Closed DCBT closed 3 years ago
I think this could be done...
+1 I think that with the current configuration there could be really really easy that users will update the user/plugin/config/email.yaml
with password and other sensible data. Is there any hashed password available? As for the admin plugin?
This issue is solved with the Dotenv plugin - https://github.com/Ralla/grav-plugin-dotenv/
I was also able to solve the issue with the dotenv plugin:
plugins.email.mailer.smtp.password='<password>'
I guess that is the best way to inject the password, isnt it @rhukster ?
Environment variables are the 'safest' way to handle passwords such as these, but a lot of people simply don't have shell access and probably don't have the expertise to deal with environment variables.
I think the dotenv
plugin solves the problem perfectly. I will probably use it myself 👍
I'm hosting in Heroku, direct from GitHub, and didn't want to expose my SendGrid API key in the repo.
I added a field in the blueprint to allow the user to enter the name of an environmental variable instead of a password:
And altered classes/Email.php to use the environmental variable value if the name was set:
It's not perfect by any means, but it solved a problem I was having.