Please consider adding an easily accessible and visible place for security issues with Drupal. One such thing could be a new project, e.g. http://drupal.org/project/security or a special forum or a simple page, whatever.

IMHO there should be a single (easily accessible and easy to find) place on drupal.org where users can check back now and then and always find the latest security-related announces and patches.

E.g. if an XSS attack or SQL injection vulnerability etc. is found in Drupal (or a Drupal module), there should be an announcement on that page and information/patches on how to fix them, as well as information under which circumstances you are vulnerable, which versions of Drupal are vulnerable and which are not etc. etc.

I also suggest to add a "tab" (such as "Downloads" or "Handbook") in the upper rigth menu on drupal.org which reads "Security" which should make it visible enough for users to easily find that page/project/forum...

I have no real reason for this at the moment (i.e. I know no security holes in Drupal at the moment), BUT we should arrange for a central place to announce security issues/patches BEFORE anything happens, IMHO.

Oh yes, another nice thing would be to allow users to file issues if they think they have found a security issue. This should also happen in the "Security" area.

Thanks for considering.

P.S. I'm working on a security.module whose intent it is to give a site administrator a single place for security-relevant information/settings. E.g. it'll show your PHP/MySQL/Apache versions, OS version, Drupal version etc., safe_mode on/off, open_basedir settings etc.
Also, it could list potentially dangerous events from watchdog (e.g. occurences of ../../passwd in URLs), show you world-readable directories/files within your Drupal directory etc.
I have a longish TODO-list with ideas of what could be done. If you have any suggestions, please post them here until the module is available from cvs and a project has been created. Thanks.

I'll checkin a first version of the module in a few days, stay tuned!

Comments

bryan kennedy’s picture

bryan kennedy commented

The new security email option in the contact form covers some of this issue. Do people think a full security project or page is important?

bryan kennedy’s picture

bryan kennedy commented

Sorry, this is a link to thh new security contact form discussion:
http://drupal.org/node/21210

killes@www.drop.org’s picture

killes@www.drop.org commented

Good enough for the time being.

Anonymous’s picture

(not verified) commented
beginner’s picture

beginner commented
Priority: Normal » Critical

There are two issues here.

One is being able to contact someone in case we find out about a new security issue. This is already dealt with.

Another one is for users to find out whether their current installation is sucure. Currently, there's no easy way (or even hard way) to be sure that our current installation includes all the security patches.

I support Uwe's request and hope it can be implemented soon.

beginner’s picture

beginner commented

and please, let there be a 'security policy' in place, i.e. what shoul be considered as a security issue (I'm sorry to see that a full path disclosure is regarded as a non-issue for some senior Drupal developpers: http://drupal.org/node/22872 ), and what measures are to be taken how soon in case a new security loophole has been found.

There could (should?) be a 'security' level above 'critical' in the Priority pull down menu.

venkat-rk’s picture

venkat-rk commented

I think having a separate page or project and the security.module is a very good idea. For some reason, security seems to be the least discussed aspect of Drupal and I completely agree with Uwe Hermann that it should be discussed and something done *before* something happens. Being pro-active is always good.

The module ideas seem particularly good too.

quux’s picture

quux commented

Having had my Drupal system hacked via the XMLRPC thing, I'd say Uwe was right on the money almost a year ago! I would love to see:

-Some sort of security policy as beginner has mentioned. Let it be something that evolves, but let it be written down for all to see.
-A page devoted to security issues - with an RSS feed and maybe a 'subscribe to' link for email notification of changes. http://drupal.org/node/22238
-Some administrative way to determine what version of Drupal is running.

Bèr Kessels’s picture

Bèr Kessels commented

the easiest would be to create a taxonomy term called "security". we get all the rest of the features for free.

dries’s picture

dries commented

I'll take care of this in the next few weeks. There is a dependency on simplenews module but it's shaping up nicely.

benshell’s picture

benshell commented

Any progress with this? Last night I had one of my sites hacked that was still running un-patched Drupal 4.5 code. I had made a lot of changes to the core, and I was using features like the personal image galleries and reoccuring events (using a patch someone contributed) that aren't available for Drupal 4.6, so I was hoping to get away with waiting until 4.7 to upgrade. It could have been worse though. All they did was replace the index.php file. However, I'm curious how this was possible? Wouldn't they need FTP access to do this? You can't do this by logging into Drupal as the administrator.

Uwe Hermann’s picture

Uwe Hermann commented

Not performing security updates immediately is always a bad idea. They most probably exploited one of the XML-RPC flaws which were fixed a while ago... The security advisory clearly said that you can simply delete xmlrpc.php if you cannot upgrade immediately.

Further work on security infrastructure is underway, stay tuned...

chx’s picture

chx commented
Status: Active » Fixed

http://drupal.org/security to read security issues, contact form and security@drupal.org to submit issues.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)