Security

There are better systems for doing XMLRPC calls, e.g. look at http://drupal.org/project/services

The XMLRPC API exposes two functions - in most cases you will only want to use one.

  xmlrpc_api_query($xmlrpcuri, $method, $arguments)

xmlrpcuri supports this format:

[http/ssl]://[Basic:Digest][user:pass]@[name|address]:[port]/[path]

Note two things:

The Client Side Encryption (CSE) module is developed to provide a means of encrypting and decrypting sensitive information (such as computer IPs, non-public email addresses etc.) completely within the web browser. This means neither the network nor any server php code gets to see any plain text content that it shouldn't. Plain text can be intermixed with encrypted text on a page meaning only sensitive parts can be hidden.

This module allows administrators to control node access based on permissions. In drupal access control is based on the permissions
granted to a role. However most of the access control modules are based on roles and not permissions.

Ponto Keychains is a generic module that allows one to save authentication bits for later use. This module should be thought of as an API with a user facing interface.

Requirements:

Cipher

Cipher is purely a generic API to encrypt and decrypt data. One should only need to install this module if it is asked for by another module as a dependency.

Gives content access permissions to users for content that references the users with User reference or Entity reference.

Allows a node to generate a password for itself that users must enter into their profile to be able to see that node.

The idea is that someone who has access to the node anyway (e.g., because of their user role) will be shown the password which they can then give to somebody else in person.

This module is incomplete. Nodeaccess Userreference is what you should use.

With Userreference Access, site administrators can choose to give additional view or edit access to users who are associated with a node by userreference fields.

This module was originally developed by AgaricDesign | A Multimedia Collective.

This module does not protect your site's file integrity. Only you can do that by configuring the site correctly and by not installing insecure software. It can be used to check a Drupal site for file integrity breeches.

This module lets the site maintainer “fingerprint” an entire site (except the files below the public:// upload directory) when it is in an untainted state. It can then be configured to periodically compare the site to this “fingerprint”, and report the following:

This module will encrypt outgoing mail your Drupal site if the recipient has uploaded a GPG key to the profile.

Both profile module and user fields will be supported.

There will be an option to not send any body text in case there is no key.