Save the secret key in db?

[Amit Kumar Mishra]

hi

will it be a good idea to save the secret key from the blesta config file in a table in the blesta database?

say, will it be a security concern?

[Paul]

No, you shouldn't save the system key from /config/blesta.php to your database. It would be a good idea to back up this file & key to your computer or to some other media. If your database were compromised but not your file system, the attacker could not decrypt the encrypted data. But if you put your key in your database, then.. no such protection.

Just make sure to back up files + database.

[Amit Kumar Mishra]

hi @Paul, and even other may join in to comment and help me achieve what we are looking at

so would you advice some kind of a secret different database, having some different named tables to store it, so that the outside can communicate with the table/db and the needfull be done, without the hacker/cracker getting to know the clue of what this field is?

let me know if this would be okay

i may, on this, share a few screenshots as soon as we get on to the best advice implemented...

and believe me all, you are all going to love it,  what we are trying to achieve, not sure all will, but i feel so

[Paul]

9 minutes ago, Amit Kumar Mishra said:

hi @Paul, and even other may join in to comment and help me achieve what we are looking at

so would you advice some kind of a secret different database, having some different named tables to store it, so that the outside can communicate with the table/db and the needfull be done, without the hacker/cracker getting to know the clue of what this field is?

let me know if this would be okay

i may, on this, share a few screenshots as soon as we get on to the best advice implemented...

and believe me all, you are all going to love it,  what we are trying to achieve, not sure all will, but i feel so

No I wouldn't recommend storing it anywhere in your database or anywhere besides where it's currently stored (in /config/blesta.php). Other than an offline backup someplace.

What are you trying to accomplish? For what reason do you want to access the system key through mysql?

[Amit Kumar Mishra]

trying to develop some plugin to enhance user functionalities

then we will try reading it every time from the file

what we wish not to achieve, is to disturb the blesta security, so discussing here

[Jono]

Hi there, if this is the same thing you private messaged us about then knowing the actually key is not necessary, you can using the API as we described.  However, if this is in fact a plugin, and not external software, then you should follow the documentation here for creating a Blesta plugin.  It should make you life easier by giving you easy access the Blesta models, helpers, and components without having to go through the API.

[Amit Kumar Mishra]

hi @Jono, this is not the same, as this wont be able to use API

the only thing is when i go ahead with the plugin thing, i am requiring the db things which may compromise the security, so am rethinking and rethinking, and i am going crazy...

[Tyson]

It's going to take some thinking to determine what the best route to follow is for what you're doing, but your best option is probably going to be to write a plugin and provide end-points to that plugin via the API or web to perform your new functionality. Plugins in Blesta can access the configuration setting to get the key as-is, so that shouldn't be a problem.

I'd be curious to know why accessing the key from a database table would work, but an API call to a plugin wouldn't.

[Amit Kumar Mishra]

not that api wont work

but we are figuring out a way, keeping the fingers crossed in testing

will update after some rigorous testing is over