See above quote.

Yeah. Great. A post from yesterday. That only proves that NOW they tell you to remove that directory. They have done otherwise for years.

I've always deleted the install directory on live sites without any problems. It just seemed to make more sense to me.

I also rename the admincp and modcp folders to a secure name. In addition, whenever possible I protect them with htaccess so only IP addresses included in the htaccess file can use the ACP and ModCP.

Why would you take that rrisk ? VB recommends to delete it, why ignore that ?

It is not just your forum at risk, but also the privacy and online security of your users.

I have always deleted the whole install folder have been doing this for sometime. I have also a lot of other security things in place

I'm working on a adminCP file manager and am using it to delete this but I found a functional but very slow running block of code I would like to improve so I'm wondering if I need to do this in the next five minutes or the next five hours. But TheLastSuperman answered. Now I have to create a bunch of junk files to test my improved code on.

Clone the site, restore on localhost then tinker away ;).

Obviously, it is not smart for VB to post any real details of the vulnerability, but if any of you are in the know: Is it sufficient enough to just IP restrict the install directory?

Might be a short term solution @nerbert.

I do like @TheLastSuporman suggestion, but I am sure you are already developing on a local system, this is probably just for testing -- right?

Actually I have an old unusable vB3 clone I can beat to pieces. But it's a useful resource for developing something like this -- not to be consumed recklessly.

Renaming/htaccess protecting it still leaves you vulnerable the only way to be 100% safe is to delete the entire directory.