Timeline for How to prevent emails, api keys hashes, being stored in config and instead use a non-git controlled env-specific settings.php file instead for them
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 3 at 4:31 | comment | added | Patrick Kenny | @therobyouknow Yes, Drupal 11 now issues a basic warning about this! | |
| Aug 3 at 1:57 | comment | added | therobyouknow | +1 finally accepted. I've just adjustment my site today and tested and it works great - so... thank you very much. Also Drupal 11 out today so wondering if that issue has been worked on, as the comments there indicated: drupal.org/project/drupal/issues/2408549 | |
| Aug 3 at 1:56 | vote | accept | therobyouknow | ||
| Jul 8 at 22:36 | comment | added | Patrick Kenny | Unique !== sensitive. UUIDs are basically equivalent to UIDs/NIDs, and if you are using something like JSON:API, they are all public even if your site's code is not available. | |
| Jul 8 at 14:53 | comment | added | therobyouknow |
working towards marking this answer as accepted. In doing so I'm looking at any other personal/sensitive info in config. What do you think of uuid and default_config_hash - these appear to be unique. I wouldn't want these in my published open source either, this answer somewhat addresses it but wish Drupal/Drush provided some built-in automation drupal.stackexchange.com/questions/295320/…
|
|
| Jul 7 at 23:03 | comment | added | therobyouknow | +1 thank you @Patrick Kenny. Success: with your advice, I found that what I did actually worked. As you say the overriden config isn't displayed. I will checkout [drupal.org/project/coi](Config Override Inspector). This will likely be the accepted answer. I will do some further tests and then follow up here. Thanks again. | |
| Jul 7 at 22:23 | history | answered | Patrick Kenny | CC BY-SA 4.0 |