[Adrian Schneider]

If they have FTP access, all they need to do is add var_dump($vbulletin->config) anywhere after global.php to see the password being used. Or they can look in init.php / class_core.php to see where the config.php is located. Even if they can't use FTP to view that directory, they can use file_get_contents() or similar to read the file.

There are lots things you can do to stop hackers, this may slow someone down for 3-4 minutes but I don't' think that 3-4 minutes is worth botching upgrades for. That's not my call, of course, people are free to do what they want.

Thanks I'm not trying to be a ++++ here, but I am trying to help educate people who may not understand the pros/cons of doing stuff like this. Hopefully it's not coming across that way.

Cheers