Skip to content
This repository has been archived by the owner on Aug 28, 2024. It is now read-only.

MEDIAWIKI_DB_PASSWORD required every run #15

Open
rbong opened this issue May 1, 2017 · 0 comments
Open

MEDIAWIKI_DB_PASSWORD required every run #15

rbong opened this issue May 1, 2017 · 0 comments

Comments

@rbong
Copy link

rbong commented May 1, 2017

MEDIAWIKI_DB_PASSWORD is required everytime the image is run, even though it is only required on install. This makes the image less secure by requiring the password to be stored both inside the image and in environment variables, requiring the password to be stored outside of the image, giving two vectors of attack to access the secret.

This is because MEDIAWIKI_DB_TYPE defaults to mysql, set -e is run, and php runs exit(1) if it fails to connect.

A workaround is to set MEDIAWIKI_DB_TYPE to something else. I'd like to make a pull request to either give this workaround in the README, or to not attempt to connect if the password is empty in the entrypoint.

However, is this design intentional?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant