Drupal 安装的公共存储库：有哪些安全风险？
我正在将 Drupal 项目放在开源托管站点上。我必须不要将哪些文件放在那里，以免损害网站的安全？
我想到了各种settings.php。显然数据库本身不会位于存储库中。还有什么危险的吗？
我正在运行 Drupal 6。
此外，如果能以某种方式将数据库本身置于版本控制之下就好了。知道该怎么做吗？
更新：如果我要转储数据库数据、对其进行加密并对其进行版本控制会怎样？
I'm putting a Drupal project on an open source hosting site. What files do I have to not put up there so I don't compromise my site's security?
Various settings.php comes to mind. And obviously the database itself won't be in a repository. Anything else dangerous?
I'm running Drupal 6.
Also, it'd be nice to get the database itself under version control in some way. Any idea how to do that?
UPDATE: What if I were to dump the db data, encrypt it, and version that?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
确保不要提交用户上传的文件。我不会上传你的数据库转储，即使它是加密的。我也会小心 .htaccess 文件。
提交settings.php将是你能做的最糟糕的事情，你可以尝试在文件中查找你的mysql用户/密码以确保它不重复。
如果 Drupal 受版本控制，您可以将其与 Drupal 的存储库进行比较，以查看哪些文件已更改。像 TortiseSVN 这样的东西使这个过程变得非常简单。
我也会小心缓存文件，但据我所知，Drupal 仅具有基于 sql 的缓存。
对于 SQL 版本控制，最常见的是使用 mysqldump。另一种方法是使用脚本化版本控制策略，以及PHP 实现。转储任何
cache_*表、Variable表，当然还有user表都是不安全的。Make sure not to submit User Uploaded Files. I wouldn't upload your db dump, even if it is encrypted. I would also be careful of .htaccess files.
Committing settings.php would be the worst thing you could do, you could try doing a find in files for your mysql user/password to make sure it isn't duplicated.
If Drupal is under version control you could Diff it with Drupal's repo to see what files have changed. Something like TortiseSVN makes that process pretty easy.
I'd also be careful of Cache files, but as far as I know Drupal only has a sql based cache.
For SQL Version control it is most common to use a mysqldump. Another approch is using an scripted versioning strategy, with a PHP Implementation. It is unsafe to dump any of the
cache_*tables, theVariabletable and of course theusertable.插件将是我唯一要隐藏的东西。原因是插件有自己的安全漏洞，向世界宣布您正在使用的版本可能会让您遭到黑客攻击。 Drupal 本身还是相当安全的
Plugins would be the only thing I would hide. The reason is that plugins have their own security holes, and announcing to the world what version you are using could get you hacked. Drupal itself is pretty secure though