Is it considered bad practice to have a MySQL query with user:pass as plaintext?
I'm doing this right now (in nginx/roundcube to modify my dovecot passwords) but it seems strange because if I had other system users on the server they could navigate to the config, read the name/pass file and delete password hashes and/or add their own.
Would the suggested fix to simply set any sensitive files to 700 permision? I'm not sure how flexible that would be with some files on the webserver?
If someone could clear this up for me that would be great :-)