OllieJones / sqlite-object-cache

A WordPress persistent object cache for the rest of us.
GNU General Public License v2.0
24 stars 4 forks source link

Option to change default DB file name #7

Closed nawawi closed 1 year ago

nawawi commented 1 year ago

Hi there,

Thanks for your great work.

Currently, by default, we can download the DB file (siteurl/wp-content/object-cache.sqlite) which can lead to security issues. For example, from the downloaded DB file we can extract user info:

select * from object_cache where name like '%user%';

image

My suggestions:

  1. Rename it with the prefix ".ht" which by default most web server configurations prevent access to the file. For example ".ht.object-cache.sqlite"
  2. Have the option to change the DB file name and location.

Thanks.

OllieJones commented 1 year ago

Good catch, thank you.

OllieJones commented 1 year ago

Thanks for this bug report, it's fixed in v 1.0.0.

nawawi commented 1 year ago

Thanks!