I'm not sure how it could be done better, but storing this password as plaintext seems as though it could be a tad insecure?

Now I suppose I'm already having a bad day if someone got into my database and saw this, but I'd have a much worse week if on top of that if someone got into my Gmail account. (the account Dreamhost suggested to me to use for this smtp module (Another story for another time I suppose...)).

Comments

nikolaosinlight’s picture

nikolaosinlight commented

I noticed this as well and agree.

Although nothing is full proof when it comes to encryption/decryption a simple/rudimentary cypher would be nice.

iamcarrico’s picture

iamcarrico commented

I would recommend two things.

1) Don't use your personal Gmail account then.
2) Store the user/pass as a $conf variable in the settings.php file. Then you can delete those db entries. The settings.php will be the only way to view it, which should be secure from the outside world. And if you server gets hacked, well that sucks. The code is below. 

$conf['smtp_password'] = 'PASSWORD;
$conf['smtp_username'] = 'USERNAME';
josesanmartin’s picture

josesanmartin commented
Category: bug » support
Status: Active » Fixed

1) Creating a separated GMail account for sending purposes only is also a good practise.

2) ChinggizKhan's advice about settings.php is wonderful, I fully endorse it.

A little obfuscation seems more comfortable but it doesn't provide real security. Moving to settings.php, however, is certainly safer. I'm marking this as a fixed support request.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

skaught’s picture

skaught
Primary language English
commented
Issue summary: View changes

the admin control panel needs to reprocess the submission in smtp_admin_settings_form_submit() ...and all outputs of var needs decode routine to address this concern.

skaught’s picture

skaught
Primary language English
commented
Status: Closed (fixed) » Needs work
wundo’s picture

wundo commented
Status: Needs work » Closed (works as designed)

Closing very old (dead) issues, if you think this is still relevant please re-open.