Every time we need to install or uninstall module, we always input our ftp username and password again and again,.. isn't it better if there is an option to save the password and then hide it?

thanks,.. nice 'must have' module..

Comments

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

This is a bad idea for security reasons. It is purposeful that you enter the password every time.

jabapyth’s picture

jabapyth commented
Status: Active » Closed (won't fix)

there is the option to save your username, but to save the password would mean more security concessions than we're willing to make. This module was created with security as a priority, and saving your password is one thing we definitely wont fix.

Thanks for your interest in Plugin Manager.

panji’s picture

panji commented

isn't there any secure way to save password? save it to the database and encrypt the password?
It's on the admin panel anyway, and let the admin choose weather to save the passw or not..

thanks

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

If Drupal hashes the password it then we can no longer access it.

If Drupal encrypts it and has a way to decrypt it then an attacker also has a way to decrypt it using Drupal.

spade’s picture

spade commented
Version: 6.x-1.x-dev » 7.x-1.x-dev

Everything considered, wouldn't it be an option to store the password for a limited time, let's say five minutes and have the counter reset whenever I user FTP within those five minutes. That would allow me to install several modules in a setting without having to enter the password every time.

spade’s picture

spade commented

Drupal only needs FTP username and password if it doesn't already have the right to write to the filesystem. Make sure group and owner name are the same and it will work like a charm.