cache_form table (and cache_entity_node) have the data in plain text

Created on 26 April 2016, almost 9 years ago
Updated 12 March 2025, about 1 month ago

This module provides a custom cache class for 'cache_field' table, but this table doesn't store any sensitive data. It only stores the field configuration, and it doesn't have to be encrypted. Which means the custom cache implementation in this module is useless.

However, a quick search in the database yielded that 'cache_form' and 'cache_entity_node' (provided by Entity Cache module) tables include the sensitive data in plain text.

You can see reproduce this by:
1. Enabling the module
2. Configuring some fields to be encrypted.
3. Create some sample data in those fields.
4. Search in the database for that sample data in plain text.
5. You'll see that 'cache_form' table has the data in plain text.
6. If you have Entity Cache module installed, the data is also stored in 'cache_entity_ENTITY_TYPE' table in plain text.

📌 Task
Status

Closed: outdated

Version

1.0

Component

Documentation

Created by

🇩🇪Germany Elin Yordanov

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024