Influx of Security Issues all tied to the same thing

[DieselMinded]

I have 15 websites most are php and have admin control panels , recently i got an email from one of the softwares where they were basically flipping out and told all its members to change the name of its admin directory from admin/

im thinking whats the big deal then the same day another one of my softwares sends out a notice to all its users about the same exact thing !

this got me thinking real good about it and all the stuff you have to do to pull off a rename of the admin directory .... so 2 days later which is today another one of my software developers send out the same thing again !

not sure what has happened recently but it seems like all php software developers are requesting the admin directories renamed

So now we have vBulletin !!! with an admin directory named admin on 99% of our sites so what are we going to do about it?

[Marks]

renaming the admincp directory on vb is very easy. All you have to do is edit the file name, and then one line in config.php.

[DieselMinded]

what about upgrades ?

[Marks]

Do you mean upgrading vB in the future? Just rename the admincp directory before you upload the files to your server, and make sure you keep the same settings in config.php.

[DieselMinded]

Will the upgrade script know that the admin directory is renamed ?

heres some code from one of my developers patch ..

PHP Code:

$form .= '<input type="hidden" name="securityToken" value="' . $_SESSION['securityToken'] . '" />'; 


Does VB have the "securityToken" on its admin cp log in?

[Marks]

I'm pretty sure that as long as config.php is configured correctly, you wont have any problems with the upgrade script.

If you were worried about it, you could always revert back to the default settings just for the upgrade.

[DieselMinded]

i would rather for vbulletin to look into this and make a decision rather this is of warrant

[Marks]

Originally Posted by vBulletin manual

$config['Misc']['admincpdir']

By default, vBulletin will install the files for the Administrators' Control Panel into a folder called admincp, but you may wish to rename this folder this for security purposes. If you rename the folder, enter the new name here. Note that you can only rename the folder, if you move the folder to a new location the system will be unable to function.

Sums it up.

That quote is from the installation instructions about configuring config.php.

[DieselMinded]

Whats the importance of doing this !

[Brandon Sheley]

Originally Posted by Marks

I'm pretty sure that as long as config.php is configured correctly, you wont have any problems with the upgrade script.

This is correct.
As long as the config has the correct info about the admincp and modcp, you could name them whatever you want.
Just make note on the upgrades to name those 2 folders the same, and make the same 2 edits in the config.php file.