Forum hacked, restored, now showing bare index

[cellarius]

Originally Posted by loua_oz

Let's see why this debate is ridiculous: because coders and VB staff participating here have not told us (may well be news to them) that plain text database admin user name and password in

/includes/config.php

are used when initially creating the database from the sheet supplied for paid install or from own notes. Some may stay with that password, most would change it.

So - now you're accusing vB staff of hacking your board? That's ridiculous. Believe me, all of your discoveries are nothing new to anyone here. Every single customer who has read the installation instructions and installed vB knows config.php and it's contents, because everyone has edited it themselves. Also, everyone who has only the slightest clue of web development knows that and why you need such files.

Just changed my cPanel, mail and database passwords and in

/includes/config.php

the password is the same as it was upon creation, should not be valid. But the site does not care

Then you did not change the password of the database vB uses. Period. If you change the database password, and do not edit it in config.php accordingly, the site will stop working and throw database errors. Just give it a try. Change your password in config.php to something random, and your site will break immediately.

That is another question: why is it then in /includes, why not in /install and removed before the site is powered up?

Because, as any other webscript, vB requires certain basic access data in order to work. If you remove config.php, your site will break. Again: Just try it. Delete (or better: rename) config.php. Your site will break immediately.

You're lashing out at everyone and everything here, making wild accusations, yet obviously having only very limited knowledge of what you're talking about.

It's sad that you have been hacked numerous times, but it will not help you at all if you're pointing at a perfectly normal file with perfectly normal contents.

You really need to understand this: If someone is able to read the contents of your config.php, you already have been hacked. It's too late.

Step back, calm down, breath through. There's people here trying to help you, and you're lashing out at them in a way that is really not called for.