Problem/Motivation

Identified by Codex 5.5:

- High: Firebase service-account JSON supplied through a config override can
be rendered into the admin form. anata/web/modules/orig/firebase_php/src/
Form/FirebasePhpConfigurationForm.php:58 uses the resolved config value as
the textfield default. If settings.php injects raw credentials JSON, any
user with administer site configuration can view the private key in the
page HTML. Use editable/stored config for display, or mask/blank overridden
secret values.

Issue fork firebase_php-3593735

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

ptmkenny created an issue. See original summary.

ptmkenny opened merge request !58

  • ptmkenny committed aaef923d on 8.0.x 
    fix: #3593735 Security hardening: Do not expose settings.php overrides (...
ptmkenny’s picture

ptmkenny commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.