Security!
Mon, 2007-02-12 21:42 — rtennant
I've recently had a run-in with someone who was somehow able to insert code into some PHP and HTML files on my site. Needless to say I've cleaned the files and dialed back file permissions, but what else can/should I do? I'm afraid I find the drupal.org site rather hopeless for this information. I'm still on 4.6.3, believe it or not! Thanks,
Roy
This work is licensed under a Creative Commons Attribution- NonCommercial- ShareAlike 2.5 License.
Several more security holes
Several more security holes have been identified since 4.6.3. How about upgrading to 4.6.11 ? -> http://www.drupal.org/download
If you want to patch release by release, I found them by searching on Google for site:drupal.org 4.6 security
I keep up with the Drupal.org security announcements feed from http://drupal.org/taxonomy/term/44/0.
Two-sided coin
I'm amazed at and grateful for everything that Drupal does for a website maintainer, but I find that keeping up with security patches is one of the downsides to using Drupal (the other is juggling the various module dependencies). I would imagine that these two 'problems' apply to any open source app that has a large and active user base, however.
Roy, are you on the Drupal security bulletin email list (http://drupal.org/security)? The security team is excellent, but it is unfortunate that so many XSS and SQL injection bugs get into the code.
Post new comment