1

I have set up continuous integration for a Drupal site. After every git push the site is built remotely from scratch in a Docker container. It runs a site install, sets the site's UUID to import the configs, creates some sample content and then runs Behat tests.

For simplicity I'd simply commit the UUID in a text file and then import it like so:

drush cset system.site uuid "$(< sites/default/uuid.txt)"

The underlying question I have is if it's OK – from a security point of perspective - to commit a site's UUID into a public Git repo? Does that create any vulnerabilities to my site?

Improve this question

1 Answer 1

Reset to default
1

Sorry, only after I created the question it came to my mind that the UUID itself already may be present inside a config YAML. And indeed it is. Inside system.site.yml. So, I guess when it's OK to have it printed inside a config YAML – with the purpose to get version tracked – it's no problem to have it inside a text file as well.

Improve this answer
1
  • I guess the only difference being that most web servers will be default-configured to allow the contents of txt files to be served, but not yml files. So there's probably still a slight security concern for some people
    – Clive ♦
    Sep 8, 2017 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.