In the default installation, settings.php is located at sites/default/. There are no recommendations in the official Drupal website about changing the location of this file. Doesn't it pose a potential problem of security? I have seen Apache webservers eventually failing to interpret PHP files, and serving the content of the PHP file in pure plain/text format, instead of the supposed HTML content. That would completely expose the database connection user and password, which is not even encrypted. Why does it work this way?
Add a comment
|
2 Answers
You are absolutely correct. I know for a fact that many developers/sysadmins do not take the risk that the PHP interpreter might fail at some point, and include the db password (and other sensitive data like API keys) from a file outside the webserver's docroot.
I'm surprised that this is not documented as a best practice anywhere - at least I couldn't find it on drupal.org either. I have no information why it works the way it does.
answered Jan 18, 2016 at 16:19
-
6I remember seeing a discussion between core/well known devs some years back where they argued against moving sensitive data out of the web root. I remember being quite horrified at the time. If memory serves me right, I think the argument was related to to Drupal needing to work out of the box on shared hosting, and these recommendations would make that harder to realise for the masses or something like that. I'll see if I can find that discussion– Clive ♦Jan 18, 2016 at 16:25
-
1Thanks @Clive. I didn't want to add speculations to my answer, but like you say, the requirement to work out-of-the-box on all kinds of environments seems the most likely reason to have settings.php inside the docroot. Jan 19, 2016 at 8:16
-
Yes, @marcvangend, this is what I thought myself, but somehow an automatic procedure may be available during installation which checks if there are the appropriate write/owner permissions at the server level, and if this is the case, to provide additional security, in a standarized and controlled (via core methodology) way.– CesarJan 19, 2016 at 15:17
On some providers this sensitive connection string is stored external to the web root (i.e., getpantheon.com) You can always create some symbolic links instead of storing directly in /sites/default folder.
