Closed mbollmann closed 7 years ago
Original comment by Marcel Bollmann (Bitbucket: mbollmann, GitHub: mbollmann):
Configuration data has been refactored as per commit b3ed57b.
It is still in the main web directory by default (
Meanwhile, one idea to move sensible config data out of the web directory: replace config.php with a symbolic link pointing to a location outside the web directory, and configure the web server to not follow symlinks in
Original comment by Marcel Bollmann (Bitbucket: mbollmann, GitHub: mbollmann):
Apparently, other projects (like MediaWiki) are doing something similar.
Also, with the new CMake build system, configuration data such as passwords are at least no longer stored in the repo.
Putting this on hold for now.
Originally reported by: Marcel Bollmann (Bitbucket: mbollmann, GitHub: mbollmann)
Server-specific configuration should not be stored in globals.php, but in some external configuration file.
Particularly, passwords shouldn't be stored in a web-accessible directory, as is currently the case with this setup.