Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
27 views

IDS causing site to fail for lots of visitors

We are getting IDS errors left and right. We would get complaints here and there that our site isn't working and after reviewing our logs, IDS errors everywhere. Mostly getting the error: There is a ...
1
vote
1answer
40 views

What this bot/IP trying to do on my civicrm site?

I find 100s of these types of entries in my drupal log. It tries URLs like this below. It happens when there's very less traffic on our site. What is it trying to do? Is it a security threat? Can it ...
6
votes
1answer
149 views

packages/Net/UserAgent/Detect/APC.php flagged as malicious by Wordfence Firewall

Our Wordpress firewall Wordfence has flagged packages/Net/UserAgent/Detect/APC.php as possibly a malicious file. Based on past experience, I assume this is a false positive. However, I posted it ...
1
vote
1answer
35 views

Solarium vs CiviCRM

Drupal solr integration, as of Drupal 8.7.8 solr integration, as of 8.x-3.7 requires solarium/solarium:^5.1 which requires symfony/event-dispatcher:^4.3 which breaks civicrm. To maintain module ...
1
vote
1answer
36 views

Server Security Update Breaks Cron

A recent security update from our host has resulted in cron throwing out the following errors: PHP Warning: ini_set() has been disabled for security reasons in /.../public_html/wp-content/plugins/...
8
votes
3answers
269 views

Is there a way to encrypt a single field in Civi database?

To protect sensitive data - such as HIPAA info
1
vote
1answer
65 views

How should a CiviCRM site that uses remote profiles be protected?

When remote profiles are enabled for a CiviCRM site, it says the following: Warning: External profile support (aka "HTML Snippet" support) is enabled in system settings. This setting may be ...
1
vote
3answers
192 views

Loading a page browser says Waiting for another URL (not mine)

So when I'm waiting for CiviCRM to load in the bottom left of the browser it says Waiting for scorpioindustries.com.... (which is not my URL) What could this be a sign of? Have tried loading in ...
1
vote
1answer
52 views

CiviCRM Security Patch Needed warning still exists from older Civicrm Version?

I've moved a CiviCRM installtation from 5.7.3 (LTS) up to 5.10.4 *latest. However CiviCRM still gives the 'Security Patch Needed warning' which displayed when it was on 5.7.3. Database updates, ...
3
votes
1answer
65 views

What are the minimum permissions for Cron User?

In the interest of creating minimal permission sets for automated users, what are these for the cron user? If the cron is being run via drush, what are the minimum Civi permissions it can get away ...
2
votes
1answer
81 views

What are the security considerations before allowing access AJAX API to anonymous users?

We have an autocomplete-select list in one of our profiles that we want to use on a public page. I can see the call is blocked for anonymous users because of permissions on 'access AJAX API'. I'm ...
2
votes
2answers
93 views

The CiviCRM debug log should not be downloadable - generated .htaccess seems ok

On the civicrm/a/#/status the security message The CiviCRM debug log should not be downloadable is displayed. And the complaint is correct, I am able to download the log file. But CiviCRM does ...
2
votes
1answer
44 views

Secure storage for file attachments

We want to add some file fields to individual contacts for PDF documents. Is there a way to store these files so that they can be accessed by a Civicrm user with appropriate permissions but not ...
4
votes
1answer
87 views

what kind of sanitization needs to be done when doing civicrm_api3('Contact', 'create') inside custom drupal modules?

How does creating contacts via civicrm_api3() fit into these areas https://docs.civicrm.org/dev/en/latest/security/#strategy https://docs.civicrm.org/dev/en/latest/security/inputs ? If I'm using this ...
2
votes
1answer
64 views

How can I tell if Remote Profiles are in use?

Remote profiles are difficult to configure safely, so they're turned off by default on modern CiviCRM installs. However, if I have an old CiviCRM installation, how can I tell if this feature is in ...
12
votes
5answers
244 views

How do I prevent a user from adding contacts to ACL groups?

I have successfully set up CiviCRM ACLs so that only contacts within the group "NYC Team" have access to certain events. What I am trying to figure out is how to prevent low-level users from adding ...
6
votes
1answer
34 views

Is revealing Internal id a security risk?

We are planning on a mail out with recipients returning completed paper forms, then we'll update Civi with the results. This is where we have no email address for users. On the returned form we are ...
5
votes
3answers
487 views

How secure is CiviCRM?

How does CiviCRM keep our data secure? Is the program web-based? Or is it desktop based? I am interested in downloading and trying CiviCRM for our organization but can't find an information on ...
8
votes
2answers
245 views

GDPR and CiviCRM for a small but internationally operating and serving organisation

In our relatively small UK based charity, our CiviCRM database holds personal data of members, donors, event attendees and volunteers from around the UK, Europe, USA and other countries around the ...
5
votes
2answers
485 views

How do I update CiviCRM following a security update?

I am getting a warning to update security. It says: New security release 4.7.9 is available. The site is currently running 4.7.3. How do I update it? Thanks. Melissa Brooklyn Commons ...
1
vote
1answer
31 views

Support for Apache 2.4

I have noted that CiviCRM creates .htaccess with the Deny from all command in stead of the Require all denied. This causes security issues with my new setup at a hosting site. Drupal has support for ...
1
vote
0answers
33 views

Should I be worried about granting select on civicrm tables to drupal user?

To use drupal views to display civicrm data, you need to grant SELECT on the relevant tables in the civicrm database to the drupal user. I want to start creating some views because they offer so much ...
0
votes
1answer
60 views

Why do I get security warning & how to remove?

User just got 3 security warnings about access to sites/default/files/civicrm/custom & sites/default/files/civicrm/upload & sites/default/files/civicrm/ConfigAndLog. I changed the access of ...
2
votes
4answers
91 views

Best way to integrate two sites with different security levels

We have a civi install that contains some sensitive data. We also have a public facing website. We would like to integrate them so that you can sign up for events, give donations etc on the website. ...
2
votes
3answers
256 views

Best way to configure IDS?

Civicrm has a built-in layer of intrusion detection using a library called PHPIDS. Unfortunately, I often have to disable for webhooks and other things that get trapped. For example, using the ...
3
votes
3answers
183 views

Security Warning on Dashboard (pantheon / nginx)

Getting Security warning everytime I log into civicrm that my log directory is downloadable. I checked and it is completely viewable on my browser. I realize that there is a solution for nginx ...
1
vote
1answer
822 views

Call to undefined function dl() error w/Joomla 3.5.1 & PHP 7

I've just installed CiviCRM on a Joomla 3.5.1 site to learn how to use it. I am seeing an issue that I have a question about. As long as I use Php 5.6 the installation works properly. If I try to ...
2
votes
2answers
2k views

Cron not working after forcing https

TL;DR: Does anyone know why forcing https would break CiviCRM's cron jobs? A few days ago, I edited my .htaccess file to rewrite URLs to always use https, using the following code: RewriteEngine On ...
6
votes
2answers
63 views

In what circumstances is it safe to automatically de-duplicate contacts?

When is it safe (and when might it not be safe) to automatically de-duplicate contacts submitted from a public facing form? How might a malicious user leverage automatic contact merges to their ...
4
votes
4answers
478 views

How do I stop the new “Security Notifications” that civi pops up for upgrades

As we keep an eye on these upgrade for clients, the last thing we need is for them to worry about it while we check out their customisations for compatability etc. How to get rid of them?
1
vote
1answer
83 views

Security Vulnerability in Dashboard CiviCRM 4.6 for Drupal 7

I am currently testing the dashboard feature before enabling it on a production site. There seems to be a vulnerability in the Dashboard where a contact who only has "View my contact" permission and ...
4
votes
2answers
131 views

Security approach

As someone responsible for IT-security, I have to state that everything has been done that can reasonably be expected to keep people’s data safe. Therefore I want to ask in the round: Did you do ...
3
votes
1answer
50 views

Need help in getting quote for security upgrades

We are a small non-profit using CiviCRM. We are currently being charged a lot for security upgrades and monitoring. We are trying to understand pricing and what we actually need. We want to change ...
1
vote
1answer
98 views

Is there an update safe way to disable smarty security in templates for CiviMail?

I'm using CiviCRM 4.6.14 and I want to write a Template for CiviMail using the smarty templating engine. I need to add some PHP code to that template, but obvious the security setting is set to true ...
0
votes
1answer
49 views

Setting up API access for WordPress installation

I'm using civicrm's API to pull country and state data from CiviCRM into a Gravity Forms address pull-down list. The current webhooks between Gravity Forms and CiviCRM are failing because Gravity ...
0
votes
1answer
243 views

How do I perform a security update [duplicate]

When logging on today, I got the following alert: "Jmanage Security Update Required New security release 4.7.11 is available. The site is currently running 4.7.9." What steps do I need to perform to ...
1
vote
1answer
44 views

Does Civi CRM have ISO 27001? And is it compliant with ISO 27002 and ISO 27017?

Does Civi CRM have ISO 27001? And is it compliant with ISO 27002 and ISO 27017?
5
votes
1answer
106 views

Is automatic new Drupal user to existing CiviCRM contact linking a possible security vulnterability?

According to this CiviCRM wiki page, when a new Drupal user is created, its e-mail address is checked against the CiviCRM contacts list and, if a match is found, the new user is associated with the ...
1
vote
1answer
47 views

Outdated CiviCRM, blind SQL injection risk on parameters? (PCI compliance failure)

on CiviCRM 4.5.4 on Drupal, PCI vendor is reporting errors along the lines of: Using the GET HTTP method, XYZ found that : + The following resources may be vulnerable to blind SQL injection : + ...
2
votes
3answers
215 views

Storing Personally Identifiable Information

Is anyone storing Personally Identifiable Information (PII), such as Social Security Numbers (SSN), in their database? How would I encrypt such a field in the database? I'm expecting that it would ...
6
votes
1answer
115 views

Is civicrm-buildkit safe to use in production?

Background: I am recreating our CiviCRM installation on top of Drupal inside a Docker container. After a significant amount of research, I have decided to incorporate the best parts of civicrm-docker ...
0
votes
2answers
116 views

Is CiviCRM HIPPA compliant? [duplicate]

We are a non-profit mental health organization and require our records to be secure.
2
votes
1answer
36 views

How many levels of security can I set for a data base of 12000 people with their confidential data?

I am planning to set up a database of 12000 members. The database will include considerable amount of personal and confidential data. How many levels of access can I set up - each level graded to ...
2
votes
2answers
87 views

Does anyone use CiviCRM behind a Web Application Firewall?

We're looking at deployment for a client who's sensitive to being hacked, so we want to put CiviCRM behind, say, nginx running mod_security2. Has anyone used a WAF with CiviCRM that can share ...
6
votes
2answers
3k views

How do I set up an API key for a user?

The current documentation for creating an API key for user is on the wiki at https://wiki.civicrm.org/confluence/display/CRMDOC/REST+interface#RESTinterface-CreatingAPIkeysforusers. Unfortunately ...
2
votes
1answer
87 views

/civicrm/civicrm/CRM/Case/BAO/Query.php Reported to Contain Malware by Wordfence

I'm testing Wordfence a WordPress security plug-in on our site. It reports that /civicrm/civicrm/CRM/Case/BAO/Query.php contains suspected malware. Is this true? We are running CiviCRM 4.7.2. Here'...
2
votes
1answer
26 views

How can I track down a script or form that's generating empty contact records?

Every 10-15 minutes a new, (almost) blank contact record is being generated in civi. The only clue I have is that the blank record is subscribed to our mailing list. Any ideas?
2
votes
1answer
95 views

How do I tell what security issues require upgrade?

Just upgraded a site to 4.6.11 (long story as to why). CiviCRM is showing the "Security update required", which links to https://civicrm.org/advisory As I click on advisory after advisory, in ...
5
votes
4answers
339 views

Why did we lose contact data after deleting the default location type “Home”?

So we lost 2/3 of our email and addresses on 6/15 around 1pm. Everything else seemed fine. I was able to get the civi log that pointed to a deletion command (DELETE FROM civicrm_location_type) around ...
5
votes
2answers
134 views

Installing CiviCRM - best security practices

I am new to CiviCRM and want to use it on a Joomla website. The question I have is how is the best way to make sure, that the CiviCRM user data is secure? I am thinking about installing CiviCRM in ...