Skip to content

don't disclose saved subscription key#23475

Open
orthagh wants to merge 2 commits intoglpi-project:11.0/bugfixesfrom
orthagh:feat/sub_key
Open

don't disclose saved subscription key#23475
orthagh wants to merge 2 commits intoglpi-project:11.0/bugfixesfrom
orthagh:feat/sub_key

Conversation

@orthagh
Copy link
Contributor

@orthagh orthagh commented Mar 13, 2026

Following a discussion at Caen offices, I mainly removed the possibility to view a subscription key when it's already saved in GLPI configuration. Some people use it to copy advanced key from one instance to another.
It's always possible to retrieve the key in database, decrypt it with GLPI_KEY, but it requires more steps and more knowledge.
And I reworked a bit the page. The latter is rather simple, and the change should be OK even for 11.0/bugfixes.

Screenshots (if appropriate):

image

Copilot AI review requested due to automatic review settings March 13, 2026 15:27
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR prevents admins from viewing an already-saved GLPI Network registration/subscription key in the UI, while reworking the setup page layout and adding a server-side “remove key” action.

Changes:

  • Reworks the GLPI Network setup Twig template to only allow entering a key when none is saved, and adds a “Remove registration key” button.
  • Adds a reset_registration_key handler in front/config.form.php to clear the saved key.
  • Updates Marketplace section UI (titles, helper text, buttons).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File Description
templates/pages/setup/general/glpinetwork_setup.html.twig Reworks the form/UI and hides the saved registration key; adds remove-key UI.
front/config.form.php Adds POST handler to clear the saved registration key.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants