Is there any way to not expose ENV, SERVER via phpinfo but keep getenv functionality in wp-config?

[maltris]

Old topic, but I found that the WORDPRESS_* envvars are still exposed via phpinfo. This can be fixed by setting clear_env in the fpm pool config, but I think this breaks the getent workings of wp-config-docker.php. Is there a way to rework this?

Personally I dont have a problem with separated stacks and no web-exposed phpinfo nor MySQL DB. However there are people who forget their info.php and actually use a web-exposed MySQL server, which puts their whole site at risk.

Maybe I am missing something, please enlighten me.

Best regards

[tianon]

This is actually exactly why we don't use getenv directly and instead implement a small wrapper -- that's so we can transparently support _FILE variants of all the variables so their values can be stored slightly more securely (for example, Swarm Mode's "secrets" functionality creates a tmpfs to pass secrets to the container securely):

wordpress/wp-config-docker.php

Lines 30 to 32 in 50da133

	if ($fileEnv = getenv($env . '_FILE')) {
	return rtrim(file_get_contents($fileEnv), "\r\n");
	}

[tianon]

I believe you can also add phpinfo to https://www.php.net/manual/en/ini.core.php#ini.disable-functions, but that would obviously only disable phpinfo() itself, not related functions or scripts that reimplement parts of it more directly.