Sicurity issue with giving access to Test on Pantheon?

We encourage users to post events happening in the community to the community events group on https://www.drupal.org.
Anonymous's picture

Someone has kindly replied and offered to give me help for a support request I just posted. He suggested Features Module, which I don't have yet...but I wondered if it would just be easier if I give him access to, say, my Test site, on Pantheon and let him take a look at that. Would there be a huge security risk in doing that?

I've backed up my site, and have locked both of the Dev and Live versions. What do you think?

He needs access to my content types and views...so that would mean administration rights.

Thanks in advance!

SW

Comments

Never mind!

SoniaWilk's picture

I used features, after all, and got the support I needed.

I would be interested to know the safe ways to allow people to give tech support on a site, though. I'm not able Skype because of the odd times I'm working on my site, so what are alternatives?

SW

Unfortunately, right now

Eidolon Night's picture

Unfortunately, right now granting access on Pantheon grants access to EVERYTHING. Locking the site merely adds htaccess lockout. If the person is an admin in Pantheon they'll have the ability to unlock the site and do as they please.

Last I checked Pantheon is working on resolving this.

For now, our solution is to only allow trusted developers into Pantheon to mess with our sites.

Thanks for that, Eidolon

SoniaWilk's picture

Thanks for that, Eidolon Night! I ended up using Features Module to share the list of modules and settings and such, and he took it from there. I avoided giving access, just in case. I was lucky to have found someone who was was able to take the time to do that for me as there were several modules involved. Is there a better way of sharing settings/module settings, etc for troubleshooting complex issues? (that could be a group discussion, I would think)

This will get a list of

daven's picture

This will get a list of enabled modules:
drush @yoursitealias pml --status=enabled

This will spit out config but it should be scanned for any private info:
drush @yoursitealias vget

But I like the features approach too.