0

we have a local community site for drupal and site is run by volunteer admins. my question is, is there any way I can 'hide' passwords in module settings? some modules ask for user password of the service they integrate. it's not safe to have them in plain text in their settings page.

and I don't want to restrict access to those module settings.

this is a common issue with drupal. you can create the permission using hook_permission in your own module. then in your own module use hook_form_alter, find the form of the module andon those password fields use '#access' => user_access('your_permission'). but I have no idea how.

for example, Bot module has a password field. Mailchimp has API Secret field. etc

  • "You should only ask practical, answerable questions based on actual problems that you face." - please provide the name of a module, and tell us how it is not "Issues found in existing modules" - if module has a security hole, you should file a bugreport in module's issue queue, not ask here. – Mołot Nov 22 '13 at 11:35
  • this is a common issue with drupal. you can create the permission using hook_permission in your own module. then in your own module use hook_form_alter, find the form of the module andon those password fields use '#access' => user_access('your_permission'). but I have no idea how to do these stuff, hence asking here – Hadi Farnoud Nov 22 '13 at 12:39
  • for example, Bot module has a password field. Mailchimp has API Secret field. etc – Hadi Farnoud Nov 22 '13 at 12:40
  • Please edit your question. Data provided in comments may get purged without notice. – Mołot Nov 22 '13 at 12:42
1

As you've already noted in the question, you can set '#access' => FALSE to any form element to remove it from display.

The correct place for this is in hook_form_alter():

function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
  if ($form_id == 'relevant_form_id') {
    $form['some_element']['#access'] = FALSE;
  }
}

If you're asking for a way to do this generically, without having to target each element with a specific form ID/element key, then you're out of luck. Those fields are nothing special, just standard text fields, so there's nothing to distinguish them from any other text field.

Bottom line - you need to decide exactly what fields you want to disable, find the appropriate form IDs/element keys, and use the method above to apply the rule one-by-one.

0

The settings.php is a starter of drupal core, maybe you can put your password in another database(temp database) and fetch them in settings.php , but if another admin access settings.php, also can access you temp database.

I think restrict unix users by groups users in seperate groups and by file permission restrict them to access settings.php .

  • Will not help. If settings form reads default value from variable, then it will be displayed no matter where the variable's content is loaded from. – Mołot Nov 22 '13 at 15:28
  • Yes , I know, I think only way to do this job is restrict by user group of server. – Yusef Mohamadi Nov 22 '13 at 15:30
  • that doesn't help since other admins can still see module passwords. I'm not talking about db pass and other stuff. those can be omitted in gitignore file – Hadi Farnoud Dec 12 '13 at 16:53
  • @HadiFarnoud you said "my question is, is there any way I can 'hide' passwords in module settings?" !!! – Yusef Mohamadi Dec 13 '13 at 7:28
  • yeah, I meant in /admin/config/[module] – Hadi Farnoud Dec 14 '13 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.