ID on the front-end, so the plain ID number is not ...
4
votes
1answer
715 views

Removing x-powered-by and changing cookies names for security?

I noticed that anyone interested in finding out what software is used for my website could find that out very easily just by looking at the headers and cookies received by craft. You can find two ...
3
votes
1answer
586 views

Is there a 2-factor auth plugin?

Is there a 2-factor authentication plugin for Craft? Or is there a way to secure the login for Craft CMS beyond the common installation instructions? I want to build a system that someone on a dynamic ...
3
votes
1answer
437 views

Login attempts limit

We've just had a security review of a client's site and one main issue raised is that a brute force attack would reveal the password if the username was guessable (ie "admin"). Could a limit on the ...
1
vote
1answer
108 views

Can we log both access & content changes?

If we implement CraftCMS, we would need logging of both access and publishing (both successful and failed attempts). The ability to change/remove those logs should not be available to those using the ...
1
vote
1answer
755 views

Can we use Active Directory for Access Control?

We have a quite elaborate set up for Active Directory, and would like to use this to provision & deprovision access to the Control Panel. Would this be possible in Craft core or in a plugin? Are ...
1
vote
1answer
85 views

How can I restrict access to the Control Panel to a single port?

Is it possible to limit access to the Control Panel to a specific HTTP port, which is shielded from public access? We want external visitors to only be able to access the front end site.
1
vote
3answers
152 views

Craft pieces accessed by people on domain only

How would you make portions of Craft available to only people that are "on the domain" and then let the rest of it be public facing? Would you need two instances of craft on 2 servers? One which is ...
3
votes
2answers
121 views

Is it possible to restrict access to a page based on a visitor's country?

Is it possible to restrict access to a page based on a visitor's country? For instance, only users in the US can view the FAQ page? Thanks!
2
votes
1answer
505 views

Restrict control panel by ip address?

Has anyone ever limited access to Craft's back-end via ip address? What paths should I limit if I'm wanting to ensure only certain ip addresses can post updates? Thanks!
1
vote
1answer
630 views

How should I set an arbitrary session value in a plugin?

I have some data I want to store in session: $data = array ( 'id' => '23539471' 'token' => 'cf310b81-9431-4303-804d-c1635ae29278' ); In my plugin I am doing this: new HttpCookie('...
1
vote
2answers
242 views

Is “Replace file” a potential security hole?

I am new to Craft, but have a lot of experience with other CMS systems. I have a very specific question about Assets. I have an intern who has been given access to a Craft site; for a particular ...
1
vote
1answer
960 views

Unable to retrieve a cookie set by another application on the same domain

We have a Laravel app that sets a cookie: public function make($name, $value, $minutes = 0, $path = null, $domain = null, $secure = false, $httpOnly = true) { list($path, $domain) = $this->...
0
votes
1answer
151 views

Protected Web Page

Is there a way to build a protected webpage within craft. Something that can only be accessed if you have the actual link. Something that you can not click to through the website. The point is to have ...
5
votes
1answer
459 views

Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

We've enabled CSRF Protection on a site. When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted. Things we've ...
2
votes
1answer
490 views

How do I test if Craft CSRF Protection is properly enabled?

Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "How do I enable CSRF protection?" Let's say we pull that all off without a ...
2
votes
1answer
258 views

Minimum database privileges for Craft front-end?

I'm wondering if it's possible to reduce the database user privileges required by Craft, to run just the front-end of the site. Currently, the requirements docs indicate that the MySQL user must have ...
58
votes
1answer
10k views

How secure is Craft and why is it secure?

What measures have been put in place in regards to securing Craft at the core level. What measures have been put in place in regards to Craft's Plugins which make use of (connect to if you will) Craft'...
0
votes
1answer
145 views

Define database details in index.php

I've got a multi-environment setup similar to the following, and thinking about adding database details to the index.php. In this way, I can pretty much just edit the index.php when creating new ...
6
votes
1answer
1k views

Password protect a single page

Is it possible to password protect a single page in Craft? Wordpress has this functionality built in. I would love to do it in Craft as well.
4
votes
2answers
113 views

Prevent users for assigning permissions

I want to control what users are able to do. For example, prevent access to the CP when the system is off. How can I prevent users for assigning extra permissions but still allow them to assign users ...
3
votes
1answer
184 views

Can I use Rich Text field on frontend safely?

I have done a commenting system based on entries. It works fine but I would like to allow to registered users to do basic formatting on their comments. What type of checking is done on the Rich Text ...