administration

Lesson Nine of my special Getting Started With Drupal series of videos.

This lesson provides instruction on how to move a localhost Drupal site to a web server. Steps shown in the video include creating a domain, creating a web database, exporting the local drupal database and importing the exported database to the web database.

The premium version is a full resolution (1024x768) version that contains additional content as indicated below.

I've had good reason to think about security on my Drupal sites lately. This site and a few others were hacked recently. The result of the hacking was a script injected into both the generated pages and the RSS feeds of the site. I picked up on the hack pretty fast because the RSS feeds on the site were not behaving correctly and that broke something else that relies on the feeds to work. I also checked the site in Internet Explorer and things weren't displaying properly.

I spent about an hour investigating the issues before I realized that the site had been hacked for sure. One of the first things I did once I realized that the site had been hacked was that I took it offline. Whatever the script that had been injected into the site was doing it couldn't have been good. Then I took steps to correct the situation.

Since multiple sites were affected I assumed that somehow an FTP user password (which I thought was obscure enough) had been compromised. So I changed every password I could think of. Then I uploaded the latest version of Drupal to all of my sites. Next I checked the directories to see if there were any suspicious files remaining. Finally I checked the site RSS feeds and pages for signs of the script that I had found when I discovered the problems. It was only after taking those steps that I brought the sites back online.

The process was time consuming and painful enough for me to cause me to remember how important security is for any type of site you put up on the web. I should've known better since I've been caught by spammers before, but it's been a long time so I got a bit complacent.

I'd like to pass on some tips (and links to related modules) that can give you an idea of some of the security features to take advantage of when you're using Drupal.

From time to time people will ask me questions about problems they are having with content not displaying properly in nodes. Site developers may have problems displaying images, javascript, flash and php code. The problem is usually related to the input format chosen when publishing the node. The following video provides a very detailed look at how input formats work within Drupal.

Quicktime Video

Input Format Basics

There are three "out of the box" input formats for Drupal. These formats can be found on your site at admin/settings/filters.

1. Filtered HTML - This format allows very basic text input and some HTML. This is a good format for comments and user generated content since it limits the ability of the user to add malicious code to the node.
2. Full HTML - This format allows the full range of HTML tags including <embed> codes that are typically used for inserting widgets or embedded videos. This is my preferred format as a site administrator for creating all nodes and blocks on my sites. You can open this up to site users but it's recommended only for logged in users that have accounts at your site.
3. PHP Code -  This format allows the posting of PHP code. This is used to customize the nodes on your site. There is a gallery of PHP snippets on Drupal.org where you can find examples thay may help extend the features of your site. This is a format that should only be available to admin users of the site. Opening up the PHP format to users jeopardizes the security of the site. So take great care when using this format.

The input formats in Drupal are highly customizable so you're not stuck with the exact formats that come standard with Drupal. Since these input formats greatly effect how and what content is posted to your site it is definitely a worthwhile investment of time to get to know them better.