Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
55 views

What does IDS (Intrusion Detection System) exactly? What happens if I disable it?

One of my clients sends emails with click-through links. And sometimes, after clicking on the link, the following message is displayed. I did some research. The error is generated from a piece of code ...
user avatar
1 vote
2 answers
31 views

Are single timezone countries affected by security release 5.47.2 event date problem?

Reading this note it's not clear to me whether to go ahead with the 5.47.2 release. I have several clients using events, but all are in the UK which has a single timezone. I'm assuming the date ...
user avatar
  • 4,263
0 votes
0 answers
15 views

WordFence conflict

When I activate the CiviCRM plugin on WordPress, the WordFence plugin instantly intervenes to block me from logging into WordPress, and flags my IP address. Thoughts?
user avatar
2 votes
1 answer
49 views

Multi-Factor Authentification?

I am in the process of looking at the features of CiviCRM and have come across a security question. Does CiviCRM have multi-factor authentification (MFA)? I tried looking into the website and public ...
user avatar
  • 21
1 vote
2 answers
50 views

How to prevent use of a forwarded email link to a webform

We are sending emails to contacts, using Civimail, with a link to a webform. These contacts do not have a login to Civi so are seen by the webform as 'Anonymous (not verified)' users when they are ...
user avatar
  • 4,263
1 vote
0 answers
21 views

Contact Groups and ACL Management

I am using Civi 5.38 on a WordPress site, and have a query on ACL permissions. We want to use different tiers of access for the information stored in custom data sets. We have created ACLs and applied ...
user avatar
  • 53
3 votes
2 answers
78 views

Get CiviCRM working without internet connection

I tried to install CiviCRM on a server with a firewall that blocks outgoing traffic. But the dashboard wouldn't load. Looking at the logs, it appears CiviCRM tries to connect to civicrm.org. Probably ...
user avatar
1 vote
1 answer
36 views

Cyber security penetration testing

As part of our annual information governance review we have to answer a question on whether all of the suppliers of our systems have cyber certifications. CiviCRM as open source software is a bit ...
user avatar
  • 624
2 votes
1 answer
47 views

CKeditor security issue--does it impact CiviCRM and what to do?

Drupal security reported Project: Drupal core Date: 2021-May-26 Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Default Vulnerability: Cross Site Scripting ...
user avatar
  • 363
2 votes
1 answer
66 views

How secure is CiviCRM

I have been using CiviCRM for over five years. I am trying to encourage a local charity who provides care to vulnerable people to move to CiviCRM. I have been asked by the project manager the ...
user avatar
  • 101
2 votes
1 answer
54 views

When using PayPal, we DON'T want to collect credit card info!

I've searched for the answer to this, but haven't found it. Our issue is we want to have a contribution page with PayPal and Pay Later capability but don't want credit card information entered on our ...
user avatar
0 votes
1 answer
32 views

Permission 'See CiviCRM is installed' keeps being removed on Joomla

I have a problem where the CiviCRM permissions on a Joomla site keep being altered. The 'See CiviCRM is installed' permission is set on 'Registered' users to 'Allowed' but keeps being reset to 'Not ...
user avatar
4 votes
0 answers
221 views

Errors from 5.30.1 update (errors of missing settings, missing images)

I updated my CiviCRM plugin for Wordpress to 5.30.1 from a recent version (5.27 if I recall). Since the update, I get an error appearing in debug.log multiple times per page load saying: PHP Notice: ...
user avatar
  • 71
1 vote
1 answer
69 views

Disabling Breadcrumbs in CiviCRM

I want to disable the CiviCRM breadcrumbs inside the program code for security reasons. I tried modifying sites/all/modules/civicrm/CRM/Core/DAO/Menu.php by adding $skipBreadcrumb['type'] = TRUE; in ...
user avatar
  • 431
0 votes
0 answers
15 views

Anonymours_User Creating Articles and Publishing Pages on Drupal 8

It seems like our site's security has been compromised. We have some annoymous_users creating pages and publishing articles. They are all showing as unpublished, but it seems like there's dozens of ...
user avatar
  • 1
1 vote
1 answer
51 views

Does ModSecurity and CiviCRM play well together?

I am thinking to add ModSecurity to the server (Wordpress 5.x/Apache2/Ubuntu 18) that is running CiviCRM to further augment the security. Thought I thought I check on this forum on the experience of ...
user avatar
1 vote
1 answer
54 views

IDS causing site to fail for lots of visitors

We are getting IDS errors left and right. We would get complaints here and there that our site isn't working and after reviewing our logs, IDS errors everywhere. Mostly getting the error: There is a ...
user avatar
  • 3,122
1 vote
1 answer
42 views

What this bot/IP trying to do on my civicrm site?

I find 100s of these types of entries in my drupal log. It tries URLs like this below. It happens when there's very less traffic on our site. What is it trying to do? Is it a security threat? Can it ...
user avatar
  • 2,846
6 votes
1 answer
195 views

packages/Net/UserAgent/Detect/APC.php flagged as malicious by Wordfence Firewall

Our Wordpress firewall Wordfence has flagged packages/Net/UserAgent/Detect/APC.php as possibly a malicious file. Based on past experience, I assume this is a false positive. However, I posted it ...
user avatar
1 vote
1 answer
41 views

Solarium vs CiviCRM

Drupal solr integration, as of Drupal 8.7.8 solr integration, as of 8.x-3.7 requires solarium/solarium:^5.1 which requires symfony/event-dispatcher:^4.3 which breaks civicrm. To maintain module ...
user avatar
1 vote
1 answer
51 views

Server Security Update Breaks Cron

A recent security update from our host has resulted in cron throwing out the following errors: PHP Warning: ini_set() has been disabled for security reasons in /.../public_html/wp-content/plugins/...
user avatar
1 vote
1 answer
123 views

How should a CiviCRM site that uses remote profiles be protected?

When remote profiles are enabled for a CiviCRM site, it says the following: Warning: External profile support (aka "HTML Snippet" support) is enabled in system settings. This setting may be ...
user avatar
  • 111
1 vote
1 answer
65 views

CiviCRM Security Patch Needed warning still exists from older Civicrm Version?

I've moved a CiviCRM installtation from 5.7.3 (LTS) up to 5.10.4 *latest. However CiviCRM still gives the 'Security Patch Needed warning' which displayed when it was on 5.7.3. Database updates, ...
user avatar
  • 343
3 votes
1 answer
94 views

What are the minimum permissions for Cron User?

In the interest of creating minimal permission sets for automated users, what are these for the cron user? If the cron is being run via drush, what are the minimum Civi permissions it can get away ...
user avatar
  • 2,343
2 votes
1 answer
139 views

What are the security considerations before allowing access AJAX API to anonymous users?

We have an autocomplete-select list in one of our profiles that we want to use on a public page. I can see the call is blocked for anonymous users because of permissions on 'access AJAX API'. I'm ...
user avatar
  • 233
2 votes
1 answer
47 views

Secure storage for file attachments

We want to add some file fields to individual contacts for PDF documents. Is there a way to store these files so that they can be accessed by a Civicrm user with appropriate permissions but not ...
user avatar
2 votes
2 answers
144 views

The CiviCRM debug log should not be downloadable - generated .htaccess seems ok

On the civicrm/a/#/status the security message The CiviCRM debug log should not be downloadable is displayed. And the complaint is correct, I am able to download the log file. But CiviCRM does ...
user avatar
2 votes
1 answer
78 views

How can I tell if Remote Profiles are in use?

Remote profiles are difficult to configure safely, so they're turned off by default on modern CiviCRM installs. However, if I have an old CiviCRM installation, how can I tell if this feature is in ...
user avatar
6 votes
1 answer
35 views

Is revealing Internal id a security risk?

We are planning on a mail out with recipients returning completed paper forms, then we'll update Civi with the results. This is where we have no email address for users. On the returned form we are ...
user avatar
  • 4,263
4 votes
1 answer
89 views

what kind of sanitization needs to be done when doing civicrm_api3('Contact', 'create') inside custom drupal modules?

How does creating contacts via civicrm_api3() fit into these areas https://docs.civicrm.org/dev/en/latest/security/#strategy https://docs.civicrm.org/dev/en/latest/security/inputs ? If I'm using this ...
user avatar
  • 407
1 vote
1 answer
39 views

Support for Apache 2.4

I have noted that CiviCRM creates .htaccess with the Deny from all command in stead of the Require all denied. This causes security issues with my new setup at a hosting site. Drupal has support for ...
user avatar
1 vote
0 answers
39 views

Should I be worried about granting select on civicrm tables to drupal user?

To use drupal views to display civicrm data, you need to grant SELECT on the relevant tables in the civicrm database to the drupal user. I want to start creating some views because they offer so much ...
user avatar
  • 1,247
0 votes
1 answer
68 views

Why do I get security warning & how to remove?

User just got 3 security warnings about access to sites/default/files/civicrm/custom & sites/default/files/civicrm/upload & sites/default/files/civicrm/ConfigAndLog. I changed the access of ...
user avatar
  • 4,263
8 votes
2 answers
253 views

GDPR and CiviCRM for a small but internationally operating and serving organisation

In our relatively small UK based charity, our CiviCRM database holds personal data of members, donors, event attendees and volunteers from around the UK, Europe, USA and other countries around the ...
user avatar
  • 81
2 votes
4 answers
102 views

Best way to integrate two sites with different security levels

We have a civi install that contains some sensitive data. We also have a public facing website. We would like to integrate them so that you can sign up for events, give donations etc on the website. ...
user avatar
  • 1,247
5 votes
3 answers
658 views

How secure is CiviCRM?

How does CiviCRM keep our data secure? Is the program web-based? Or is it desktop based? I am interested in downloading and trying CiviCRM for our organization but can't find an information on ...
user avatar
2 votes
2 answers
2k views

Cron not working after forcing https

TL;DR: Does anyone know why forcing https would break CiviCRM's cron jobs? A few days ago, I edited my .htaccess file to rewrite URLs to always use https, using the following code: RewriteEngine On ...
user avatar
  • 1,047
1 vote
1 answer
84 views

Security Vulnerability in Dashboard CiviCRM 4.6 for Drupal 7

I am currently testing the dashboard feature before enabling it on a production site. There seems to be a vulnerability in the Dashboard where a contact who only has "View my contact" permission and ...
user avatar
  • 2,067
4 votes
2 answers
152 views

Security approach

As someone responsible for IT-security, I have to state that everything has been done that can reasonably be expected to keep people’s data safe. Therefore I want to ask in the round: Did you do ...
user avatar
3 votes
1 answer
51 views

Need help in getting quote for security upgrades

We are a small non-profit using CiviCRM. We are currently being charged a lot for security upgrades and monitoring. We are trying to understand pricing and what we actually need. We want to change ...
user avatar
0 votes
1 answer
278 views

How do I perform a security update [duplicate]

When logging on today, I got the following alert: "Jmanage Security Update Required New security release 4.7.11 is available. The site is currently running 4.7.9." What steps do I need to perform to ...
user avatar
1 vote
1 answer
64 views

Does Civi CRM have ISO 27001? And is it compliant with ISO 27002 and ISO 27017?

Does Civi CRM have ISO 27001? And is it compliant with ISO 27002 and ISO 27017?
user avatar
5 votes
2 answers
583 views

How do I update CiviCRM following a security update?

I am getting a warning to update security. It says: New security release 4.7.9 is available. The site is currently running 4.7.3. How do I update it? Thanks. Melissa Brooklyn Commons ...
user avatar
0 votes
1 answer
60 views

Setting up API access for WordPress installation

I'm using civicrm's API to pull country and state data from CiviCRM into a Gravity Forms address pull-down list. The current webhooks between Gravity Forms and CiviCRM are failing because Gravity ...
user avatar
5 votes
1 answer
118 views

Is automatic new Drupal user to existing CiviCRM contact linking a possible security vulnterability?

According to this CiviCRM wiki page, when a new Drupal user is created, its e-mail address is checked against the CiviCRM contacts list and, if a match is found, the new user is associated with the ...
user avatar
1 vote
1 answer
58 views

Outdated CiviCRM, blind SQL injection risk on parameters? (PCI compliance failure)

on CiviCRM 4.5.4 on Drupal, PCI vendor is reporting errors along the lines of: Using the GET HTTP method, XYZ found that : + The following resources may be vulnerable to blind SQL injection : + ...
user avatar
  • 113
1 vote
1 answer
864 views

Call to undefined function dl() error w/Joomla 3.5.1 & PHP 7

I've just installed CiviCRM on a Joomla 3.5.1 site to learn how to use it. I am seeing an issue that I have a question about. As long as I use Php 5.6 the installation works properly. If I try to ...
user avatar
  • 51
2 votes
3 answers
231 views

Storing Personally Identifiable Information

Is anyone storing Personally Identifiable Information (PII), such as Social Security Numbers (SSN), in their database? How would I encrypt such a field in the database? I'm expecting that it would ...
user avatar
  • 1,116
0 votes
2 answers
152 views

Is CiviCRM HIPPA compliant? [duplicate]

We are a non-profit mental health organization and require our records to be secure.
user avatar
2 votes
1 answer
39 views

How many levels of security can I set for a data base of 12000 people with their confidential data?

I am planning to set up a database of 12000 members. The database will include considerable amount of personal and confidential data. How many levels of access can I set up - each level graded to ...
user avatar