getgrav / getgrav/grav-plugin-admin
OnAdminSave event does not give any information about config path
- Dominant language
- PHP
- Stars
- 377
- Forks
- 225
- Avg merge
- 11h 51m
- Merged PRs (30d)
- 4
Description
I am currently trying to solve "Environment variables leaked when saved via Admin Plugin" https://github.com/Ralla/grav-plugin-dotenv/issues/11
What I need to do is to filter out any variable, that has a corresponding environment variable set. However this is currently not possible, since the `Event $event` only has an `object` of type `Data`. It has no information which plugin/theme the data belongs to.
Example:
```
Event {#277 ▼
#items: array:1 [▼
"object" => & Data {#281 ▼
#gettersVariable: "items"
#items: array:8 [▼
"enabled" => true
"active" => true
"matomo_url" => ""
"site_id" => 2
"token" => ""
"respect_do_not_track" => false
"enable_cookies" => false
"enable_javascript" => false
]
#blueprints: Blueprint {#283 ▼
#context: "plugins://"
#scope: null
#blueprintSchema: BlueprintSchema {#278 ▶}
#defaults: null
#handlers: []
#items: array:14 [▶]
#filename: "matomo/blueprints"
#overrides: []
#dynamic: []
#nestedSeparator: "/"
}
#storage: CompiledYamlFile {#286 ▶}
-missingValuesAsNull: false
-keepEmptyValues: true
#nestedSeparator: "."
}
]
-propagationStopped: false
}
```
Any ideas how to handle this? Also in my opinion the dotenv plugin should be maintained by grav, as this is an essential plugin to handle secrets.
Funfact: If you show the full error trace when any PHP code fails, the environment variables will be leaked. This can be disabled (and should!), however a better integration into grav to handle secrets properly would be nice.
Contributor guide
Assessment
This issue has not been assessed yet.