是否有针对 Drupal（包括常见模块）中的漏洞的良好资源或已知修复列表，我可以使用它们来弥补站点中的漏洞？
我在所有站点上使用 6.19，并确保立即安装模块的所有安全更新。还有什么我可以实际做的吗？ （例如将对所有“/admin”url 的访问限制为一组特定的 IP 地址等）
我知道一些显而易见的内容，例如过滤表单上的用户输入等，但我想知道是否还有其他陷阱担心...
Is there a good resource or list of known fixes for exploits in Drupal (including common modules) that I can use to close up holes in my sites?
I'm using 6.19 on all my sites, as well as making sure that any security updates for modules are installed immediately. Is there anything else I can realistically do? (Such as restricting access to all "/admin" urls to a certain set of IP addresses etc)
I know about the obvious bits, such as filtering user input on forms etc, but I'm wondering if there are other pitfalls I need to worry about...
发布评论
评论（4）
只是所有常见的 PHP 安全性。事实上，只是 OWASP 发布的前 10 名。
然而，Drupal 也充当了一个 Web 应用程序框架。
Drupal 拥有针对所有 10 大 OWASP 问题的安全模型和层。尽管A6（配置）可能会出错。您需要了解自己在做什么，并且需要详细阅读 Drupals 管理中的在线帮助。您可能会通过更改设置轻松打开安全漏洞，而不知道它们到底做了什么。例如：我见过许多 Drupal 站点将默认的“输入格式”切换为 Full HTML，因为他们认为这对编辑人员有帮助，但没有意识到这使得这种格式成为所有内容（包括评论）的过滤器。到处开放 XSS 发布。 Drupals 在线帮助提到了这一点，但人们通常不会阅读:)
另一件需要意识到的事情是，Drupal 不会预先扫描代码。人们必须阅读代码并报告发现的安全问题，然后才能进行处理。如果您运行许多第三方模块，则几乎可以肯定其中至少有一个模块存在安全漏洞。如果你想避免这种情况，你必须扫描自己，否则就完全避免这样的模块。
Just all the common PHP security. In fact, just the top 10 as published by OWASP.
However, Drupal acts as a web-application framework, a little here too.
Drupal has security models and layers in place for all top10 OWASP issues. Allthough A6 (configuration) can go wrong. You will need to understand what you are doing and need to read the online help in Drupals admin in detail. You might open up security holes easily by changing settings, without knowing what they do exactly. For example: I have seen many Drupal sites that switch the default "input format" to e.g. Full HTML, because they think that helps editors, not realising that this makes this format the filter for all content, including comments. Opening up XSS-posting all over the place. Drupals online help mentions this, but people often don't read that :)
Another thing to realise, is that Drupal does not scan code upfront. People must read trough code, and report found security issues, before they are dealt with. If you run many thrid party modules, you can be almost assured at least one of them will have a security hole in them. If you want to avoid that, you must scan yourself, or else avoid such modules alltogether.
Drupal 本身非常安全，但它的模块却不然。您最有可能因修改默认的 Drupal 安装而遭到黑客攻击。
也就是说，您应该安装Web 应用程序防火墙。确保使用 PHPSecInfo 和 锁定 MySQL。 （
FILE权限是您可以授予 Web 应用程序的最差权限）Drupal its self is pretty secure, however its modules are not. You are most likely to be hacked by modifying your default Drupal install.
That being said you should install a Web Application Firewall. Make sure php is configured correctly with PHPSecInfo and lock down MySQL. (
FILEprivilege is the worst privilege you can give to a web application)考虑到您使用 Drupal 核心和一些最流行的模块，它是相当安全的。不过，您需要记住一些事情：
Considering you use Drupal core and few most popular modules, it is pretty secure. Still, you need to remember few things:
这是一本关于 Drupal 安全性主题的书：
http://www.amazon.com /Cracking-Drupal-Bucket-Greg-Knaddison/dp/0470429038
Here is a book on the topic of Drupal security:
http://www.amazon.com/Cracking-Drupal-Bucket-Greg-Knaddison/dp/0470429038