Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Major Security Flaw - Database Credentials get leaked. #935

Closed
timothymarois opened this issue Feb 9, 2018 · 1 comment
Closed

Major Security Flaw - Database Credentials get leaked. #935

timothymarois opened this issue Feb 9, 2018 · 1 comment

Comments

@timothymarois
Copy link
Contributor

timothymarois commented Feb 9, 2018

It appears on php errors, using development mode, the database credentials get leaked from the config variables.

[db] => CodeIgniter\Database\MySQLi\Connection Object

[hostname] 
[username]
[password] 
[database] 

It appears the database config is public, these variables should be concealed, at least to protected or private. Development or production mode, never should I see database credentials printed on the screen.

That is why we have a .env file on each environment to protect the application from unauthorized users, or hacks and even developers from seeing true credentials of the database.

@lonnieezell
Copy link
Member

I don't know that I'd say it's a "major" flaw. They would never be seen in production. And the .env file is to keep credentials out of repos. But I've fixed it all the same. Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants