Hacked again...

[NTLDR]

Originally posted by Boofo
How do you restrict the setting.php file?

Its allready protected by:

PHP Code:

cpheader(); 


So only admins can use it, you could of course restrict it to a specified userid:

PHP Code:

if ($bbuserinfo[userid]!=1) {
exit;
} 


After cpheader(); so that the script exits if you don't have the userid 1.

The safest option though is to put the entire admin directory behind a .htaccess block and uses a different username / password combo then you do for your forums.