[tbworld]

@Anolian, you bring up some good points and correctly so. I am sure many of us have increased the security of vBulletin per our particular hosting environment, but vBulletin must write their software to run on a multitude of hosts and environments. This alone complicates the issue of security and ease of installation, let alone an advanced permission install.

As you have stated above, I believe you should not rely on PHP level permissions to control sensitive database options. As you have already figured out the solution for this is quite simple, it just makes it -- in my opinion -- too difficult for fist time users of the software and some of the environments out there. The modification system (which beginners use extensively) would be impossible to support. Anyway, good post. I liked it

Not that I know, but I am sure this is part of the thinking in the vb5 cloud release, you noticed they dropped the user API system for the release. Makes sense to me.