Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

The tag has no usage guidance.

2
votes
2answers
234 views

Does Craft Have a URL Rewrite Vulnerability?

We could use some help tracking down a consistent error on our Craft installs according to Acunetix Security Audits. URL Rewrite Vulnerability It was identified that this application supports the ...
1
vote
1answer
24 views

hashing form fields to prevent tampering

I have a front end form for entry creation. I have a few options I don't want tampered with. The docs for |hash say "Prefixes the given string with a keyed-hash message authentication code (HMAC), for ...
1
vote
2answers
113 views

Manually creating Security Key gives PHP error

I'm going on 5 days of banging my head on my desk here. I'm simply not getting how to install it on my production server. I have Craft working beautifully locally...but getting it to my server is a ...
1
vote
1answer
288 views

Craft 3 Database Backup

Why do I have to activate the PHP functions: "proc_open" and "proc_close" to backup the database? I got the error logs: [error][yii\base\Exception] yii\base\Exception: Could not create backup: ...
2
votes
1answer
713 views

Security Key and Boilerplate

We have set up a Craft 3 installation with composer to serve as boilerplate for a number of upcoming projects. The installation sits in a private git repository and the plan is to clone it when we ...
0
votes
1answer
105 views

Hiding Craft's admin folder from search engines

I am trying to hide our website's admin directory from public view as best as possible and have read the Securing Craft article. I am pleased at how easy it is to make a directory that isn't easy to ...
2
votes
1answer
37 views

Temporarily access to an entry

I have an entry that is currently password protected and I am looking for a way to give access to this entry to non-craft users temporarily access either by a token or something else. Anyone know how ...
1
vote
1answer
91 views

Does Craft CMS support 'encryption at rest' / 'data at rest' encryption?

Does Craft CMS support 'encryption at rest' / 'data at rest' encryption? I've looked here, here, and here - but can't find any info on this. Explain like I'm 5. Thanks.
5
votes
1answer
1k views

How to handle the SECURITY_KEY?

1) Where To Put It I’m wondering how I should proceed with the SECURITY_KEY which is now mandatory in Craft 3 (RC2). It has to be the same for one project, right? So it should be shared across ...
5
votes
1answer
168 views

Content Security Policy CSP

On Craft 2.x, is it a known limitation that we must allow unsafe-inline for script-src in the Content-Security-Policy? My admin dashboard fails to load when I don't allow it. ...Trying to get a high ...
1
vote
1answer
308 views

Adding reCAPTCHA to the admin login page

Is there any plugin or relatively straightforward and accepted way to add a recaptcha to the login for the admin page? My research so far has come up with nothing. I'm curious if others have looked ...
1
vote
1answer
225 views

How can I make Sprout Invisible Captcha plugin works using AJAX submission?

I set up a custom form template using Sprout Forms and added {{ craft.sproutInvisibleCaptcha.protect() }} inside the <form> tag. I can see there are several captcha tags added by the plugin, ...
1
vote
1answer
164 views

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

I'm using the MailChimp Subscribe for Craft plugin to embed several subscription forms on a website I'm building. The following code appears via my master _layout.html file: <form action="" ...
0
votes
2answers
840 views

Security Headers in htaccess Don't Work

We have an issue on our server when our Security Headers are not working. We added the following to our htaccess file after installing Craft CMS: - <IfModule mod_headers.c> Header always ...
1
vote
1answer
51 views

Is Craft's Email Service Protected Against Mail Header Injection Attacks?

We have a client website using Sprout Forms for a contact form. The client has queried a number of security topics with us, one of which is about Mail Header Injection attack protection (https://www....
1
vote
0answers
309 views

CSRF token creation and Content-Security-Policy header

I've just updated my site with setting my Content-Security-Policy Header and after fixing the slew of errors which popped up in the console, I am now down to one. The relevant part of my .htaccess ...
3
votes
1answer
212 views

How long does a CSRF token lasts?

I did at some point believe that the CSRF token my plugin requests was using expired in the middle of a request, but it turns out that they were never included in the first place. Still curious, I ...
2
votes
1answer
301 views

Delete CSRF cookie on submit form success

I need to delete the CRAFT_CSRF_TOKEN cookie when a form submission reaches certain/success page. I'm using CSRF stripped cookie's value to store entry title like this: {% set token = craft.request....
2
votes
1answer
405 views

“Purify HTML” on plain text fields

Recently we've had someone/something trying to perform a XSS attack using a form which saves all data into sessionStorage and then sends it to a custom craft plugin to pair it with a user. A solution ...
5
votes
1answer
197 views

What are useful guidelines for Craft CMS security on VPS (virtual private servers)?

We have the choice of engaging services like Forge and ServerPilot, or rolling our own. Besides pricing, the opacity of what the services are actually providing can be a question -- just how well do ...
0
votes
1answer
472 views

Problems Securing Database Connection Over SSL

I used to connect to my database over SSL by directly modifying the createDbConnection method in Craft's AppBehavior.php: $dbConnection = new DbConnection(); $dbConnection->connectionString = $...
2
votes
1answer
100 views

Any cloud providers hosting and securing Craft as a service

Are there any PaaS providers out there delivering Craft as a platform continuously updated and secured?
1
vote
1answer
60 views

Why is a “Brute Force Protection” dialog appearing on login? How to remove? [closed]

After successfully logging into admin I seem to be getting this message in a browser auth dialog: Brute force protection, Please use these credentials: User = 'u' and Password is the answer to 1+1” ...
2
votes
0answers
532 views

Content-Security-Policy Header vs. CSRF Token and login.html

My company would use the current version of the Content-Security-Policy header. We have problems with inline JavaScript and would not use MD5 checksums with the policy. Eg: CSRF Token support ...
3
votes
2answers
964 views

Is it safe to have PHP files in the public directory of a craft cms website?

I just ‘discovered’ that the developer on my client’s craft website has been migrating his old landing pages to the new setup by cramming the older static pages into the public directory instead of ...
9
votes
3answers
2k views

Creating partials outside of the templates folder

I'm interested in building a highly modular Craft site in which my folder structure might look something like this: - craft/ - modules/ - hero-banner/ index.html scripts.js styles....
3
votes
2answers
148 views

Restrict entry editing to category / topic

How can I implement security which allows members to only publish an entry in an assigned category / topic? Example: The site is a business directory. Business listings are published in cities: New ...
3
votes
2answers
655 views

Encrypt ID on front-end and decrypt on back-end

I have a front-end form that posts through the ID of a particular element/entry to a back-end controller. Is there any way to encrypt/hash that ID on the front-end, so the plain ID number is not ...
4
votes
1answer
661 views

Removing x-powered-by and changing cookies names for security?

I noticed that anyone interested in finding out what software is used for my website could find that out very easily just by looking at the headers and cookies received by craft. You can find two ...
4
votes
1answer
577 views

Is there a 2-factor auth plugin?

Is there a 2-factor authentication plugin for Craft? Or is there a way to secure the login for Craft CMS beyond the common installation instructions? I want to build a system that someone on a dynamic ...
3
votes
1answer
408 views

Login attempts limit

We've just had a security review of a client's site and one main issue raised is that a brute force attack would reveal the password if the username was guessable (ie "admin"). Could a limit on the ...
1
vote
1answer
105 views

Can we log both access & content changes?

If we implement CraftCMS, we would need logging of both access and publishing (both successful and failed attempts). The ability to change/remove those logs should not be available to those using the ...
1
vote
1answer
729 views

Can we use Active Directory for Access Control?

We have a quite elaborate set up for Active Directory, and would like to use this to provision & deprovision access to the Control Panel. Would this be possible in Craft core or in a plugin? Are ...
1
vote
1answer
83 views

How can I restrict access to the Control Panel to a single port?

Is it possible to limit access to the Control Panel to a specific HTTP port, which is shielded from public access? We want external visitors to only be able to access the front end site.
1
vote
3answers
150 views

Craft pieces accessed by people on domain only

How would you make portions of Craft available to only people that are "on the domain" and then let the rest of it be public facing? Would you need two instances of craft on 2 servers? One which is ...
3
votes
2answers
112 views

Is it possible to restrict access to a page based on a visitor's country?

Is it possible to restrict access to a page based on a visitor's country? For instance, only users in the US can view the FAQ page? Thanks!
2
votes
1answer
489 views

Restrict control panel by ip address?

Has anyone ever limited access to Craft's back-end via ip address? What paths should I limit if I'm wanting to ensure only certain ip addresses can post updates? Thanks!
1
vote
1answer
594 views

How should I set an arbitrary session value in a plugin?

I have some data I want to store in session: $data = array ( 'id' => '23539471' 'token' => 'cf310b81-9431-4303-804d-c1635ae29278' ); In my plugin I am doing this: new HttpCookie('...
1
vote
2answers
238 views

Is “Replace file” a potential security hole?

I am new to Craft, but have a lot of experience with other CMS systems. I have a very specific question about Assets. I have an intern who has been given access to a Craft site; for a particular ...
1
vote
1answer
891 views

Unable to retrieve a cookie set by another application on the same domain

We have a Laravel app that sets a cookie: public function make($name, $value, $minutes = 0, $path = null, $domain = null, $secure = false, $httpOnly = true) { list($path, $domain) = $this->...
0
votes
1answer
132 views

Protected Web Page

Is there a way to build a protected webpage within craft. Something that can only be accessed if you have the actual link. Something that you can not click to through the website. The point is to have ...
5
votes
1answer
442 views

Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

We've enabled CSRF Protection on a site. When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted. Things we've ...
2
votes
1answer
463 views

How do I test if Craft CSRF Protection is properly enabled?

Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "How do I enable CSRF protection?" Let's say we pull that all off without a ...
2
votes
1answer
255 views

Minimum database privileges for Craft front-end?

I'm wondering if it's possible to reduce the database user privileges required by Craft, to run just the front-end of the site. Currently, the requirements docs indicate that the MySQL user must have ...
58
votes
1answer
9k views

How secure is Craft and why is it secure?

What measures have been put in place in regards to securing Craft at the core level. What measures have been put in place in regards to Craft's Plugins which make use of (connect to if you will) Craft'...
0
votes
1answer
144 views

Define database details in index.php

I've got a multi-environment setup similar to the following, and thinking about adding database details to the index.php. In this way, I can pretty much just edit the index.php when creating new ...
6
votes
1answer
1k views

Password protect a single page

Is it possible to password protect a single page in Craft? Wordpress has this functionality built in. I would love to do it in Craft as well.
4
votes
2answers
112 views

Prevent users for assigning permissions

I want to control what users are able to do. For example, prevent access to the CP when the system is off. How can I prevent users for assigning extra permissions but still allow them to assign users ...
3
votes
1answer
182 views

Can I use Rich Text field on frontend safely?

I have done a commenting system based on entries. It works fine but I would like to allow to registered users to do basic formatting on their comments. What type of checking is done on the Rich Text ...
5
votes
1answer
124 views

Is it Possible to Assign Permissions Within a Content Structure

I'd like to be able to assign permissions to content or sections of content within a structure. For example, if I have a structure modeled around an organization and there are several departments ...