search

littleredbutton / bigbluebutton-api-php

Unofficial (but better) PHP API for @BigBlueButton
GNU Lesser General Public License v3.0
24 stars 12 forks source link

Deprecate support for passing BigBlueButton server configuration trough env #189

Closed FelixJacobi closed 2 months ago

FelixJacobi commented 4 months ago 
        $this->securitySecret = $secret ?: getenv('BBB_SECURITY_SALT') ?: getenv('BBB_SECRET');
        $this->bbbServerBaseUrl = $baseUrl ?: getenv('BBB_SERVER_BASE_URL');

This messy construct was the original reason to create this library (originally with no alternative constructor parameter). Since this can lead to dangerous situations, where passing of the secret trough POSIX environment can lead to unintended leakage to unexpected consumers (child processes of PHP), we should deprecate the support for this and remove it.