Skip to main content

Rotate the Dropbox share links in dotfiles

Two Dropbox share URLs with rlkey query parameters are committed in the dotfiles repo:

FileWhat it is
.zsh_aliases:193The dlud alias, downloads UpdraftPlus Premium
wp-scripts/wpinit.sh:54 and :56A second link to the UpdraftPlus Premium folder

An rlkey is the access token. Anyone with the URL can download the file without logging in.

Severity is Low because the dotfiles repo is private. If it were ever made public, or the history shared, this becomes urgent, and git history keeps the links even after they're removed from the working tree.

Fix

Not worth doing now. Worth doing before the repo is ever made public, or if the links leak.

Better long-term shape: move both to .zshrc.local, which is already gitignored, and have the tracked files read a variable. That way the pattern is right regardless of what happens to the repo.

ddevinit.sh:229 also has a hardcoded --admin_password, but it's a throwaway local value identical to the username, so it doesn't matter.