CODEWITHSUNDEEP
phpsecuritydrupaldrupal-7
TheLQ
TheLQ

Reputation: 15008

Where to store sensitive information in a Drupal Module?

In a module I'm creating I have some sensitive information I need to store securely: A remote database host, username, and password.

It seems that the only storage available is in the Drupal database, which worries me since this means if Drupal is compromised so is this other database. The settings.php file in sites/all/default was my second option, but I'm having trouble writing to it. Various chmod commands in FTP and SSH to 777 and 666 won't open the file to writing. I'm also not sure if the variables I set there are available anywhere else.

Are there any other ways to store this information securely?

Upvotes: 4

Views: 845

Answers (3)

rook
rook

Reputation: 67019

Using a config file is ideal for this type of information. However doing a chmod 777 or 666 is a really bad idea. The problem is that both of these settings allow the file GLOBALLY read/write. So if you are on a shared host, then its possible for another user on the system to access your file. On install trying using php's chmod() function to do a chmod 500 on the file. (500 should work in most cases, the most important part is that the last number is zero).

Upvotes: 0

Matt V.
Matt V.

Reputation: 9809

You're on the right track using settings.php. You can use the $conf variable in settings.php to set variables that you can access in modules using variable_get.

Upvotes: 3

Endophage
Endophage

Reputation: 21473

Hmmm... this seems like something you shouldn't do in general. Write an API that sits at the remote database that you can access.

If however you insist on direct database access. Hard code the host, username and password in a file, put the file outside your document root and include it from there. For example, if your document root (i.e. where Drupal's index.php file is) was /www/htdocs, put a file containing the info at something like /www/secure and include it where you need it. Then if php stops working for some reason, the file isn't in a readable location to the outside world but PHP can include it within the site as necessary.

Sure somebody might see that you were including the file but they wouldn't be able to see the file itself unless they hacked your server (rather than just Drupal) and in that situation, your pretty much screwed anyway.

Upvotes: 3

Related Questions