0

we have a local community site for drupal and site is run by volunteer admins. my question is, is there any way I can 'hide' passwords in module settings? some modules ask for user password of the service they integrate. it's not safe to have them in plain text in their settings page.

and I don't want to restrict access to those module settings.

this is a common issue with drupal. you can create the permission using hook_permission in your own module. then in your own module use hook_form_alter, find the form of the module andon those password fields use '#access' => user_access('your_permission'). but I have no idea how.

for example, Bot module has a password field. Mailchimp has API Secret field. etc

4
  • "You should only ask practical, answerable questions based on actual problems that you face." - please provide the name of a module, and tell us how it is not "Issues found in existing modules" - if module has a security hole, you should file a bugreport in module's issue queue, not ask here.
    – Mołot
    Nov 22, 2013 at 11:35
  • this is a common issue with drupal. you can create the permission using hook_permission in your own module. then in your own module use hook_form_alter, find the form of the module andon those password fields use '#access' => user_access('your_permission'). but I have no idea how to do these stuff, hence asking here Nov 22, 2013 at 12:39
  • for example, Bot module has a password field. Mailchimp has API Secret field. etc Nov 22, 2013 at 12:40
  • Please edit your question. Data provided in comments may get purged without notice.
    – Mołot
    Nov 22, 2013 at 12:42

2 Answers 2

1

As you've already noted in the question, you can set '#access' => FALSE to any form element to remove it from display.

The correct place for this is in hook_form_alter():

function MYMODULE_form_alter(&$form, &$form_state, $form_id) {
  if ($form_id == 'relevant_form_id') {
    $form['some_element']['#access'] = FALSE;
  }
}

If you're asking for a way to do this generically, without having to target each element with a specific form ID/element key, then you're out of luck. Those fields are nothing special, just standard text fields, so there's nothing to distinguish them from any other text field.

Bottom line - you need to decide exactly what fields you want to disable, find the appropriate form IDs/element keys, and use the method above to apply the rule one-by-one.

0

The settings.php is a starter of drupal core, maybe you can put your password in another database(temp database) and fetch them in settings.php , but if another admin access settings.php, also can access you temp database.

I think restrict unix users by groups users in seperate groups and by file permission restrict them to access settings.php .

6
  • Will not help. If settings form reads default value from variable, then it will be displayed no matter where the variable's content is loaded from.
    – Mołot
    Nov 22, 2013 at 15:28
  • Yes , I know, I think only way to do this job is restrict by user group of server.
    – Yuseferi
    Nov 22, 2013 at 15:30
  • that doesn't help since other admins can still see module passwords. I'm not talking about db pass and other stuff. those can be omitted in gitignore file Dec 12, 2013 at 16:53
  • @HadiFarnoud you said "my question is, is there any way I can 'hide' passwords in module settings?" !!!
    – Yuseferi
    Dec 13, 2013 at 7:28
  • yeah, I meant in /admin/config/[module] Dec 14, 2013 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.