Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
5
votes
1answer
379 views

Files in the data directory (Upload | Custom)should not be downloadable. (Nginx)

I am running a drupal site on nginx and I have a civicrm set-up on this site. Whenever I login and goto civicrm dashboard, I am getting this warnings. I have tried searching solution for this, not ...
5
votes
4answers
339 views

Why did we lose contact data after deleting the default location type “Home”?

So we lost 2/3 of our email and addresses on 6/15 around 1pm. Everything else seemed fine. I was able to get the civi log that pointed to a deletion command (DELETE FROM civicrm_location_type) around ...
2
votes
1answer
46 views

What are the implications of changing the SITE_KEY?

See also Generating a new SITE_KEY If I change the SITE_KEY in civicrm.settings.php, what might stop working as a result? Eg: Will checksums emailed to contacts last week still be valid? (you're ...
4
votes
3answers
383 views

How to prevent fraud attempts on Contribution pages?

An org I work with is reporting heavy fraudulent use (at least attempts to use -- it seems many are being declined in Auth.net, although some are getting through) of the CiviContribute form, despite ...
2
votes
3answers
259 views

Best way to configure IDS?

Civicrm has a built-in layer of intrusion detection using a library called PHPIDS. Unfortunately, I often have to disable for webhooks and other things that get trapped. For example, using the ...
6
votes
2answers
94 views

Is there a way for a user to verify themselves when following a checksum link?

Use case: Email a checksum link to a user asking them to update their profile data. When that user clicks the checksum link, request that they fill out a couple of verification fields such as ...
4
votes
3answers
39 views

Is there a way to send an email about security updates?

In Drupal there is an option to have an email sent periodically when there are updates (in general, or only security updates) available: I know CiviCRM already checks for updates and obviously has ...
8
votes
3answers
270 views

Is there a way to encrypt a single field in Civi database?

To protect sensitive data - such as HIPAA info
6
votes
1answer
280 views

Since upgrade, dompdf.php is presenting a security risk?

Upgraded to 4.5 a few weeks back on Joomla 3.3.6 and everything is working fine, except for a warning that I see when I first access CiviCRM. Reads: Security Warning File /home/[directory]/...
7
votes
2answers
133 views

How is the restful API secured?

In order to access the API securely what do I need to do? Is it as simple as using https and letting my CMS manage session authentication?
12
votes
5answers
245 views

How do I prevent a user from adding contacts to ACL groups?

I have successfully set up CiviCRM ACLs so that only contacts within the group "NYC Team" have access to certain events. What I am trying to figure out is how to prevent low-level users from adding ...

1
2