0

We are using Drupal 8.6.3.

I want to store some configuration in file system (in settings.php or some other file outside Web Root).

Can a Drupal Site Administrator view that configuration?

What parts of settings.php file can be viewed by a Drupal Site Administrator?

1 Answer 1

0

For brevity, it helps to think about this question in terms of roles/permissions (since "site admin" is an overloaded term):

Does the ____ role have an escalated permission to:

  • Write arbitrary files to the server?
  • Execute arbitrary code on the server?

If the first/second answer is "Yes," the answer would be:

____ role could probably come up with a clever way to read the entire contents of settings.php by injecting/running arbitrary code.

 

Generally, Drupal core tries to signal these potentially dangerous permissions with this warning:

Warning: Give to trusted roles only; this permission has security implications.

However, there are many contrib modules out there that could have exploits (some known, some not) so you'll always have to take pro-active security steps like the principle of least privilege (if a role doesn't need a privilege to do the job, don't give it to them).

This also applies to your whole system (DB, web server, etc.), not just Drupal.

1
  • 1
    Also a site admin. may be able to view variables that is stored statically in $conf if they have permission to view the user interface that configures that variable.
    – mradcliffe
    Commented Apr 12, 2019 at 1:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.