Feature: Read SP Private Key from config define rather than DB
Open
enhancement
- Dominant language
- PHP
- Stars
- 52
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
### SP Private Key Location
In the case of full GLPI SQL backup or SQLi vunerability (eg CVE-2026-29047) it would be good to have sp_private_key out of the database.
### Proposed Solution
Read sp_private_key from a PHP define (GLPI_CONFIG_DIR . '/local_define.php').
Contributor guide
Research direction
Start by tracing where the plugin currently reads sp_private_key from the database, then inspect GLPI_CONFIG_DIR and the local_define.php configuration location mentioned in the issue. Confirm how a PHP define is exposed to the plugin and verify that the key is read from configuration instead of the database, including the existing SAML flow.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100