Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
30 views

Solarium vs CiviCRM

Drupal solr integration, as of Drupal 8.7.8 solr integration, as of 8.x-3.7 requires solarium/solarium:^5.1 which requires symfony/event-dispatcher:^4.3 which breaks civicrm. To maintain module ...
1
vote
1answer
29 views

Server Security Update Breaks Cron

A recent security update from our host has resulted in cron throwing out the following errors: PHP Warning: ini_set() has been disabled for security reasons in /.../public_html/wp-content/plugins/...
8
votes
3answers
236 views

Is there a way to encrypt a single field in Civi database?

To protect sensitive data - such as HIPAA info
1
vote
1answer
37 views

How should a CiviCRM site that uses remote profiles be protected?

When remote profiles are enabled for a CiviCRM site, it says the following: Warning: External profile support (aka "HTML Snippet" support) is enabled in system settings. This setting may be prone ...
1
vote
3answers
179 views

Loading a page browser says Waiting for another URL (not mine)

So when I'm waiting for CiviCRM to load in the bottom left of the browser it says Waiting for scorpioindustries.com.... (which is not my URL) What could this be a sign of? Have tried loading in ...
1
vote
1answer
48 views

CiviCRM Security Patch Needed warning still exists from older Civicrm Version?

I've moved a CiviCRM installtation from 5.7.3 (LTS) up to 5.10.4 *latest. However CiviCRM still gives the 'Security Patch Needed warning' which displayed when it was on 5.7.3. Database updates, ...
3
votes
1answer
45 views

What are the minimum permissions for Cron User?

In the interest of creating minimal permission sets for automated users, what are these for the cron user? If the cron is being run via drush, what are the minimum Civi permissions it can get away ...
2
votes
1answer
69 views

What are the security considerations before allowing access AJAX API to anonymous users?

We have an autocomplete-select list in one of our profiles that we want to use on a public page. I can see the call is blocked for anonymous users because of permissions on 'access AJAX API'. I'm ...
2
votes
2answers
70 views

The CiviCRM debug log should not be downloadable - generated .htaccess seems ok

On the civicrm/a/#/status the security message The CiviCRM debug log should not be downloadable is displayed. And the complaint is correct, I am able to download the log file. But CiviCRM does ...
2
votes
1answer
41 views

Secure storage for file attachments

We want to add some file fields to individual contacts for PDF documents. Is there a way to store these files so that they can be accessed by a Civicrm user with appropriate permissions but not ...
4
votes
1answer
84 views

what kind of sanitization needs to be done when doing civicrm_api3('Contact', 'create') inside custom drupal modules?

How does creating contacts via civicrm_api3() fit into these areas https://docs.civicrm.org/dev/en/latest/security/#strategy https://docs.civicrm.org/dev/en/latest/security/inputs ? If I'm using this ...
2
votes
1answer
54 views

How can I tell if Remote Profiles are in use?

Remote profiles are difficult to configure safely, so they're turned off by default on modern CiviCRM installs. However, if I have an old CiviCRM installation, how can I tell if this feature is in ...
12
votes
5answers
222 views

How do I prevent a user from adding contacts to ACL groups?

I have successfully set up CiviCRM ACLs so that only contacts within the group "NYC Team" have access to certain events. What I am trying to figure out is how to prevent low-level users from adding ...
6
votes
1answer
33 views

Is revealing Internal id a security risk?

We are planning on a mail out with recipients returning completed paper forms, then we'll update Civi with the results. This is where we have no email address for users. On the returned form we are ...
5
votes
3answers
425 views

How secure is CiviCRM?

How does CiviCRM keep our data secure? Is the program web-based? Or is it desktop based? I am interested in downloading and trying CiviCRM for our organization but can't find an information on ...
8
votes
2answers
227 views

GDPR and CiviCRM for a small but internationally operating and serving organisation

In our relatively small UK based charity, our CiviCRM database holds personal data of members, donors, event attendees and volunteers from around the UK, Europe, USA and other countries around the ...
5
votes
2answers
385 views

How do I update CiviCRM following a security update?

I am getting a warning to update security. It says: New security release 4.7.9 is available. The site is currently running 4.7.3. How do I update it? Thanks. Melissa Brooklyn Commons ...
1
vote
1answer
29 views

Support for Apache 2.4

I have noted that CiviCRM creates .htaccess with the Deny from all command in stead of the Require all denied. This causes security issues with my new setup at a hosting site. Drupal has support for ...
1
vote
0answers
32 views

Should I be worried about granting select on civicrm tables to drupal user?

To use drupal views to display civicrm data, you need to grant SELECT on the relevant tables in the civicrm database to the drupal user. I want to start creating some views because they offer so much ...
0
votes
1answer
55 views

Why do I get security warning & how to remove?

User just got 3 security warnings about access to sites/default/files/civicrm/custom & sites/default/files/civicrm/upload & sites/default/files/civicrm/ConfigAndLog. I changed the access of ...
2
votes
4answers
87 views

Best way to integrate two sites with different security levels

We have a civi install that contains some sensitive data. We also have a public facing website. We would like to integrate them so that you can sign up for events, give donations etc on the website. ...
2
votes
3answers
231 views

Best way to configure IDS?

Civicrm has a built-in layer of intrusion detection using a library called PHPIDS. Unfortunately, I often have to disable for webhooks and other things that get trapped. For example, using the ...
3
votes
3answers
167 views

Security Warning on Dashboard (pantheon / nginx)

Getting Security warning everytime I log into civicrm that my log directory is downloadable. I checked and it is completely viewable on my browser. I realize that there is a solution for nginx ...
1
vote
1answer
755 views

Call to undefined function dl() error w/Joomla 3.5.1 & PHP 7

I've just installed CiviCRM on a Joomla 3.5.1 site to learn how to use it. I am seeing an issue that I have a question about. As long as I use Php 5.6 the installation works properly. If I try to ...
2
votes
2answers
1k views

Cron not working after forcing https

TL;DR: Does anyone know why forcing https would break CiviCRM's cron jobs? A few days ago, I edited my .htaccess file to rewrite URLs to always use https, using the following code: RewriteEngine On ...
6
votes
2answers
60 views

In what circumstances is it safe to automatically de-duplicate contacts?

When is it safe (and when might it not be safe) to automatically de-duplicate contacts submitted from a public facing form? How might a malicious user leverage automatic contact merges to their ...
4
votes
4answers
445 views

How do I stop the new “Security Notifications” that civi pops up for upgrades

As we keep an eye on these upgrade for clients, the last thing we need is for them to worry about it while we check out their customisations for compatability etc. How to get rid of them?
1
vote
1answer
83 views

Security Vulnerability in Dashboard CiviCRM 4.6 for Drupal 7

I am currently testing the dashboard feature before enabling it on a production site. There seems to be a vulnerability in the Dashboard where a contact who only has "View my contact" permission and ...
3
votes
2answers
122 views

Security approach

As someone responsible for IT-security, I have to state that everything has been done that can reasonably be expected to keep people’s data safe. Therefore I want to ask in the round: Did you do ...
3
votes
1answer
50 views

Need help in getting quote for security upgrades

We are a small non-profit using CiviCRM. We are currently being charged a lot for security upgrades and monitoring. We are trying to understand pricing and what we actually need. We want to change ...
1
vote
1answer
90 views

Is there an update safe way to disable smarty security in templates for CiviMail?

I'm using CiviCRM 4.6.14 and I want to write a Template for CiviMail using the smarty templating engine. I need to add some PHP code to that template, but obvious the security setting is set to true ...
0
votes
1answer
42 views

Setting up API access for WordPress installation

I'm using civicrm's API to pull country and state data from CiviCRM into a Gravity Forms address pull-down list. The current webhooks between Gravity Forms and CiviCRM are failing because Gravity ...
0
votes
1answer
219 views

How do I perform a security update [duplicate]

When logging on today, I got the following alert: "Jmanage Security Update Required New security release 4.7.11 is available. The site is currently running 4.7.9." What steps do I need to perform to ...
1
vote
1answer
37 views

Does Civi CRM have ISO 27001? And is it compliant with ISO 27002 and ISO 27017?

Does Civi CRM have ISO 27001? And is it compliant with ISO 27002 and ISO 27017?
5
votes
1answer
105 views

Is automatic new Drupal user to existing CiviCRM contact linking a possible security vulnterability?

According to this CiviCRM wiki page, when a new Drupal user is created, its e-mail address is checked against the CiviCRM contacts list and, if a match is found, the new user is associated with the ...
1
vote
1answer
47 views

Outdated CiviCRM, blind SQL injection risk on parameters? (PCI compliance failure)

on CiviCRM 4.5.4 on Drupal, PCI vendor is reporting errors along the lines of: Using the GET HTTP method, XYZ found that : + The following resources may be vulnerable to blind SQL injection : + ...
2
votes
3answers
200 views

Storing Personally Identifiable Information

Is anyone storing Personally Identifiable Information (PII), such as Social Security Numbers (SSN), in their database? How would I encrypt such a field in the database? I'm expecting that it would ...
6
votes
1answer
91 views

Is civicrm-buildkit safe to use in production?

Background: I am recreating our CiviCRM installation on top of Drupal inside a Docker container. After a significant amount of research, I have decided to incorporate the best parts of civicrm-docker ...
0
votes
2answers
103 views

Is CiviCRM HIPPA compliant? [duplicate]

We are a non-profit mental health organization and require our records to be secure.
2
votes
1answer
36 views

How many levels of security can I set for a data base of 12000 people with their confidential data?

I am planning to set up a database of 12000 members. The database will include considerable amount of personal and confidential data. How many levels of access can I set up - each level graded to ...
2
votes
2answers
81 views

Does anyone use CiviCRM behind a Web Application Firewall?

We're looking at deployment for a client who's sensitive to being hacked, so we want to put CiviCRM behind, say, nginx running mod_security2. Has anyone used a WAF with CiviCRM that can share ...
6
votes
2answers
2k views

How do I set up an API key for a user?

The current documentation for creating an API key for user is on the wiki at https://wiki.civicrm.org/confluence/display/CRMDOC/REST+interface#RESTinterface-CreatingAPIkeysforusers. Unfortunately ...
2
votes
1answer
84 views

/civicrm/civicrm/CRM/Case/BAO/Query.php Reported to Contain Malware by Wordfence

I'm testing Wordfence a WordPress security plug-in on our site. It reports that /civicrm/civicrm/CRM/Case/BAO/Query.php contains suspected malware. Is this true? We are running CiviCRM 4.7.2. Here'...
2
votes
1answer
25 views

How can I track down a script or form that's generating empty contact records?

Every 10-15 minutes a new, (almost) blank contact record is being generated in civi. The only clue I have is that the blank record is subscribed to our mailing list. Any ideas?
2
votes
1answer
93 views

How do I tell what security issues require upgrade?

Just upgraded a site to 4.6.11 (long story as to why). CiviCRM is showing the "Security update required", which links to https://civicrm.org/advisory As I click on advisory after advisory, in ...
5
votes
4answers
338 views

Why did we lose contact data after deleting the default location type “Home”?

So we lost 2/3 of our email and addresses on 6/15 around 1pm. Everything else seemed fine. I was able to get the civi log that pointed to a deletion command (DELETE FROM civicrm_location_type) around ...
5
votes
2answers
127 views

Installing CiviCRM - best security practices

I am new to CiviCRM and want to use it on a Joomla website. The question I have is how is the best way to make sure, that the CiviCRM user data is secure? I am thinking about installing CiviCRM in ...
7
votes
2answers
129 views

How is the restful API secured?

In order to access the API securely what do I need to do? Is it as simple as using https and letting my CMS manage session authentication?
2
votes
2answers
45 views

Security Configuration and Programming Guidance

I'm a security person. I have a non-profit that wants to use CiviCRM. What are the nitty-gritty details that I need to know? I will handle the hard technical stuff for them. The only information of ...
2
votes
1answer
247 views

Security of REST API keys

This OWASP document suggests that API keys for REST APIs should be passed as a POST parameter or a cookie. Not a GET parameter, because they can appear in the server logs. Elsewhere they suggest that ...