1

)

i am a newbe with drupal7=>civicrm and found by chance an "open door" probably dynamically genrated by ajax:

=> https://{our domain}/crm/civicrm/ajax/l10n-js/ The browser shows this:

*// http://civicrm.org/licensing // Generated 17 May 2021 14:28:02 (function($) { // Config settings CRM.config.userFramework = "Drupal"; CRM.config.resourceBase = "https://machmit.aufstehen.de/crm/sites/all/modules/civicrm/"; CRM.config.packagesBase = "https://machmit.aufstehen.de/crm/sites/all/modules/civicrm/packages/"; CRM.config.lcMessages = "de_DE"; CRM.config.locale = "de_DE"; CRM.config.cid = 15944; $.datepicker._defaults.dateFormat = CRM.config.dateInputFormat = "mm/dd/yy"; CRM.config.timeIs24Hr = false; CRM.config.ajaxPopupsEnabled = true; CRM.config.allowAlertAutodismissal = true; CRM.config.resourceCacheCode = "JfC51"; // Merge entityRef settings CRM.config.entityRef = $.extend({}, {"filters":{"Contact":[{"key":"contact_type","value":"Kontaktart"},{"key":"group","value":"Gruppe","entity":"GroupContact"},{"key":"tag","value":"Tag","entity":"EntityTag"},{"key":"city","value":"Stadt","type":"text","entity":"Address"},{"key":"postal_code","value":"Postleitzahl","type":"text","entity":"Address"},{"key":"state_province","value":"Bundesland","entity":"Address"},{"key":"country","value":"Land","entity":"Address"},{"key":"first_name","value":"Vorname","type":"text","condition":{"contact_type":"Individual"}},{"key":"last_name","value":"Nachname","type":"text","condition":{"contact_type":"Individual"}},{"key":"nick_name","value":"Nick Name","type":"text","condition":{"contact_type":"Individual"}},{"key":"organization_name","value":"Employer name","type":"text","condition":{"contact_type":"Individual"}},{"key":"gender_id","value":"Geschlecht","condition":{"contact_type":"Individual"}},{"key":"is_deceased","value":"Verstorben","condition":{"contact_type":"Individual"}},{"key":"contact_id","value":"CiviCRM ID","type":"text"},{"key":"external_identifier","value":"Externe ID","type":"text"},{"key":"source","value":"Bezugsquelle","type":"text"}],"Email":{"0":{"key":"contact_id.contact_type","value":"Kontaktart","entity":"Contact"},"7":{"key":"contact_id.first_name","value":"Vorname","type":"text","condition":{"contact_type":"Individual"},"entity":"Contact"},"8":{"key":"contact_id.last_name","value":"Nachname","type":"text","condition":{"contact_type":"Individual"},"entity":"Contact"},"9":{"key":"contact_id.nick_name","value":"Nick Name","type":"text","condition":{"contact_type":"Individual"},"entity":"Contact"},"10":{"key":"contact_id.organization_name","value":"Employer name","type":"text","condition":{"contact_type":"Individual"},"entity":"Contact"},"11":{"key":"contact_id.gender_id","value":"Geschlecht","condition":{"contact_type":"Individual"},"entity":"Contact"},"12":{"key":"contact_id.is_deceased","value":"Verstorben","condition":{"contact_type":"Individual"},"entity":"Contact"},"13":{"key":"contact_id","value":"CiviCRM ID","type":"text"},"14":{"key":"contact_id.external_identifier","value":"Externe ID","type":"text","entity":"Contact"},"15":{"key":"contact_id.source","value":"Bezugsquelle","type":"text","entity":"Contact"}},"Activity":[{"key":"activity_type_id","value":"Aktivit\u00e4tstyp"},{"key":"status_id","value":"Status der Aktivit\u00e4t"}]},"links":{"Contact":[{"label":"New Individual","url":"/crm/civicrm/profile/create?reset=1&context=dialog&gid=4","type":"Individual","icon":"fa-user"},{"label":"New Organization","url":"/crm/civicrm/profile/create?reset=1&context=dialog&gid=5","type":"Organization","icon":"fa-building"},{"label":"New Household","url":"/crm/civicrm/profile/create?reset=1&context=dialog&gid=6","type":"Household","icon":"fa-home"}]}}, CRM.config.entityRef || {}); // Initialize CRM.url and CRM.formatMoney CRM.url({back: '/crm/civicrm-placeholder-url-path?civicrm-placeholder-url-query=1', front: '/crm/civicrm-placeholder-url-path?civicrm-placeholder-url-query=1'}); CRM.formatMoney('init', false, "\u20ac 1.234,56"); // Localize select2 $.fn.select2.defaults.formatNoMatches = "Nichts gefunden."; $.fn.select2.defaults.formatLoadMore = "Lade..."; $.fn.select2.defaults.formatSearching = "Suche..."; $.fn.select2.defaults.formatInputTooShort = function() { return ($(this).data('api-entity') === 'contact' || $(this).data('api-entity') === 'Contact') ? "Hier Namen oder E-Mail-Adresse eintragen..." : "Einen Suchbegriff eingeben..."; }; // Localize jQuery UI $.ui.dialog.prototype.options.closeText = "Schließen"; // Localize jQuery DataTables // Note the first two defaults set here aren't localization related, // but need to be set globally for all DataTables. $.extend( $.fn.dataTable.defaults, { "searching": false, "jQueryUI": true, "language": { "emptyTable": "Nichts gefunden.", "info": "Einträge START bis END von insgesamt TOTAL", "infoEmpty": "Zeige 0 bis 0 von 0 Einträgen", "infoFiltered": "(filtered from MAX total entries)", "infoPostFix": "", "thousands": ".", "lengthMenu": "MENU Einträge anzeigen", "loadingRecords": " ", "processing": " ", "zeroRecords": "Nichts gefunden.", "paginate": { "first": "Erste", "last": "Letzte", "next": "Weiter", "previous": "Zurück" } } }); // Localize strings for jQuery.validate var messages = { required: "Dieses Feld ist ein Pflichtfeld.", remote: "Bitte korrigieren Sie dieses Feld.", email: "Bitte geben Sie eine gültige E-Mailadresse ein.", url: "Geben Sie eine gültige URL ein.", date: "Bitte gebe ein gültiges Datum ein.", dateISO: "Bitte gebe ein gültiges Datum ein (JJJJ-MM-TT).", number: "Geben Sie eine gültige Zahl ein.", digits: "Bitte gebe nur Ziffern ein. ", creditcard: "Bitte geben Sie eine gültige Kreditkartennummer ein. ", equalTo: "Bitte geben Sie die gleichen Werter noch einmal ein.", accept: "Please enter a value with a valid extension.", maxlength: $.validator.format("Please enter no more than {0} characters."), minlength: $.validator.format("Please enter at least {0} characters."), rangelength: $.validator.format("Please enter a value between {0} and {1} characters long."), range: $.validator.format("Please enter a value between {0} and {1}."), max: $.validator.format("Please enter a value less than or equal to {0}."), min: $.validator.format("Please enter a value greater than or equal to {0}.") }; $.extend($.validator.messages, messages);

var params = { errorClass: 'crm-inline-error alert-danger', messages: {}, ignore: '.select2-offscreen, [readonly], :hidden:not(.crm-select2), .crm-no-validate', ignoreTitle: true, errorPlacement: function(error, element) { if (element.prop('type') === 'radio') { error.appendTo(element.parent('div.content')); } else { error.insertAfter(element); } } }; // use civicrm notifications when there are errors params.invalidHandler = function(form, validator) { // If there is no container for display then red text will still show next to the invalid fields // but there will be no overall message. Currently the container is only available on backoffice pages. if ($('#crm-notification-container').length) { $.each(validator.errorList, function(k, error) { $(error.element).parents('.crm-custom-accordion.collapsed').crmAccordionToggle(); $(error.element).crmError(error.message); }); } }; CRM.validate = { _defaults: params, params: {}, functions: [] }; // Load polyfill if (!('Promise' in window)) { CRM.loadScript(CRM.config.resourceBase + 'bower_components/es6-promise/es6-promise.auto.min.js'); } })(jQuery);*

Is this the way it should be ???

Thanks a lot for any suggestion how to protect this....

Best regards Dieter

2
  • I can't reproduce this either on a test site or the public demo dmaster.demo.civicrm.org. My guess is something about your web server configuration? – Demerit May 17 at 13:30
  • Hi Demerit, thx ;-) The drupal7/civicrm is installed via yunohost. WebServer is nginx and i did not change any configuration by myself. There are installed these addons also: # yunohost app list apps: 0: civicrm_drupal7 1: my_webapp 2: phpmyadmin 3: redirect best regards Dieter – thedi May 18 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.