版本控制wp-config.php的最佳实践是什么？

时间：2012-05-20 作者：jjeaton

是否有最佳实践来包括wp-config.php 版本控制存储库中的文件？

我正在考虑用这种配置创建一个新站点，（类似于Alex King 和Mark Jaquith):

/index.php
/local-config.php
/wp-config.php
/wp/ (core)
/wp-content/ (plugins, themes, etc.)

How can I do this without exposing my passwords to git, in case this repository ever becomes public?

特别是在Mark的帖子中，它看起来像本地配置。php可以存储本地数据库的详细信息和密码，但生产数据库的详细信息和密码保存在wp配置中。php。这是不是太麻烦了，我应该离开wp配置吗。php未版本化？

4 个回复
最合适的回答,由SO网友:Ashfame 整理而成

我就是这样做的，没有比这更好的了。我保留了不同版本的wp config。php文件受版本控制，然后在上面的一个目录中保留一个文件，其中保存所有数据库凭据和盐/键。同样，通过这种方式，我能够区分我正在运行的设置类型，并在此基础上进行不同的操作。

这是wp-config.php 我一直在下面git (https://gist.github.com/1923821):

<?php

/**
* Define type of server
*
* Depending on the type other stuff can be configured
* Note: Define them all, don\'t skip one if other is already defined
*/

define( \'DB_CREDENTIALS_PATH\', dirname( ABSPATH ) ); // cache it for multiple use
define( \'WP_LOCAL_SERVER\', file_exists( DB_CREDENTIALS_PATH . \'/local-config.php\' ) );
define( \'WP_DEV_SERVER\', file_exists( DB_CREDENTIALS_PATH . \'/dev-config.php\' ) );
define( \'WP_STAGING_SERVER\', file_exists( DB_CREDENTIALS_PATH . \'/staging-config.php\' ) );

/**
* Load DB credentials
*/

if ( WP_LOCAL_SERVER )
    require DB_CREDENTIALS_PATH . \'/local-config.php\';
elseif ( WP_DEV_SERVER )
    require DB_CREDENTIALS_PATH . \'/dev-config.php\';
elseif ( WP_STAGING_SERVER )
    require DB_CREDENTIALS_PATH . \'/staging-config.php\';
else
    require DB_CREDENTIALS_PATH . \'/production-config.php\';

/**
* Authentication Unique Keys and Salts.
*
* Change these to different unique phrases!
* You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
* You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
*/

if ( ! defined( \'AUTH_KEY\' ) )
    define(\'AUTH_KEY\', \'9*W=5&lt;Rw-)c].9}g?^[:!j]h+Efr&lt;y$&lt;YmV0XOo|lOIujEE}+[R}iAQZ :Sy3wN}\');
if ( ! defined( \'SECURE_AUTH_KEY\' ) )
    define(\'SECURE_AUTH_KEY\', \'APge3~H;g+b0FyNF&amp;e`$=g?qj9@FQwqFe^Q4(@p#kDa=NR? $Z9|@v*a(tOj*B+.\');
if ( ! defined( \'LOGGED_IN_KEY\' ) )
    define(\'LOGGED_IN_KEY\', \'5l0+:WTpj8#[V|;&lt;Iw;%rkB(A}r++HwT|s[LW!.wt.=5J!b%Z{F1/[LxQ*d7J&gt;Cm\');
if ( ! defined( \'NONCE_KEY\' ) )
    define(\'NONCE_KEY\', \'zO2cmQX`Kc~_XltJR&amp;T !Uc72=5Cc6`SxQ3;$f]#J)p&lt;/wwX&amp;7RTB2)K1Qn2Y*c0\');
if ( ! defined( \'AUTH_SALT\' ) )
    define(\'AUTH_SALT\', \'je]#Yh=RN DCrP9/N=IX^,TWqvNsCZJ4f7@3,|@L]at .-,yc^-^+?0ZfcHjD,WV\');
if ( ! defined( \'SECURE_AUTH_SALT\' ) )
    define(\'SECURE_AUTH_SALT\', \'^`6z+F!|+$BmIp&gt;y}Kr7]0]Xb@&gt;2sGc&gt;Mk6,$5FycK;u.KU[Tw$345K9qoF}WV,-\');
if ( ! defined( \'LOGGED_IN_SALT\' ) )
    define(\'LOGGED_IN_SALT\', \'a|+yZsR-k&lt;cSf@PQ~v82a_+{+hRCnL&amp;|aF|Z~yU&amp;V0IZ}Mrz@ND])YD22iUM[%Oc\');
if ( ! defined( \'NONCE_SALT\' ) )
    define(\'NONCE_SALT\', \'|1.e9Tx{fPv8D#IXO6[&lt;WY*,)+7+URp0~|:]uqiCOzu93b8,h4;iak+eIN7klkrW\');

/**
* WordPress Database Table prefix.
*
* You can have multiple installations in one database if you give each a unique
* prefix. Only numbers, letters, and underscores please!
*/

$table_prefix = \'ft_\';

/**
* WordPress Localized Language, defaults to English.
*
* Change this to localize WordPress. A corresponding MO file for the chosen
* language must be installed to wp-content/languages. For example, install
* de_DE.mo to wp-content/languages and set WPLANG to \'de_DE\' to enable German
* language support.
*/

define( \'WPLANG\', \'\' );

/**
* For developers: WordPress debugging mode.
*
* Change this to true to enable the display of notices during development.
* It is strongly recommended that plugin and theme developers use WP_DEBUG
* in their development environments.
*/

if ( WP_LOCAL_SERVER || WP_DEV_SERVER ) {

    define( \'WP_DEBUG\', true );
    define( \'WP_DEBUG_LOG\', true ); // Stored in wp-content/debug.log
    define( \'WP_DEBUG_DISPLAY\', true );

    define( \'SCRIPT_DEBUG\', true );
    define( \'SAVEQUERIES\', true );

} else if ( WP_STAGING_SERVER ) {

    define( \'WP_DEBUG\', true );
    define( \'WP_DEBUG_LOG\', true ); // Stored in wp-content/debug.log
    define( \'WP_DEBUG_DISPLAY\', false );

} else {

    define( \'WP_DEBUG\', false );
}


/* That\'s all, stop editing! Happy blogging. */

/** Absolute path to the WordPress directory. */
if ( !defined(\'ABSPATH\') )
define(\'ABSPATH\', dirname(__FILE__) . \'/\');

/** Sets up WordPress vars and included files. */
require_once(ABSPATH . \'wp-settings.php\');
这里是本地配置文件，我在WordPress根目录上方保留了一个目录，这也使得它位于web可访问目录之外，因此如果apache停止解析PHP文件并开始抛出它们，我们的数据库凭据仍然是安全的(https://gist.github.com/1923848):

<?php

/**
 * WordPress config file to use one directory above WordPress root, when awesome version of wp-config.php is in use.
 *
 * Awesome wp-config.php file - https://gist.github.com/1923821
 */

/* WordPress Local Environment DB credentials */

define(\'DB_NAME\', \'project_21\');
define(\'DB_USER\', \'root\');
define(\'DB_PASSWORD\', \'root\');
define(\'DB_HOST\', \'localhost\');
define(\'DB_CHARSET\', \'utf8\');
define(\'DB_COLLATE\', \'\');

/* Keys & Salts */

define(\'AUTH_KEY\',         \'5H%)s-nQ,+fn0gwg/p1UjBTmCQ?l[8-!>Q{MW&?X3DM,OF;TaI<SOOTrl0+-@) *\');
define(\'SECURE_AUTH_KEY\',  \'+%rr@,XIt-V+[.B9++uH1L,L+r)uq}5(:~=&4~Lk|.LV|y;R}fEo?G}+Sntf_JN}\');
define(\'LOGGED_IN_KEY\',    \'Szv!gQm9#(L&TUD OnM`>sXGge:m1j`L2 5sO;hRNVhlN>IUED1/`%<[ly-GxVJ \');
define(\'NONCE_KEY\',        \'o-Jo;>G#-%~,[ki@REqXV%4^I.HDnc.3]P;e8];4pJt% $xe5K<aOb|a2*QKV4c-\');
define(\'AUTH_SALT\',        \'8-tQb3d|W8,;Y_#mfuFB.1&b%U2fnlLD|F&yH).tLRX=ANEdNap{78o|9tqv6JPt\');
define(\'SECURE_AUTH_SALT\', \'RSa%^qd~T|@+!-;qgh,qK-GJ}zPpgxz#+@v6-I;BMwqT`TzGTtg_^n*ILxGOdbq4\');
define(\'LOGGED_IN_SALT\',   \']+XV)YK.Q-EU1vR [BT!Y$!d(J_[AO37OP[Fg[/esFx;6cI-L[^O|cvtw9F[;_*Q\');
define(\'NONCE_SALT\',       \'iP{nTQBzy&f^hSbwBgyan.v9<+ErvAMi2ymLhz`Tl-fF?HXa(j<W`wA*8U3R#-|w\');
如果上述文件命名为local-config.php, 我的系统的运行方式类似于本地安装。如果其名称为staging-config.php, 它的行为类似于临时安装production-config.php. 它可以帮助我获得某些常量的不同值，例如调试在不同的环境下具有不同的值，并且仍然在SCM（git）下拥有所有内容。可能性是无限的，不同的环境不需要黑客。

这确保了你永远不会向公众透露任何敏感信息，我使用它只是为了开始我所从事的任何项目，默认情况下，我有更强的密钥，一旦我将它们添加到上面一个目录下的第二个配置文件中，就会使用这些密钥，而不是这里定义的密钥。幸福

SO网友:EAMann

如果此存储库公开，我如何在不向git公开密码的情况下做到这一点？

如果您的wp-config.php 文件处于版本控制中，则它包含的任何密码也将处于版本控制中。避免这种情况的唯一方法是not 将文件置于版本控制中。

这是不是太麻烦了，我应该离开wp配置吗。php未版本化？

我的直觉是wp-config.php 完全未版本化。但是有一些方法可以解决这个问题。

提取的部分wp-config.php 将密码和哈希值包含在单独的文件中include() 它在常规中wp-config.php 文件那么，地点wp-config.php 在版本控制下，但保持include() 文件分开。

wp-config.php:

<?php
/**
 * The base configurations of the WordPress.
 *
 * This file has the following configurations: MySQL settings, Table Prefix,
 * Secret Keys, WordPress Language, and ABSPATH. You can find more information
 * by visiting {@link http://codex.wordpress.org/Editing_wp-config.php Editing
 * wp-config.php} Codex page. You can get the MySQL settings from your web host.
 *
 * This file is used by the wp-config.php creation script during the
 * installation. You don\'t have to use the web site, you can just copy this file
 * to "wp-config.php" and fill in the values.
 *
 * @package WordPress
 */

/** Database Charset to use in creating database tables. */
define(\'DB_CHARSET\', \'utf8\');

/** The Database Collate type. Don\'t change this if in doubt. */
define(\'DB_COLLATE\', \'\');

include( \'conf.php\' );    

/**#@-*/

/**
 * WordPress Database Table prefix.
 *
 * You can have multiple installations in one database if you give each a unique
 * prefix. Only numbers, letters, and underscores please!
 */
$table_prefix  = \'wp_\';

/**
 * WordPress Localized Language, defaults to English.
 *
 * Change this to localize WordPress. A corresponding MO file for the chosen
 * language must be installed to wp-content/languages. For example, install
 * de_DE.mo to wp-content/languages and set WPLANG to \'de_DE\' to enable German
 * language support.
 */
define(\'WPLANG\', \'\');

/**
 * For developers: WordPress debugging mode.
 *
 * Change this to true to enable the display of notices during development.
 * It is strongly recommended that plugin and theme developers use WP_DEBUG
 * in their development environments.
 */
define(\'WP_DEBUG\', false);

/* That\'s all, stop editing! Happy blogging. */

/** Absolute path to the WordPress directory. */
if ( !defined(\'ABSPATH\') )
    define(\'ABSPATH\', dirname(__FILE__) . \'/\');

/** Sets up WordPress vars and included files. */
require_once(ABSPATH . \'wp-settings.php\');
现在您可以看到，密码和哈希不包括在wp-config.php 完全

conf.php:

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define(\'DB_NAME\', \'database_name_here\');

/** MySQL database username */
define(\'DB_USER\', \'username_here\');

/** MySQL database password */
define(\'DB_PASSWORD\', \'password_here\');

/** MySQL hostname */
define(\'DB_HOST\', \'localhost\');


/**#@+
 * Authentication Unique Keys and Salts.
 *
 * Change these to different unique phrases!
 * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}
 * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again.
 *
 * @since 2.6.0
 */
define(\'AUTH_KEY\',         \'put your unique phrase here\');
define(\'SECURE_AUTH_KEY\',  \'put your unique phrase here\');
define(\'LOGGED_IN_KEY\',    \'put your unique phrase here\');
define(\'NONCE_KEY\',        \'put your unique phrase here\');
define(\'AUTH_SALT\',        \'put your unique phrase here\');
define(\'SECURE_AUTH_SALT\', \'put your unique phrase here\');
define(\'LOGGED_IN_SALT\',   \'put your unique phrase here\');
define(\'NONCE_SALT\',       \'put your unique phrase here\');
但老实说，在这一点上，您只是在这里添加了一个冗余的抽象级别。全部原因wp-config.php 首先是因为它是特定于环境的。您根本不应该将其从本地服务器复制到生产服务器。。。所以它根本不应该处于版本控制之下。

SO网友:Chris_O

Mark\'s example 假设您正在使用私人回购：

if ( file_exists( dirname( __FILE__ ) . \'/local-config.php\' ) ) {
  include( dirname( __FILE__ ) . \'/local-config.php\' );
  define( \'WP_LOCAL_DEV\', true ); 
} else {
  define( \'DB_NAME\',     \'production_db\'       );
  define( \'DB_USER\',     \'production_user\'     );
  define( \'DB_PASSWORD\', \'production_password\' );
  define( \'DB_HOST\',     \'production_db_host\'  );
}
您可以轻松地创建生产配置，而不是定义凭据。php文件，并将其包含在条件检查中：

if ( file_exists( dirname( __FILE__ ) . \'/local-config.php\' ) ) {
      include( dirname( __FILE__ ) . \'/local-config.php\' );
      define( \'WP_LOCAL_DEV\', true ); 
    } else {
     include( dirname( __FILE__ ) . \'/production-config.php\' )
    }
然后在未版本的生产配置中。php：

  define( \'DB_NAME\',     \'production_db\'       );
  define( \'DB_USER\',     \'production_user\'     );
  define( \'DB_PASSWORD\', \'production_password\' );
  define( \'DB_HOST\',     \'production_db_host\'  );

SO网友:getWeberForStackExchange

您可以提交wp-config.php 将文件保存到存储库，但不包含机密字符串，然后运行：

git update-index --assume-unchanged wp-config.php
这将告诉git假定文件没有更改。

结束
标签： wp-config   version-control   小码农  

相关推荐

Editing wp-config.php

我需要添加行define(\'WP_POST_REVISIONS\', false);到我的配置。php，以便禁用后期修订。我没有访问wp配置的权限。php，我有权限编辑我的主题和插件。是他们的任何方式，我可以添加这个代码到我的主题的功能。php，或是他们的任何钩子来实现它。而且是他们无论如何都要重写wp config中定义的函数。PHP用于eg：define( \'BP_DEFAULT_COMPONENT\', \'profile\' ); 我可以在不访问wp config的情况下重写上述代码