4

I've not tried all these options out, but looking at the documentation for Payment Processors (user guide and system administrators guide there is more than one PayPal payment processor. With PayPal Standard all the credit card details are collected on the PayPal site and with PayPal Pro they are collected on your site and transferred by SSL but not kept. ...


3

Adapted from my response on MM: In terms of penetration testing that's host specific, the point of penetration testing is to test the entire system, it's as much about your local/server configuration as the PHP code. The CiviCRM codebase has benefitted from several third party audits for security which have resulted in security releases but, and this is ...


2

The first problem can be avoided by checking 'Skip IDS check' in Drupal permissions. I have this checked for my clients, and it hasn't resulted in any problems. The second message is 'normal' - I'm getting this message too for my clients. I guess it's some PHP warning?


1

I've often run into trouble with shared hosts' use of ModSecurity, but those that are willing to tweak the rules have always managed to make it work. Expect to do some testing!


1

It's a SQL injection attempt, where it's looking to see if it gets used in a query and alters it. Depending on the query where it gets used, it could do nothing or it could do something, but at the very least tells the attacker if it's vulnerable. Simple example, where it does nothing: If civi had code like this, where it doesn't escape the value: $reset = ...


Only top voted, non community-wiki answers of a minimum length are eligible