You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Aug 28, 2024. It is now read-only.
MEDIAWIKI_DB_PASSWORD is required everytime the image is run, even though it is only required on install. This makes the image less secure by requiring the password to be stored both inside the image and in environment variables, requiring the password to be stored outside of the image, giving two vectors of attack to access the secret.
This is because MEDIAWIKI_DB_TYPE defaults to mysql, set -e is run, and php runs exit(1) if it fails to connect.
A workaround is to set MEDIAWIKI_DB_TYPE to something else. I'd like to make a pull request to either give this workaround in the README, or to not attempt to connect if the password is empty in the entrypoint.
However, is this design intentional?
The text was updated successfully, but these errors were encountered:
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
MEDIAWIKI_DB_PASSWORD
is required everytime the image is run, even though it is only required on install. This makes the image less secure by requiring the password to be stored both inside the image and in environment variables, requiring the password to be stored outside of the image, giving two vectors of attack to access the secret.This is because
MEDIAWIKI_DB_TYPE
defaults tomysql
,set -e
is run, and php runsexit(1)
if it fails to connect.A workaround is to set
MEDIAWIKI_DB_TYPE
to something else. I'd like to make a pull request to either give this workaround in the README, or to not attempt to connect if the password is empty in the entrypoint.However, is this design intentional?
The text was updated successfully, but these errors were encountered: