Prevent {{ config() }} from exposing DB_PASSWORD

[bilogic]

Hi,

Is there a way to make {{ config("database.connections.mysql.password") }} not expose .env's DB_PASSWORD and other sensitive infomation? Thank you.

[barryvdh]

Yeah you can just not echo that?

[bilogic]

Hi,

I'm coming along the lines that a template system is supposed to limit itself to only "safe" code so that it is end user editable (think shopify's liquid).

While I could disable config() entirely, APIs such as recaptcha still needs to expose their public key in templates.

I was wondering if you would consider adding something similiar to Laravel's debug_blacklist for config? Thank you.

[barryvdh]

In that case you can use the sandbox, but by default Twig has access to al lot of functions and the global app variable.

[onemoreahmad]

@barryvdh Can't we just disable / blacklist config() and then if I need some config info I'll create a custom function for that specific data and make it available for twig ? I think config(), app() and other sensitive data must not be available for the front end developer .. any idea ?

Thanks.

[onemoreahmad]

Cool, I was able to disable config() from twigbridge.php conifg file, totally missed that!