About
This is my personal site. Whatever I find interesting may find its way here. Comments on this site are moderated. It may take a while for them to appear.
What's with all this 'Drupal' stuff?
Drupal is a great, free (GPL v2) content management system / content management framework. I've been involved with Drupal for about seven years now.
I (co) maintained the following modules:
- MyCaptcha - an easy to use math and image CAPTCHA implementation.
- Comment mover - move comments to other posts, or convert comments to posts and vice versa.
- Elements - provides a number of new form element types.
- User badges - give roles or individual users a badge for display.
- Comment upload - enable attachments on comments.
- Taxonomy defaults - assign preselected or default terms to new posts.
- Form store - provide other modules (eg Captcha) with a list of forms.
- Form inspect - ease development using hook_form_alter by displaying form IDs and form structures.
I was the Drupal security team's technical lead from July 2006 until October 2011.
I found the following vulnerabilities in Drupal core:
- SQL injection via Entity Reference autocomplete in Drupal 8 prerelease
- Access bypass of token validation
- Arbitrary PHP code execution and Information disclosure
- Cross site scripting via Exceptions in Drupal 7 prerelease
- Potential SQL injection weakness in Drupal 7 prerelease (2x)
- Arbitrary code execution via comment previews
- SQL injection via the numeric query placeholder %n
- Reflected cross site scripting vulnerability in the Drupal 6 error handler
- OpenID authentication bypass
- OpenID association cross site request forgeries
- File upload extensions not properly processed
- BlogAPI access bypass
- Cross site request forgeries on cachable forms
- Cross site request forgeries of uploads
- Translated string deletion via cross site request forgeries
I found the following vulnerabilities in contributed modules:
- Encrypt - Weak encryption (also reported by Chad DeGroot)
- Secure Cookie Data - Cookie tampering due to incorrect hash compare
- Arbitrary PHP code execution via CSRF in Views UI, CTools Page manager and derived modules
- Context - Remote code execution / Access bypass
- Login security - Multiple vulnerabilities (DOS also reported by dstol)
- Bakery SSO access bypass (login as any user).
- CKeditor and FCKEditor arbitrary PHP code execution and XSS
- Drupad cross site request forgeries
- Live preview cross site request forgeries (possible arbitrary code execution)
- Private upload access bypass
- Droptor SQL injection
- Database administration cross site request forgeries
- Aggregation vulnerabilities
- Project & project issue file handling
Contact
I only provide free Drupal support on the Drupal.org forum or in the drupal channels on irc.freenode.net.
IRC | Heine in #drupal on irc.freenode.net |
Drupal Slack | heine (not to be confused with the user "Heine" on Slack) |
@Ustima |