rawilk / laravel-settings

Store Laravel application settings in the database.
https://randallwilk.dev/docs/laravel-settings
MIT License
199 stars 17 forks source link

Decryption issue with cached defaults #2

Closed rawilk closed 4 years ago

rawilk commented 4 years ago

When caching is enabled and you get a setting while passing it a default value, the default value will be cached upon retrieval, even if the setting is not persisted. If encryption is enabled for the package, this can be problematic because the cached default value is not encrypted in the cache.

Example:

Settings::get('not_exists', 'some default');

When the not_exists setting is retrieved, the value some default will be cached, but not encrypted since the setting does not exist in the database. If that same code is called again, but a different default value is provided, a decryption error is going to be thrown since a "persisted" value was "found", but it differs from the default that was passed in the second time, so the package is going to try and decrypt it.

Settings::get('not_exists', 'some other default');
// decryption exception will be thrown here