»How to protect your phpBB forum against hackers«

"Playing with words" hahaha I was proving your choice of words wrong. A site isn't accidentally hacked.

I'm guessing the security report you submited was something about leaving the admin folder named "admin" as an exploit . . .

What? Could you finish your sentence? There's no verb in it. It makes no sense at all.

I someone finds out your (= the admin's) password hash (for example due to a bug in phpbb, or because you use the same password on other (buggy) boards) then he could enter your admin area easily.

I see, but anyways once a f*cking hacker gets access to your admin account, he can get rid of everypost!

The worst possible person to comment on a program's security is the developer.

Yes, good link. BUT HOW THE HECK DOES ONE FIND IT? It's hidden under
"modifications -> upgrade tools"

Is that where security updates should be?

It's so hidden that a phpbb moderator even told me that there is nothing like that.
• It's not under "Downloads"
• It's not under "Support"

Moreover, as far as I can see, their updates contain ALL KINDs of fixes, not only security issues.

If you go to phpbb.com, do you see any link to "Security related upgrades"?

Oh, my gosh, this bug is described as "Next Development Version vulnerable to highlight exploit" (what the heck?) and when you click on the link THERE IS NO FURTHER INFORMATION.

I never submitted any security report. A phpbb moderator told me that it's my own fault that the .patch files (= the ones used to update a phpBB installation) destroyed my forum, since my forum was modded. When I pointed out that they either don't take modding seriously or don't take security seriously I was warned and my topic locked.

As if "should be" wasn't enough. OK, let me repeat:

Awstats is a very frequent software on servers.

• I said, that Awstats is MORE used than phpBB thus if it was a bug in Awstats then more sites had been hacked.

• In other words: Your objection "No other forum hacks thus not a phpbb bug" does not apply.

I am not saying that phpbb.com was hacked because of a phpbb bug. BUT: You simply can't trust what phpbb.com is saying. And they don't know themselves, since all their logs have been deleted.

If you delete (or rename) the Database backup function (admin_db_utilities.php) and the Forum management function (admin_forums.php) then a "fake admin" cannot do much, except browsing your forum and delete single posts and topics by hand.

and restored the original config.php, this didn't help, what else did this mod do and how do I undo it? Please help!

PS I tried to register but got a error

Its kind of hard not to find those MOD Template versions of the changes when it is linked to from the announcement about the new version.

Anyways, the new Security Tracker you can find all of the submitted security problems that have been fixed and in what version. That way you can upgrade accordingly.

Over 46 million pages contain "Powered by phpBB"

Around 10,000 downloads a day

Over 250,000 downloads of 2.0.11 since it was released

There is a point between what is necessary and what is just plain annoyning. Your tips are over on the annoyning side.

I'm done, you think you know but you don't. There's no point in debating with you any further.

There is a point between what is necessary and what is just plain annoyning. Your tips are over on the annoyning side.
I'm done, you think you know but you don't. There's no point in debating with you any further.

I'm trying to program little PHP programs. In your Thread you write about "security checking programs". Have you any links for these programs?

It would be nice because I'd like to test a program security checking program

highlight.php file to view my config.php, which pretty much gives them full acces to my databse?

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));

for($i = 0; $i < sizeof($words); $i++)
{


and replace with:
Code:

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight'])));

for($i = 0; $i < sizeof($words); $i++)
{