Club Drupal

-- SITE AUDIT USAGE --

Security Review also integrates with https://www.drupal.org/project/site_audit ,

a static site analysis platform that generates reports with actionable best

practice recommendations. Security Review can be installed on an entire

platform, eliminating the need for module installation.

To use, put Security Review either in your codebase or in your Drush command

locations, then:

    # Clear Drush cache.

    drush cc drush

    # Audit security.

    drush audit_security

### Marking field content as known to be safe

The "Dangerous tags in content" check may indicate problems with fields that

you known are safe. You can create a list of field contents and entities

that you want to be skipped in future runs by creating a SHA-256 hash of the

entity_id, entity_type, and field contents. See security_review_check_field

function in security_review.inc for details.

Please use the issue queue at https://drupal.org/project/security_review for all

    'outputformat' => array(

      'default' => 'table',

      'pipe-format' => 'csv',

      'fields-default' => array('message', 'status'),

      'field-labels' => array(

        'message' => 'Message',

        'status' => 'Status',

        'findings' => 'Findings',

      ),

      'output-data-type' => 'format-table',

    ),

  $output = array();

    // Compile results.

        if ($result = _security_review_drush_format_result($check, $short_titles, $show_results)) {

          $output[$module . '-' . $check_name] = $result;

        }

    // Compile results.

          if ($result = _security_review_drush_format_result($check, $short_titles, $show_results)) {

            $output[$check['namespace'] . '-' . $check['reviewcheck']] = $result;

          }

  return $output;

 * Helper function to format Security Review results.

 *

 * @return array|NULL

 *   An array with the security review check's result, or NULL if no result.

function _security_review_drush_format_result($check, $short_titles = FALSE, $show_results = FALSE) {

    $findings = $check['value'];

    $findings = $check['value'];

    if ($show_results && !empty($findings)) {

      $message .= "\n";

      foreach (_security_review_drush_findings_output($check) as $item) {

        $message .= "\t" . $item . "\n";

  return array(

    'message' => $message,

    'status' => $status,

    'findings' => $findings,

  );

/**

 * Implements hook_drush_command_alter().

 */

function security_review_drush_command_alter(&$command) {

  // Adds security_review checks to existing security report.

  if ($command['command'] == 'audit_security') {

    $security_review_checks = array(

      'FilePerms',

      'InputFormats',

      'Field',

      'ErrorReporting',

      'PrivateFiles',

      'UploadExtensions',

      'AdminPermissions',

      'ExecutablePhp',

      'BaseUrlSet',

      'TemporaryFiles',

    );

    foreach ($security_review_checks as $name) {

      $command['checks'][] = array(

        'name' => $name,

        'location' => __DIR__ . '/security_review.site_audit.inc',

      );

    }

  }

}

  $output = '<div class="sec-rev-help-option">';

    $element['findings']['descriptions'][] = t('The following IPs were observed with an abundance of failed login attempts.');

  $element['descriptions'][] = t('Script and PHP code in content does not align with Drupal best practices and may be a vulnerability if an untrusted user is allowed to edit such content. It is recommended you remove such contents or add the hash of the content to the security_review_known_risky_fields system variable (see the README.txt for more information).');

        $html = t('@description found in @field field of <a href="!link">@title</a> (content hash: %hash).', array('@field' => $value[$entity->{$id}]['field'], '@description' => $value[$entity->{$id}]['type'], '!link' => $uri, '@title' => $entity->{$label}, '%hash' => $value[$entity->{$id}]['hash']));

          'safe' => t('@description in @field field of !url', array('@field' => $value[$entity->{$id}]['field'], '@description' => $value[$entity->{$id}]['type'], '!url' => $uri)),

          'raw' => $value[$entity->{$id}]['field'] . ':' . $uri,

    //$element['findings']['pager'] = theme('pager', NULL, 20);

  $checks['name_passwords'] = array(

  );

      if (!empty($all_permissions[$permission]['restrict access'])) {

  $known_risky_fields = explode(',', variable_get('security_review_known_risky_fields', ''));

    // Column & table come from field definitions & are safe to use in a query.

    $sql = "SELECT DISTINCT entity_id, entity_type, " . $info['column'] . " AS field_text FROM {" . $table . "} WHERE " . $info['column'] . " LIKE :text";

          // Only alert on values that are not known to be safe.

          $hash = hash('sha256', implode((array) $result));

          if (!in_array($hash, $known_risky_fields)) {

            $check_result = FALSE;

            $check_result_value[$result->entity_type][$result->entity_id] = array(

              'type' => $vuln_type,

              'field' => $info['name'],

              'hash' => $hash,

            );

          }

  require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');

  // Select users with a trusted role.

  $query = db_select('users', 'u');

  $query->leftJoin('users_roles', 'ur', 'u.uid = ur.uid AND ur.rid IN (:rids)', array(':rids' => $trusted_roles));

  $query->fields('u', array('uid', 'name', 'pass'));

  $query->addExpression('COUNT(rid)', 'count');

  $query->groupBy('u.uid');

  $query->groupBy('u.name');

  $query->groupBy('u.pass');

  $results = $query->execute()->fetchAllAssoc('uid');

  // Find users with the same password as their username.

    if ($row->count > 0 || $row->uid == 1) {

      // Make a psuedo account object to avoid loading the user.

      $account = (object)array(

        'uid' => $row->uid,

        'name' => $row->name,

        'pass' => $row->pass,

      );

      if (user_check_password($row->name, $account)) {

        $weak_users[$row->uid] = $row->name;

      }

; Information added by Drupal.org packaging script on 2017-07-26

version = "7.x-1.3"

datestamp = "1501101849"

  drupal_set_message(t('Security Review module enabled. You should first set the module access permissions at !link. Be sure to grant permissions to trusted users only as this module can show sensitive site information.', array('!link' => l('admin/people/permissions', 'admin/people/permissions'))));

      'result'      => $record->result == '1' ? TRUE : FALSE,

      'skip'        => $record->skip == '1' ? TRUE : FALSE,

  $users = user_load_multiple(array($last_check['skipuid']));

  $account = array_pop($users);

    $output .= '<h3>' . t('Check-specific help') . '</h3>';

<?php

/**

 * @file

 * Contains \SiteAudit\Check\Security security_review checks.

 */

/**

 * Class SecurityReviewSiteAuditCheckAbstract

 */

abstract class SecurityReviewSiteAuditCheckAbstract extends SiteAuditCheckAbstract {

  /**

   * The implementing module.

   * @var string

   */

  protected $module = 'security_review';

  /**

   * The check in question.

   * @var string

   */

  protected $check;

  /**

   * Implements \SiteAudit\Check\Abstract\getLabel().

   */

  public function getLabel() {

    $checks = security_review_get_checklist();

    return $checks[$this->module][$this->check]['title'];

  }

  /**

   * Implements \SiteAudit\Check\Abstract\getDescription().

   */

  public function getDescription() {

    $checks = security_review_get_checklist();

    return dt('Security Check of @title', array(

      '@title' => $checks[$this->module][$this->check]['title'],

    ));

  }

  /**

   * Implements \SiteAudit\Check\Abstract\getResultFail().

   */

  public function getResultFail() {

    $ret_val = $this->registry[$this->module][$this->check]['failure'];

    if (isset($this->registry[$this->module][$this->check]['value'])) {

      if (is_array($this->registry[$this->module][$this->check]['value'])) {

        $ret_val .= $this->generateUl($this->registry[$this->module][$this->check]['value'], drush_get_option('html'));

      }

      elseif ($this->registry[$this->module][$this->check]['value']) {

        $ret_val .= ' Additional: "' . $this->registry[$this->module][$this->check]['value'] . '"';

      }

    }

    return $ret_val;

  }

  /**

   * Generates an unordered list or flattened text version of a nested array.

   *

   * @param array $array

   *   Security Review results.

   * @param bool $html

   *   TRUE if the result should be rendered as HTML.

   * @param int $indentation

   *   The number of spaces; defaults to 6.

   *

   * @return string

   *   Formatted result.

   */

  private function generateUl($array, $html = TRUE, $indentation = 6) {

    $result = $html ? '<ul>' : '';

    foreach ($array as $key => $value) {

      $result .= $html ? '<li>' : PHP_EOL . str_repeat(' ', $indentation);

      $result .= $key . ': ';

      if (is_array($value)) {

        $result .= $this->generateUl($value, $html, $indentation + 2);

      }

      elseif (isset($value->name) && $value->name) {

        $result .= $value->name;

      }

      elseif ($value) {

        $result .= $value;

      }

      $result .= $html ? '</li>' : '';

    }

    $result .= $html ? '</ul>' : '';

    return $result;

  }

  /**

   * Implements \SiteAudit\Check\Abstract\getResultInfo().

   */

  public function getResultInfo() {}

  /**

   * Implements \SiteAudit\Check\Abstract\getResultPass().

   */

  public function getResultPass() {

    return $this->registry[$this->module][$this->check]['success'];

  }

  /**

   * Implements \SiteAudit\Check\Abstract\getResultWarn().

   */

  public function getResultWarn() {}

  /**

   * Implements \SiteAudit\Check\Abstract\getAction().

   */

  public function getAction() {}

  /**

   * Implements \SiteAudit\Check\Abstract\calculateScore().

   */

  public function calculateScore() {

    $checks = security_review_get_checklist();

    $checklist_results = security_review_run(array(

      $this->module => array($checks[$this->module][$this->check]),

    ));

    $this->registry[$this->module][$this->check] = $checklist_results['security_review'][0];

    if (!$this->registry[$this->module][$this->check]['result']) {

      return SiteAuditCheckAbstract::AUDIT_CHECK_SCORE_FAIL;

    }

    else {

      return SiteAuditCheckAbstract::AUDIT_CHECK_SCORE_PASS;

    }

  }

}

class SiteAuditCheckSecurityFilePerms extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'file_perms';

  /**

   * Implements \SiteAudit\Check\Abstract\getResultWarn().

   */

  public function getResultFail() {

    if (drush_get_option('detail')) {

      return parent::getResultFail();

    }

    return $this->registry[$this->module][$this->check]['failure'];

  }

}

class SiteAuditCheckSecurityInputFormats extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'input_formats';

}

class SiteAuditCheckSecurityField extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'field';

}

class SiteAuditCheckSecurityErrorReporting extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'error_reporting';

}

class SiteAuditCheckSecurityPrivateFiles extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'private_files';

}

class SiteAuditCheckSecurityUploadExtensions extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'upload_extensions';

}

class SiteAuditCheckSecurityAdminPermissions extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'admin_permissions';

}

class SiteAuditCheckSecurityExecutablePhp extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'executable_php';

}

class SiteAuditCheckSecurityBaseUrlSet extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'base_url_set';

}

class SiteAuditCheckSecurityTemporaryFiles extends SecurityReviewSiteAuditCheckAbstract {

  protected $check = 'temporary_files';

}

      'administer fields',