Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
27 views

How should a CiviCRM site that uses remote profiles be protected?

When remote profiles are enabled for a CiviCRM site, it says the following: Warning: External profile support (aka "HTML Snippet" support) is enabled in system settings. This setting may be prone ...
1
vote
1answer
45 views

CiviCRM Security Patch Needed warning still exists from older Civicrm Version?

I've moved a CiviCRM installtation from 5.7.3 (LTS) up to 5.10.4 *latest. However CiviCRM still gives the 'Security Patch Needed warning' which displayed when it was on 5.7.3. Database updates, ...
3
votes
1answer
39 views

What are the minimum permissions for Cron User?

In the interest of creating minimal permission sets for automated users, what are these for the cron user? If the cron is being run via drush, what are the minimum Civi permissions it can get away ...
2
votes
1answer
55 views

What are the security considerations before allowing access AJAX API to anonymous users?

We have an autocomplete-select list in one of our profiles that we want to use on a public page. I can see the call is blocked for anonymous users because of permissions on 'access AJAX API'. I'm ...
2
votes
1answer
37 views

Secure storage for file attachments

We want to add some file fields to individual contacts for PDF documents. Is there a way to store these files so that they can be accessed by a Civicrm user with appropriate permissions but not ...
2
votes
2answers
52 views

The CiviCRM debug log should not be downloadable - generated .htaccess seems ok

On the civicrm/a/#/status the security message The CiviCRM debug log should not be downloadable is displayed. And the complaint is correct, I am able to download the log file. But CiviCRM does ...
2
votes
1answer
45 views

How can I tell if Remote Profiles are in use?

Remote profiles are difficult to configure safely, so they're turned off by default on modern CiviCRM installs. However, if I have an old CiviCRM installation, how can I tell if this feature is in ...
6
votes
1answer
32 views

Is revealing Internal id a security risk?

We are planning on a mail out with recipients returning completed paper forms, then we'll update Civi with the results. This is where we have no email address for users. On the returned form we are ...
4
votes
1answer
76 views

what kind of sanitization needs to be done when doing civicrm_api3('Contact', 'create') inside custom drupal modules?

How does creating contacts via civicrm_api3() fit into these areas https://docs.civicrm.org/dev/en/latest/security/#strategy https://docs.civicrm.org/dev/en/latest/security/inputs ? If I'm using this ...
1
vote
1answer
27 views

Support for Apache 2.4

I have noted that CiviCRM creates .htaccess with the Deny from all command in stead of the Require all denied. This causes security issues with my new setup at a hosting site. Drupal has support for ...
1
vote
0answers
32 views

Should I be worried about granting select on civicrm tables to drupal user?

To use drupal views to display civicrm data, you need to grant SELECT on the relevant tables in the civicrm database to the drupal user. I want to start creating some views because they offer so much ...
0
votes
1answer
53 views

Why do I get security warning & how to remove?

User just got 3 security warnings about access to sites/default/files/civicrm/custom & sites/default/files/civicrm/upload & sites/default/files/civicrm/ConfigAndLog. I changed the access of ...
8
votes
2answers
221 views

GDPR and CiviCRM for a small but internationally operating and serving organisation

In our relatively small UK based charity, our CiviCRM database holds personal data of members, donors, event attendees and volunteers from around the UK, Europe, USA and other countries around the ...
2
votes
4answers
77 views

Best way to integrate two sites with different security levels

We have a civi install that contains some sensitive data. We also have a public facing website. We would like to integrate them so that you can sign up for events, give donations etc on the website. ...
5
votes
3answers
376 views

How secure is CiviCRM?

How does CiviCRM keep our data secure? Is the program web-based? Or is it desktop based? I am interested in downloading and trying CiviCRM for our organization but can't find an information on ...
2
votes
2answers
1k views

Cron not working after forcing https

TL;DR: Does anyone know why forcing https would break CiviCRM's cron jobs? A few days ago, I edited my .htaccess file to rewrite URLs to always use https, using the following code: RewriteEngine On ...
1
vote
1answer
83 views

Security Vulnerability in Dashboard CiviCRM 4.6 for Drupal 7

I am currently testing the dashboard feature before enabling it on a production site. There seems to be a vulnerability in the Dashboard where a contact who only has "View my contact" permission and ...
3
votes
2answers
113 views

Security approach

As someone responsible for IT-security, I have to state that everything has been done that can reasonably be expected to keep people’s data safe. Therefore I want to ask in the round: Did you do ...
3
votes
1answer
48 views

Need help in getting quote for security upgrades

We are a small non-profit using CiviCRM. We are currently being charged a lot for security upgrades and monitoring. We are trying to understand pricing and what we actually need. We want to change ...
0
votes
1answer
201 views

How do I perform a security update [duplicate]

When logging on today, I got the following alert: "Jmanage Security Update Required New security release 4.7.11 is available. The site is currently running 4.7.9." What steps do I need to perform to ...
1
vote
1answer
37 views

Does Civi CRM have ISO 27001? And is it compliant with ISO 27002 and ISO 27017?

Does Civi CRM have ISO 27001? And is it compliant with ISO 27002 and ISO 27017?
5
votes
2answers
330 views

How do I update CiviCRM following a security update?

I am getting a warning to update security. It says: New security release 4.7.9 is available. The site is currently running 4.7.3. How do I update it? Thanks. Melissa Brooklyn Commons ...
0
votes
1answer
40 views

Setting up API access for WordPress installation

I'm using civicrm's API to pull country and state data from CiviCRM into a Gravity Forms address pull-down list. The current webhooks between Gravity Forms and CiviCRM are failing because Gravity ...
5
votes
1answer
104 views

Is automatic new Drupal user to existing CiviCRM contact linking a possible security vulnterability?

According to this CiviCRM wiki page, when a new Drupal user is created, its e-mail address is checked against the CiviCRM contacts list and, if a match is found, the new user is associated with the ...
1
vote
1answer
47 views

Outdated CiviCRM, blind SQL injection risk on parameters? (PCI compliance failure)

on CiviCRM 4.5.4 on Drupal, PCI vendor is reporting errors along the lines of: Using the GET HTTP method, XYZ found that : + The following resources may be vulnerable to blind SQL injection : + ...
1
vote
1answer
696 views

Call to undefined function dl() error w/Joomla 3.5.1 & PHP 7

I've just installed CiviCRM on a Joomla 3.5.1 site to learn how to use it. I am seeing an issue that I have a question about. As long as I use Php 5.6 the installation works properly. If I try to ...
2
votes
3answers
189 views

Storing Personally Identifiable Information

Is anyone storing Personally Identifiable Information (PII), such as Social Security Numbers (SSN), in their database? How would I encrypt such a field in the database? I'm expecting that it would ...
0
votes
2answers
92 views

Is CiviCRM HIPPA compliant? [duplicate]

We are a non-profit mental health organization and require our records to be secure.
2
votes
1answer
36 views

How many levels of security can I set for a data base of 12000 people with their confidential data?

I am planning to set up a database of 12000 members. The database will include considerable amount of personal and confidential data. How many levels of access can I set up - each level graded to ...
6
votes
1answer
81 views

Is civicrm-buildkit safe to use in production?

Background: I am recreating our CiviCRM installation on top of Drupal inside a Docker container. After a significant amount of research, I have decided to incorporate the best parts of civicrm-docker ...
2
votes
2answers
72 views

Does anyone use CiviCRM behind a Web Application Firewall?

We're looking at deployment for a client who's sensitive to being hacked, so we want to put CiviCRM behind, say, nginx running mod_security2. Has anyone used a WAF with CiviCRM that can share ...
1
vote
1answer
84 views

Is there an update safe way to disable smarty security in templates for CiviMail?

I'm using CiviCRM 4.6.14 and I want to write a Template for CiviMail using the smarty templating engine. I need to add some PHP code to that template, but obvious the security setting is set to true ...
2
votes
1answer
84 views

/civicrm/civicrm/CRM/Case/BAO/Query.php Reported to Contain Malware by Wordfence

I'm testing Wordfence a WordPress security plug-in on our site. It reports that /civicrm/civicrm/CRM/Case/BAO/Query.php contains suspected malware. Is this true? We are running CiviCRM 4.7.2. Here'...
6
votes
2answers
2k views

How do I set up an API key for a user?

The current documentation for creating an API key for user is on the wiki at https://wiki.civicrm.org/confluence/display/CRMDOC/REST+interface#RESTinterface-CreatingAPIkeysforusers. Unfortunately ...
2
votes
1answer
25 views

How can I track down a script or form that's generating empty contact records?

Every 10-15 minutes a new, (almost) blank contact record is being generated in civi. The only clue I have is that the blank record is subscribed to our mailing list. Any ideas?
2
votes
1answer
93 views

How do I tell what security issues require upgrade?

Just upgraded a site to 4.6.11 (long story as to why). CiviCRM is showing the "Security update required", which links to https://civicrm.org/advisory As I click on advisory after advisory, in ...
5
votes
2answers
124 views

Installing CiviCRM - best security practices

I am new to CiviCRM and want to use it on a Joomla website. The question I have is how is the best way to make sure, that the CiviCRM user data is secure? I am thinking about installing CiviCRM in ...
6
votes
2answers
60 views

In what circumstances is it safe to automatically de-duplicate contacts?

When is it safe (and when might it not be safe) to automatically de-duplicate contacts submitted from a public facing form? How might a malicious user leverage automatic contact merges to their ...
2
votes
2answers
43 views

Security Configuration and Programming Guidance

I'm a security person. I have a non-profit that wants to use CiviCRM. What are the nitty-gritty details that I need to know? I will handle the hard technical stuff for them. The only information of ...
1
vote
3answers
174 views

Loading a page browser says Waiting for another URL (not mine)

So when I'm waiting for CiviCRM to load in the bottom left of the browser it says Waiting for scorpioindustries.com.... (which is not my URL) What could this be a sign of? Have tried loading in ...
4
votes
4answers
412 views

How do I stop the new “Security Notifications” that civi pops up for upgrades

As we keep an eye on these upgrade for clients, the last thing we need is for them to worry about it while we check out their customisations for compatability etc. How to get rid of them?
2
votes
1answer
237 views

Security of REST API keys

This OWASP document suggests that API keys for REST APIs should be passed as a POST parameter or a cookie. Not a GET parameter, because they can appear in the server logs. Elsewhere they suggest that ...
8
votes
1answer
94 views

How do I find more information about the ACL regression introduced in 4.6.7?

Email was received stating If you are currently using 4.6.7 and your site uses ACLs to segment access to contacts you are strongly encouraged to upgrade. The 4.6.7 release included a regression in ...
3
votes
3answers
161 views

Security Warning on Dashboard (pantheon / nginx)

Getting Security warning everytime I log into civicrm that my log directory is downloadable. I checked and it is completely viewable on my browser. I realize that there is a solution for nginx ...
5
votes
1answer
327 views

Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)

I am running a drupal site on nginx and I have a civicrm set-up on this site. Whenever I login and goto civicrm dashboard, I am getting this warnings. I have tried searching solution for this, not ...
5
votes
4answers
338 views

Why did we lose contact data after deleting the default location type “Home”?

So we lost 2/3 of our email and addresses on 6/15 around 1pm. Everything else seemed fine. I was able to get the civi log that pointed to a deletion command (DELETE FROM civicrm_location_type) around ...
2
votes
1answer
41 views

What are the implications of changing the SITE_KEY?

See also Generating a new SITE_KEY If I change the SITE_KEY in civicrm.settings.php, what might stop working as a result? Eg: Will checksums emailed to contacts last week still be valid? (you're ...
4
votes
3answers
350 views

How to prevent fraud attempts on Contribution pages?

An org I work with is reporting heavy fraudulent use (at least attempts to use -- it seems many are being declined in Auth.net, although some are getting through) of the CiviContribute form, despite ...
2
votes
3answers
208 views

Best way to configure IDS?

Civicrm has a built-in layer of intrusion detection using a library called PHPIDS. Unfortunately, I often have to disable for webhooks and other things that get trapped. For example, using the ...
6
votes
2answers
81 views

Is there a way for a user to verify themselves when following a checksum link?

Use case: Email a checksum link to a user asking them to update their profile data. When that user clicks the checksum link, request that they fill out a couple of verification fields such as ...