getgrav / getgrav/grav-plugin-admin

OnAdminSave event does not give any information about config path

Open
#2,006 4 comments 0 reactions 1 assignee Claimed by @mahagr View on GitHub
enhancement
Dominant language
PHP
Stars
377
Forks
225
Avg merge
11h 51m
Merged PRs (30d)
4

Description

I am currently trying to solve "Environment variables leaked when saved via Admin Plugin" https://github.com/Ralla/grav-plugin-dotenv/issues/11

What I need to do is to filter out any variable, that has a corresponding environment variable set. However this is currently not possible, since the `Event $event` only has an `object` of type `Data`. It has no information which plugin/theme the data belongs to.

Example:
```
Event {#277 ▼
#items: array:1 [▼
"object" => & Data {#281 ▼
#gettersVariable: "items"
#items: array:8 [▼
"enabled" => true
"active" => true
"matomo_url" => ""
"site_id" => 2
"token" => ""
"respect_do_not_track" => false
"enable_cookies" => false
"enable_javascript" => false
]
#blueprints: Blueprint {#283 ▼
#context: "plugins://"
#scope: null
#blueprintSchema: BlueprintSchema {#278 ▶}
#defaults: null
#handlers: []
#items: array:14 [▶]
#filename: "matomo/blueprints"
#overrides: []
#dynamic: []
#nestedSeparator: "/"
}
#storage: CompiledYamlFile {#286 ▶}
-missingValuesAsNull: false
-keepEmptyValues: true
#nestedSeparator: "."
}
]
-propagationStopped: false
}
```

Any ideas how to handle this? Also in my opinion the dotenv plugin should be maintained by grav, as this is an essential plugin to handle secrets.

Funfact: If you show the full error trace when any PHP code fails, the environment variables will be leaked. This can be disabled (and should!), however a better integration into grav to handle secrets properly would be nice.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.