Greg Anderson

Marking as 'major', as we need to decide on strategy and then update documentation.

The Drupal core issue is [2466197](https://www.drupal.org/node/2466197).

That is an excellent suggestion, @bthompson-mindgrub. I'll look into it on Monday; I think it should be possible.

So, this attack actually is not possible on the Pantheon platform, so an alternative solution here would be to simply remove the warning from the status report page when the...

Downgrading the status of this issue; this is not actually an attack vector, it merely results in an incorrect warning on the status page. We could potentially solve this by...

There is no real effect on the platform here; downgrading further to "enhancement", since we would just like to improve the firm message that is shown on the status page,...

Currently this is done in pantheon.settings.php. Drupal 8 currently loads the settings.php file from [Drupal\Core\Site\Settings:: initialize()](http://cgit.drupalcode.org/drupal/tree/core/lib/Drupal/Core/Site/Settings.php#n113). We might be able to populate $databases by calling [Database::setMultipleConnectionInfo()](http://cgit.drupalcode.org/drupal/tree/core/lib/Drupal/Core/Database/Database.php#n292) directly. However, the problem...

So, we need to do some things via settings.php modifications, but we could certainly clean up the way in which we do this.

The problem with this PR is that it would create merge conflicts with all sites that already have committed a settings.php file.

This issue and PR pre-dates my time at Pantheon. On the surface, it looks like the symptom (undefined index) is caused by a bug or a feature that (deliberately or...