nextcloud / nextcloud/fulltextsearch
elasticsearch connecting string gets saved in db in cleartext
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 234
- Forks
- 64
- Avg merge
- 6h 18m
- Merged PRs (30d)
- 10
Description
the connection string http://user:password@ip
gets saved as is aka cleartext into the psql database.
it would be great if nextcloud and/or plugins would support something like
ELASTIC_PASSWORD_FILE=/run/secrets/the_elastic_password.txt
to make use of docker secrets and then declare the connection string something like
http://user:$(ELASTIC_PASSWORD)@ip
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are identified. Start by locating where the Elasticsearch connection string is parsed and persisted in the PostgreSQL database, then determine how Docker secrets could be resolved without storing the password in cleartext. Done should include a defined secret-handling approach and coverage for the requested connection-string form.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, elasticsearch, php, postgresql
- Domain
- backend, databases, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100