[TigerC10]

Yeah, but those are default to the scripts. Its easy to add a "VB_AREA" and "THIS_SCRIPT" variable in and then include the global.php, as well as anything else they want. A potential hacker wouldn't know the customized variable. This is really only a concern for other scripts accessing vBulletin - like for example if someone is on a shared host and the file permissions are not set properly, someone else on the same server could utilize/execute the scripts of other users (I believe that GoDaddy's hosting service had this problem for awhile, not sure if it still does or not).

So by making a custom variable for himself, he ensures that it's only his approved scripts that can call global.



One idea that Jelsoft could use is if they use this technique but with customer numbers. Consider: every php file will be altered on the fly at download time with the appropriate customer number at the top of the file. Why not take it a step further and make it into a variable that is checked for security? I know that the customer number is checked when you enter the upgrade system. The only downside is that the modification system would be largely broken - all custom .php files would have to be altered to follow the new standard, and I don't think there's a way of modifying the addon/hack .php files on the fly at download so the modifications to the addon/hack .php files would have to be done by the users.

But at least it would be that much more secure... It's up to jelsoft if they want to do that.