Modules: Security
Contributed (contrib) modules are plugins for Drupal that extend, build or enhance Drupal core functionality. Use matching versions (modules released for Drupal 5.x will not work for Drupal 6.x). Contributed modules are not part of Drupal core releases and may or may not have optimized code/functionality. If a module solves your needs please consider joining forces and helping the maintainer.
Administer Users by Role
Allows users with 'administer users' permission and a role (specified in 'Access control') to edit and/or delete other users with a specified role.
If the user being edited has multiple roles, the user doing the editing must have permission to edit ALL of the user being edited's roles.
Also provides role-based control over user creation.
Works well in conjunction with the (optional) role_delegation module.
I wrote this module as part of a Kosada Inc development project --- this allows us to further delegate user administration. Site administrators can now create users without being given full "administer users" permission, and can edit a specified subset of the site's users depending on the combination of roles possessed by the editing user and the user being edited.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-0.9 | 2008-Mar-16 | Download · Release notes | Recommended for 5.x |  |
Advanced User
Details
The advanced user module allows the filtering of users based on the user.module fields and optionally the profile.module fields. The fields available for filtering can be configured using the module settings. Eg. Site admin may search through 1000s of users to display all users who have not accessed their account.
Once the group of users with selected common denominators are filtered, the module can be used to perform functions that email, block, unblock, add or remove roles, or delete. Another nice feature is the ability to notify administrators or other roles, by email, of user account creation or profile changes.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-2.x-dev | 2008-May-16 | Download · Release notes | Development snapshot |  |
AES encryption
In short, here's what this module does:
For site owners:
This module can provide you with readable passwords. Some users will be able to see other users passwords in plain text if they have a role with the permission to do so.
For developers:
This module can provide you with a very simple and easy to use encryption API. Just check out the aes_encrypt and aes_decrypt functions. It really can't get any simpler.
Note: This module requires the PHP mcrypt extension! It will not work without it.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.3 | 2008-Apr-01 | Download · Release notes | Recommended for 6.x | |
| 5.x-1.2 | 2007-Dec-06 | Download · Release notes | Recommended for 5.x | |
AntiSpam PWF Captcha
AntiSpam Protect Web Form Captcha Plug-in for Drupal
supports English, German, French, Spanish, Russian localization.
Customize your CAPTCHA with desired colors and fonts. Chose among many image types.
Add reload button and audio support.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.3 | 2007-Dec-14 | Download · Release notes | Recommended for 5.x | |
Bad Behavior
Bad Behavior is a set of PHP scripts which prevents spambots from accessing your site by analyzing their actual HTTP requests and comparing them to profiles from known spambots. It goes far beyond User-Agent and Referer, however.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.0-rc2 | 2008-Apr-09 | Download · Release notes | Recommended for 6.x | |
| 5.x-2.0-beta1 | 2008-Apr-07 | Download · Release notes | Recommended for 5.x | |
| 4.7.x-1.x-dev | 2006-Nov-13 | Download · Release notes | Development snapshot | |
Block anonymous links
BlockAnonymousLinks is a simple module which blocks comments from anonymous users that contain links.
It relies on the fact that most spam messages contain hyperlinks and also on the fact that (for now) (most) spambots don't register on the sites they want to spam. It tries to block comment-spam at an early stage.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.0 | 2008-Mar-14 | Download · Release notes | Recommended for 6.x | |
| 5.x-1.1 | 2008-Mar-14 | Download · Release notes | Recommended for 5.x | |
Blogstamp
This module acts as a digital notary for Drupal; it creates notarized/certified timestamps for content. When normal Drupal content is created, an easily modifiable timestamp is created. It is impossible to tell with any real certainity whether or not the node was created at that time. A certified timestamp guarantees the content was created on the timestamp indicated.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.x-dev | 2007-Mar-18 | Download · Release notes | Development snapshot | |
| 4.7.x-1.x-dev | 2007-Mar-18 | Download · Release notes | Development snapshot | |
CAPTCHA
A CAPTCHA is a challenge-response test most often placed within web forms to determine whether the user is human. The purpose of CAPTCHA is to block form submissions from spambots – automated scripts that harvest email address from publicly available web forms.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.0-rc2 | 2008-Apr-11 | Download · Release notes | Recommended for 6.x | |
| 5.x-3.1 | 2007-Dec-03 | Download · Release notes | Recommended for 5.x | |
| 4.7.x-1.2 | 2007-Jan-30 | Download · Release notes | Recommended for 4.7.x | |
Captcha Riddler
Requires Captcha
Inspired by this discussion and the fact that many Drupal pages are plagued with endless amounts of spam. While modules like akismet and spam offer a great way of filtering the spam after it's being submitted the purpose of Riddler is to compliment these modules by catching it before it gets submitted.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-3.1 | 2008-Mar-28 | Download · Release notes | Recommended for 5.x | |
Comment Mail
The Comment Mail module allows an email to be sent to the site administrator(s) when new comments are posted. A link in the email allows quick approval, editing, deletion, and/or banning of the poster's IP address.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-0.1 | 2007-Jul-25 | Download · Release notes | Recommended for 5.x | |
| 4.7.x-1.x-dev | 2006-Nov-13 | Download · Release notes | Development snapshot | |
Embed filter
Many great sites like YouTube, iFilm and NowPublic allow their media assets to be served to 3rd party websites (like this one). They usually offer snippets of code to be embedded in a web page that will then load a media object (usually Flash) from their servers. This module lets your site users embed such snippets into posts but gives you the power to decide which hosts to trust.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.0 | 2007-May-21 | Download · Release notes | Recommended for 5.x | |
| 4.7.x-1.x-dev | 2007-Sep-25 | Download · Release notes | Development snapshot | |
Form single
Announcement: There is no good server-side solution for this problem in Drupal 5 or Drupal 6. Your best option is Ted Serbinski's JS solution: http://tedserbinski.com/2007/01/11/how_to_prevent_duplicate_posts
This module is seeking a maintainer. Contact me if interested.
http://drupal.org/files/issues/t_6.patch
Any efforts to backport this patch to 4.7 would be greatly appreciated. To read about the final soultion that was achieved, read here:
The Formsingle module prevents forms in Drupal 4.7 from being submitted twice. Try this; with your Drupal 4.7 installation, create a new page, or submit a new comment. When it comes time to press the submit button, click it as many times as you can before the page reloads. Can you click it 50 times? 100 times? Does Drupal submit a new page or comment for every single click? You bet! This module fixes that.
As this is a new module and totally untested in the real world, I highly recommend NOT installing it on live sites. Please test this module, examine the code, provide feedback, and hopefully soon we'll have a solid tool to provide this (critical) feature.
See the Roadmap issue in the issue tracker for an overview of tasks and future directions for this module.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.x-dev | 2007-Jan-29 | Download · Release notes | Development snapshot | |
| 4.7.x-1.x-dev | 2006-Nov-30 | Download · Release notes | Development snapshot | |
Global Redirect
What?
GlobalRedirect is a simple module which…
- Checks the current URL for an alias and does a 301 redirect to it if it is not being used.
- Checks the current URL for a trailing slash, removes it if present and repeats check 1 with the new request.
- Checks if the current URL is the same as the
site_frontpageand redirects to the frontpage if there is a match. - Checks if the Clean URLs feature is enabled and then checks the current URL is being accessed using the clean method rather than the 'unclean' method. (Currently only in DEV, will be in 1.3 soon)
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.x-dev | 2007-Dec-30 | Download · Release notes | Development snapshot | |
| 5.x-1.2 | 2007-Dec-28 | Download · Release notes | Recommended for 5.x | |
| 4.7.x-1.2-1 | 2007-Apr-26 | Download · Release notes | Recommended for 4.7.x | |
Google Proxy Hacking Protector
In Dan Thies' great post about the method "Google Proxy Hacking" at
http://www.seofaststart.com/blog/google-proxy-hacking
he illustrates how an (evil) third party can remove your site from the Google
search results.
One actual example of the application of this black hat SEO tactic
for Google bowling my own company site out the results is illustrated here
http://www.marketingfan.com/search-engines/google-proxy-bowling
Obivously this screams for a solution and Dan and Jamie already presented some methods
for doing that.
The project "antiproxyhack" implements these as a convenient drupal module
for all drupal users of version 5.x and upwards (we are considering a backport to 4.7 too, but want to get new sites updated first!)
Please use the CVS or dev version until v1.2! Thanks!
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.2 | 2007-Oct-29 | Download · Release notes | Recommended for 5.x | |
GoogleVerify
Small module to make using the Google Webmaster Tools site verification easier. Works with both the Meta Tag and the Upload File methods.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 4.7.x-1.x-dev | 2006-Nov-13 | Download · Release notes | Development snapshot | |
Gotcha - Contact Spam Catcher
Gotcha is sort of a take off on "captcha." The idea was first mentioned on http://drupal.org/node/166921 as a possible way to trick spam bots who try to use the Drupal contact form. I don't particulary like the extra step humans are required to perform in these "verification" methods, and some just don't work.
The idea is simple: Basically you place a bogus input field on a contact form, and use CSS to not display it. On submission you check for a value. If there is a value entered, then that means a non-human has been blanketing form fields, and the form post can be ignored as spam. The spam bot will probably never know.
Gotcha adds a field labeled "Subject" at the top of the contact form. It uses a "div" tag to render the field as "display: none" so human users shouldn't see it, and won't enter any data there. Hopefully, the suspected spam bot will see "Subject" and be enticed to enter something there. There is descriptive text to encourage a human (whose browser might be set to display it anyway) to ignore this field.
Gotcha intercepts the contact form submission and checks the hidden field. If something is there, Gotcha simply returns to the front page and ignores the message. The attempt is logged, along with the submitter's IP address, and the suspect message is saved in the database. If the field is empty, then the message is passed on through to the contact module for normal processing.
Unfortunately, most of the spam was still getting through. And most of that was a bunch of links to drugs or porn. From exerience, I knew that the Spam module was already good at dealing with this in comments. After browsing that module, I found that I could "hook" into its filters and use them to identify spam.
All of my spam emails stopped immediately!
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.0 | 2007-Nov-17 | Download · Release notes | Recommended for 5.x | |
GTSpam
The GlobalTEK GTSpam module obfuscates email addresses to help prevent spambots from collecting them, without loosing the mailto URL scheme default semantics and operations (see RFC 2368).
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-0.4 | 2007-Oct-02 | Download · Release notes | Recommended for 5.x | |
Hashcash
Hashcash is a module which implements the Hashcash algorithm to help protect sites from spam. This module is similar to the popular wordpress plugin wp-hashcash.
Administrators are able to specify which roles need to pass a Hashcash check, and also which forms should have the hashcash check inserted into them
This is the first release of Hashcash, so any feedback would be greatly appreciated
The development of this module has been funded in part by the EDIT project
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.2 | 2008-Apr-23 | Download · Release notes | Recommended for 5.x | |
htmLawed
The htmLawed module enables the use of the htmLawed (X)HTML filter/purifier PHP script in input format-, node (content) type-, body/teaser/comment-specific configurations.
Its speed and high configurability as well as its coverage of entire HTML (including elements like script, form and embed, CDATA sections, HTML comments, etc.) sets htmLawed apart from the in-built Drupal filter as well as many other filters that require external applications like HTML Tidy or use large resource-intensive libraries like HTMLPurifier.
The highly-customizable htmLawed filter can be used to make text with HTML markup more secure, and HTML standards- and admin-compliant. It can auto-correct HTML markup and restrict HTML elements (tags), attributes, and URL protocols in the input. It also balances tags and checks for proper nesting of the HTML elements. Furthermore, it can transform deprecated tags, check and convert character entities (e.g., from hexadecimal to decimal type), obfuscate email addresses as an anti-spam measure, etc.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.2 | 2008-May-11 | Download · Release notes | Recommended for 6.x | |
| 5.x-1.8 | 2008-May-11 | Download · Release notes | Recommended for 5.x | |
http:BL
Implementation of http:BL for Drupal. It provides IP-based blacklisting through http:BL and allows linking to a honeypot. http:BL allows blocking of email harvesters and comment spammers through a centralized DNS blacklist. See http://www.projecthoneypot.org/httpbl.php for more information.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-2.1 | 2008-Apr-29 | Download · Release notes | Recommended for 5.x | |
IP anonymizer
Stale IP addresses clog up your database with useless data, not to mention, may be subject to subpoena by legal authorities in some jurisdictions.
The IP anonymizer module helps ensure users' privacy by establishing a retention policy for IP addresses logged in Drupal's database tables. IP addresses are scrubbed on each cron run according to a configurable retention period. For example, you may wish to preserve IP addresses for a short while for purposes of identifying spam.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.0 | 2008-Mar-31 | Download · Release notes | Recommended for 6.x | |
Login Security
With Login security a site administrator may add two types of access control to the login forms (default and block) within a defined time window.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.x-dev | 2008-Jan-21 | Download · Release notes | Development snapshot | |
| 5.x-1.1 | 2008-Jan-24 | Download · Release notes | Recommended for 5.x | |
OG User Roles
Note: This module does not work with OG versions 5.7.2 and above!
The OG contributor has made some modifications to it's code since the last OGR release that appears to affect some OGR functionality. Will advise when an update is available. http://drupal.org/node/258976
This module allows you to assign group-specific roles to users which are restricted to the groups they are in. In other words, using this module, you can assign the role "contributor" to a user in a group, and the user will only have the permissions of that role while he is in that particular group.
OGR (OG User Roles) does NOT override existing site-wide roles. Any site-wide roles assigned to a user are not affected by OGR. This module simply allows you to add group-specific roles to a user's profile. See: http://drupal.org/node/189164
Requires og.module (og_forum.module no longer required as of Release 5.x-2.4).
Read the history of this module: http://drupal.org/node/87679
Other features of this module allow you to:
- Assign a default role to all new users who sign up to your site.
- Allow group admins to define default roles for signups to their groups. http://drupal.org/node/177414
- Notify group admin of new group subscribers. Requires mimemail.module.
- Set a default "Founder" group role for users who create groups.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-3.1 | 2008-May-11 | Download · Release notes | Recommended for 5.x | |
OpenID URL
Allows you to delegate your URL as an OpenID. This prevents your from having to run your own OpenID server while allowing you to harness your URL as an OpenID. If you switch OpenID Providers, just switch your settings in the module. This is based on this article which covers the topic in more depth.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.3 | 2008-Mar-09 | Download · Release notes | Recommended for 6.x | |
| 5.x-1.3 | 2008-Mar-09 | Download · Release notes | Recommended for 5.x | |
| 4.7.x-1.0 | 2006-Dec-12 | Download · Release notes | Recommended for 4.7.x | |
Organic groups
Enable users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| HEAD | 2008-May-09 | Download · Release notes | Development snapshot | |
| 5.x-7.2 | 2008-May-12 | Download · Release notes | Recommended for 5.x | |
Organic Groups Sites
Together, og_sites_hub and og_sites provide multisite functionality in which a central 'hub' site has a set of associated sites leveraging Organic Groups functionality to selectively share data (nodes and users), such that the hub site has access to all data while associated sites see and edit only their own data plus that specifically shared by the hub site.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.x-dev | 2007-Jun-19 | Download · Release notes | Development snapshot | |
Paranoia
paranoia.module is for all the good sysadmins out there who think that allowing random CMS admins to execute PHP of their choice is not a safe idea.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.0 | 2007-May-24 | Download · Release notes | Recommended for 5.x | |
| 4.7.x-1.x-dev | 2006-Nov-13 | Download · Release notes | Development snapshot | |
Password policy
This module provides a way to specify a certain level of password complexity (aka. "password hardening") for user passwords on a system by defining a password policy.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 6.x-1.x-dev | 2008-Feb-13 | Download · Release notes | Development snapshot | |
| 4.7.x-1.x-dev | 2007-Jan-03 | Download · Release notes | Development snapshot | |
Password reset
The password_reset module allows for passwords to be reset without involving e-mail addresses through the use of security questions. This module would typically be used on sites that do not require users to enter their e-mail addresses or prefer not having to deal with spam folder issues etc.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.1-beta | 2008-Mar-30 | Download · Release notes | Recommended for 5.x | |
Password Strength
This module provides a backport of Drupal 6's jQuery password strength checking to Drupal 5. It also adds PHP-based password strength checking and validation routines that mirror the jQuery routines, so that administrators can restrict passwords to only be, for example, "high" strength. The module simply modifies existing password confirm fields (where two passwords are entered, like the user edit form), so no other setup is required beyond configuring the desired enforcement rules.
| Version | Date | Links | Status | |
|---|---|---|---|---|
| 5.x-1.2 | 2008-Apr-06 | Download · Release notes | Recommended for 5.x | |