search

c10b10 / wp-cli-deploy

A WP-Cli command that allows you to deploy the local database or uploads directory to a remote server using ssh.
173 stars 25 forks source link

Security: put SSH user and password (or complete configuration) into external file #23

Closed davidsneighbour closed 8 years ago

davidsneighbour commented 8 years ago

As per README.txt I am supposed to enter my SSH username and password into the wp-config.php file. This is an insecure in my opinion and I do not see why I should expose these in a file inside of the WordPress directory. If someone gets access to this file I expose my whole user account, not only that one single installation.

A better approach would be to put those files in a configuration file that's not inside of the folder we are uploading.

A simple way for paranoids like me would be the option to rsync via sshuser and keyfile or putting the configuration options in a separate file outside of the webroot.

davenaylor commented 8 years ago

The wp-config.php file in question is the one within your local dev environment, i.e. it's on your dev machine or VM.

davidsneighbour commented 8 years ago

ok, I thought wp deploy push staging would upload the whole application directory the server. sorry, first day with this plugin.