Are you able to download the database directly from AdminCP?

[Max Taxable]

Originally Posted by Digital Jedi

I guess it was useful for downloading individual tables, in addition to the CSV backup. But I don't think I've ever heard of anyone's site being compromised through that specific feature. I mean, once you have admin access, there's better ways into the server.

If you have only adminCP access, not really. It doesn't necessarily follow that those credentials get you into the server too.

I definitely agree with blind-eddie and you this was a major security flaw in v3.

[Zachery]

Originally Posted by Max Taxable

If you have only adminCP access, not really. It doesn't necessarily follow that those credentials get you into the server too.

I definitely agree with blind-eddie and you this was a major security flaw in v3.

It would be pretty trivial to re-add the functionality via a creative plugin, or template, or a bit of both. So it all depends on how skilled an admin is and if you're giving them access to stuff like plugins/templates and trust them.

We removed the backup functionality because it was not dependable to create quality backups. Instead of spending additional time improving it, it was removed. We'd recommend that customer use better tools like the raw MySQLdump command line too, or software designed to do backups like mysqldumper.

[Max Taxable]

I'm not a fan of it so i am definitely not calling for it in v4 or v5.

[tbworld]

Thanks @Zachery, for the explanation.

[Digital Jedi]

Originally Posted by Max Taxable

If you have only adminCP access, not really. It doesn't necessarily follow that those credentials get you into the server too.

I definitely agree with blind-eddie and you this was a major security flaw in v3.

No more or less secure than the ability to run queries from the Admin CP. Come to think of it, that's of those other ways in.

[Max Taxable]

Originally Posted by Digital Jedi

No more or less secure than the ability to run queries from the Admin CP. Come to think of it, that's of those other ways in.

Right but, being able to download the tables is unique to v3 and earlier. Plus, the ability to run queries must be permissioned in config file.

[Digital Jedi]

Originally Posted by Max Taxable

Right but, being able to download the tables is unique to v3 and earlier. Plus, the ability to run queries must be permissioned in config file.

It doesn't seem to be something that was ever used, at least not proficiently. And it was in vB 3 as far back as I can remember. I'm not entirely sure it isn't tied to a script permission, but I'd have to check. It just seems like it was so unreliable not even hackers bothered with it.

[Max Taxable]

Originally Posted by Digital Jedi

It doesn't seem to be something that was ever used, at least not proficiently. And it was in vB 3 as far back as I can remember. I'm not entirely sure it isn't tied to a script permission, but I'd have to check. It just seems like it was so unreliable not even hackers bothered with it.

Or they might not have known about it. It IS a obscure function.

[Zachery]

Originally Posted by Digital Jedi

It doesn't seem to be something that was ever used, at least not proficiently. And it was in vB 3 as far back as I can remember. I'm not entirely sure it isn't tied to a script permission, but I'd have to check. It just seems like it was so unreliable not even hackers bothered with it.

It was used pretty often by some customers, I remember getting complaints about it early on in vB4's life cycle. But honestly, people who used the tool rarely got full backups, which caused more problems.

We removed it for the sake of causing less problems in the long run, IIRC.

[ozzy47]

TBH, on smaller boards, I still use this, https://vborg.vbsupport.ru/showthread.php?t=192488

I had to tweak it a bit to get it to work on vB4 but it does it's job.