Remove Hardcoded DB Credentials

Question

Remove Hardcoded DB Credentials

aryker opened this issue 7 years ago · comments

The database credentials are hardcoded in the PHP code, which is visible by anyone with access to our Git repository. We need to come up with an alternate system so that our passwords are not leaked to the public.

Caleb Smith · Answer 1 · Fri Dec 01 2017 02:31:05 GMT+0800 (China Standard Time)

Files

sql.php
getTeam.php
pit.php

Let me know if you can see any others.

Caleb Smith · Answer 2 · Fri Dec 01 2017 02:32:37 GMT+0800 (China Standard Time)

Follow up: might be a good idea to remove the MySQL username & the database name.

Caleb Smith · Answer 3 · Fri Dec 01 2017 08:30:14 GMT+0800 (China Standard Time)

Alright, it's done, passwords are removed. If anyone ever tries to host this they'll need the .db-password file with the password in it (we should probably make a setup script for that).