Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

The tag has no usage guidance.

2
votes
2answers
124 views

Does Craft Have a URL Rewrite Vulnerability?

We could use some help tracking down a consistent error on our Craft installs according to Acunetix Security Audits. URL Rewrite Vulnerability It was identified that this application supports the ...
1
vote
1answer
22 views

hashing form fields to prevent tampering

I have a front end form for entry creation. I have a few options I don't want tampered with. The docs for |hash say "Prefixes the given string with a keyed-hash message authentication code (HMAC), for ...
1
vote
2answers
92 views

Manually creating Security Key gives PHP error

I'm going on 5 days of banging my head on my desk here. I'm simply not getting how to install it on my production server. I have Craft working beautifully locally...but getting it to my server is a ...
0
votes
0answers
237 views

CSRF Cookie isn't getting set in certain browsers

Seems like Chrome (67) will not set the CSRF cookie, which breaks all of my ajax requests. The CSRF tokens are not cached This is still an issue when caching is turned off This works when CSRF is ...
1
vote
1answer
218 views

Craft 3 Database Backup

Why do I have to activate the PHP functions: "proc_open" and "proc_close" to backup the database? I got the error logs: [error][yii\base\Exception] yii\base\Exception: Could not create backup: ...
2
votes
1answer
556 views

Security Key and Boilerplate

We have set up a Craft 3 installation with composer to serve as boilerplate for a number of upcoming projects. The installation sits in a private git repository and the plan is to clone it when we ...
0
votes
1answer
92 views

Hiding Craft's admin folder from search engines

I am trying to hide our website's admin directory from public view as best as possible and have read the Securing Craft article. I am pleased at how easy it is to make a directory that isn't easy to ...
0
votes
0answers
27 views

Embedding Unity Web GL app with a WordPress backend

Our client has a 3D tour which has been in built by another developer in Unity and hosted on a separate server (http://tour.example.com). The tour features a membership platform. This is powered by ...
2
votes
1answer
36 views

Temporarily access to an entry

I have an entry that is currently password protected and I am looking for a way to give access to this entry to non-craft users temporarily access either by a token or something else. Anyone know how ...
1
vote
1answer
82 views

Does Craft CMS support 'encryption at rest' / 'data at rest' encryption?

Does Craft CMS support 'encryption at rest' / 'data at rest' encryption? I've looked here, here, and here - but can't find any info on this. Explain like I'm 5. Thanks.
5
votes
1answer
1k views

How to handle the SECURITY_KEY?

1) Where To Put It I’m wondering how I should proceed with the SECURITY_KEY which is now mandatory in Craft 3 (RC2). It has to be the same for one project, right? So it should be shared across ...
4
votes
1answer
147 views

Content Security Policy CSP

On Craft 2.x, is it a known limitation that we must allow unsafe-inline for script-src in the Content-Security-Policy? My admin dashboard fails to load when I don't allow it. ...Trying to get a high ...
1
vote
1answer
280 views

Adding reCAPTCHA to the admin login page

Is there any plugin or relatively straightforward and accepted way to add a recaptcha to the login for the admin page? My research so far has come up with nothing. I'm curious if others have looked ...
1
vote
1answer
206 views

How can I make Sprout Invisible Captcha plugin works using AJAX submission?

I set up a custom form template using Sprout Forms and added {{ craft.sproutInvisibleCaptcha.protect() }} inside the <form> tag. I can see there are several captcha tags added by the plugin, ...
1
vote
1answer
147 views

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

I'm using the MailChimp Subscribe for Craft plugin to embed several subscription forms on a website I'm building. The following code appears via my master _layout.html file: <form action="" ...
0
votes
2answers
788 views

Security Headers in htaccess Don't Work

We have an issue on our server when our Security Headers are not working. We added the following to our htaccess file after installing Craft CMS: - <IfModule mod_headers.c> Header always ...
1
vote
1answer
49 views

Is Craft's Email Service Protected Against Mail Header Injection Attacks?

We have a client website using Sprout Forms for a contact form. The client has queried a number of security topics with us, one of which is about Mail Header Injection attack protection (https://www....
1
vote
0answers
287 views

CSRF token creation and Content-Security-Policy header

I've just updated my site with setting my Content-Security-Policy Header and after fixing the slew of errors which popped up in the console, I am now down to one. The relevant part of my .htaccess ...
3
votes
1answer
195 views

How long does a CSRF token lasts?

I did at some point believe that the CSRF token my plugin requests was using expired in the middle of a request, but it turns out that they were never included in the first place. Still curious, I ...
2
votes
1answer
279 views

Delete CSRF cookie on submit form success

I need to delete the CRAFT_CSRF_TOKEN cookie when a form submission reaches certain/success page. I'm using CSRF stripped cookie's value to store entry title like this: {% set token = craft.request....
2
votes
1answer
384 views

“Purify HTML” on plain text fields

Recently we've had someone/something trying to perform a XSS attack using a form which saves all data into sessionStorage and then sends it to a custom craft plugin to pair it with a user. A solution ...
5
votes
1answer
192 views

What are useful guidelines for Craft CMS security on VPS (virtual private servers)?

We have the choice of engaging services like Forge and ServerPilot, or rolling our own. Besides pricing, the opacity of what the services are actually providing can be a question -- just how well do ...
0
votes
1answer
440 views

Problems Securing Database Connection Over SSL

I used to connect to my database over SSL by directly modifying the createDbConnection method in Craft's AppBehavior.php: $dbConnection = new DbConnection(); $dbConnection->connectionString = $...
2
votes
1answer
97 views

Any cloud providers hosting and securing Craft as a service

Are there any PaaS providers out there delivering Craft as a platform continuously updated and secured?
1
vote
1answer
59 views

Why is a “Brute Force Protection” dialog appearing on login? How to remove? [closed]

After successfully logging into admin I seem to be getting this message in a browser auth dialog: Brute force protection, Please use these credentials: User = 'u' and Password is the answer to 1+1” ...
2
votes
0answers
506 views

Content-Security-Policy Header vs. CSRF Token and login.html

My company would use the current version of the Content-Security-Policy header. We have problems with inline JavaScript and would not use MD5 checksums with the policy. Eg: CSRF Token support ...
3
votes
2answers
906 views

Is it safe to have PHP files in the public directory of a craft cms website?

I just ‘discovered’ that the developer on my client’s craft website has been migrating his old landing pages to the new setup by cramming the older static pages into the public directory instead of ...
8
votes
3answers
2k views

Creating partials outside of the templates folder

I'm interested in building a highly modular Craft site in which my folder structure might look something like this: - craft/ - modules/ - hero-banner/ index.html scripts.js styles....
3
votes
2answers
144 views

Restrict entry editing to category / topic

How can I implement security which allows members to only publish an entry in an assigned category / topic? Example: The site is a business directory. Business listings are published in cities: New ...
3
votes
2answers
635 views

Encrypt ID on front-end and decrypt on back-end

I have a front-end form that posts through the ID of a particular element/entry to a back-end controller. Is there any way to encrypt/hash that ID on the front-end, so the plain ID number is not ...
4
votes
1answer
614 views

Removing x-powered-by and changing cookies names for security?

I noticed that anyone interested in finding out what software is used for my website could find that out very easily just by looking at the headers and cookies received by craft. You can find two ...
4
votes
1answer
568 views

Is there a 2-factor auth plugin?

Is there a 2-factor authentication plugin for Craft? Or is there a way to secure the login for Craft CMS beyond the common installation instructions? I want to build a system that someone on a dynamic ...
3
votes
1answer
389 views

Login attempts limit

We've just had a security review of a client's site and one main issue raised is that a brute force attack would reveal the password if the username was guessable (ie "admin"). Could a limit on the ...
1
vote
1answer
103 views

Can we log both access & content changes?

If we implement CraftCMS, we would need logging of both access and publishing (both successful and failed attempts). The ability to change/remove those logs should not be available to those using the ...
1
vote
1answer
688 views

Can we use Active Directory for Access Control?

We have a quite elaborate set up for Active Directory, and would like to use this to provision & deprovision access to the Control Panel. Would this be possible in Craft core or in a plugin? Are ...
1
vote
1answer
83 views

How can I restrict access to the Control Panel to a single port?

Is it possible to limit access to the Control Panel to a specific HTTP port, which is shielded from public access? We want external visitors to only be able to access the front end site.
1
vote
3answers
146 views

Craft pieces accessed by people on domain only

How would you make portions of Craft available to only people that are "on the domain" and then let the rest of it be public facing? Would you need two instances of craft on 2 servers? One which is ...
3
votes
2answers
107 views

Is it possible to restrict access to a page based on a visitor's country?

Is it possible to restrict access to a page based on a visitor's country? For instance, only users in the US can view the FAQ page? Thanks!
2
votes
1answer
471 views

Restrict control panel by ip address?

Has anyone ever limited access to Craft's back-end via ip address? What paths should I limit if I'm wanting to ensure only certain ip addresses can post updates? Thanks!
1
vote
1answer
572 views

How should I set an arbitrary session value in a plugin?

I have some data I want to store in session: $data = array ( 'id' => '23539471' 'token' => 'cf310b81-9431-4303-804d-c1635ae29278' ); In my plugin I am doing this: new HttpCookie('...
1
vote
2answers
234 views

Is “Replace file” a potential security hole?

I am new to Craft, but have a lot of experience with other CMS systems. I have a very specific question about Assets. I have an intern who has been given access to a Craft site; for a particular ...
1
vote
1answer
866 views

Unable to retrieve a cookie set by another application on the same domain

We have a Laravel app that sets a cookie: public function make($name, $value, $minutes = 0, $path = null, $domain = null, $secure = false, $httpOnly = true) { list($path, $domain) = $this->...
0
votes
1answer
130 views

Protected Web Page

Is there a way to build a protected webpage within craft. Something that can only be accessed if you have the actual link. Something that you can not click to through the website. The point is to have ...
5
votes
1answer
428 views

Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

We've enabled CSRF Protection on a site. When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted. Things we've ...
2
votes
1answer
446 views

How do I test if Craft CSRF Protection is properly enabled?

Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "How do I enable CSRF protection?" Let's say we pull that all off without a ...
2
votes
1answer
245 views

Minimum database privileges for Craft front-end?

I'm wondering if it's possible to reduce the database user privileges required by Craft, to run just the front-end of the site. Currently, the requirements docs indicate that the MySQL user must have ...
58
votes
1answer
9k views

How secure is Craft and why is it secure?

What measures have been put in place in regards to securing Craft at the core level. What measures have been put in place in regards to Craft's Plugins which make use of (connect to if you will) Craft'...
0
votes
1answer
144 views

Define database details in index.php

I've got a multi-environment setup similar to the following, and thinking about adding database details to the index.php. In this way, I can pretty much just edit the index.php when creating new ...
6
votes
1answer
1k views

Password protect a single page

Is it possible to password protect a single page in Craft? Wordpress has this functionality built in. I would love to do it in Craft as well.
4
votes
2answers
111 views

Prevent users for assigning permissions

I want to control what users are able to do. For example, prevent access to the CP when the system is off. How can I prevent users for assigning extra permissions but still allow them to assign users ...