MyBB Community Forums

Hi, I'll describe this in basic terms, if you need more details to understand the question, please ask:

* simple_admin.php = A simple utility to help develop multiple sites and / or projects.
* db_data.php sits outside of the public_html path and cannot be viewed or directly accessed by any browser-based hacker.


1) simple_admin.php is an experiment to help easily make changes in several databases at once, using basic to medium-level PHP.
2) db_data.php is included in simple_admin.php
3) Also note:

<?php
rename("simple_admin.php", "simple_admin.txt");
?>

Every time the admin uses simple_admin.php it is automatically renamed to .txt, so hackers have no chance of running the file themselves.

Quick Summary:
> The Database login info is outside of the public_html path
> The "main file" is automatically renamed to .txt every time.


Please tell me, is there anything about this set-up which is not 'reasonably' secure?

Thank you.

Edit: Oops... Of course, simple_admin.php can also, be in a password protected area.
Now, can I think "it" is secure?

I don't think renaming it to .txt is a good idea because then the .txt file can be viewed and therefore will expose the PHP source won't it?

Rather, try

rename("simple_admin.php", "simple_admin");

(2008-11-09, 02:30 AM)_Tim Wrote: [ -> ]I don't think renaming it to .txt is a good idea because then the .txt file can be viewed and therefore will expose the PHP source won't it?

My thought... The best way is to put as many things you can think of into your script as possible...

I haven't tested this, but surely using something like...

if(eregi(basename(__FILE__),$_SERVER['REQUEST_URI'])){ print "<h1>Incorrect access</h1>You cannot access this file directly."; exit(); }

... would stop anybody from accessing the script directly. Or, use define. In your main script, put something like define("OnlyMe",1);, and in simple_admin, use...

if(!defined("OnlyMe"){ die("A horrible death"); }

Of course, include("simple_admin.php") should work in both cases... but just try it out...

What Tom.M says what it does in MYBB, i would go with it because evan with what dikidera said i am pretty sure you could still go open with and click notepad.

So when i oppen http://site.com/simple_admin it will open the file? Wouldnt it be treated like a folder? It would and when the folder aint there it is 404

Hmm, maybe. Ill try it this afternoon.

A htaccess password is also another good form of protection.

Htaccess is also good but it is another example of a no extension file that cannot be opened by browser

Why not make it a hidden file?
.simple_admin

And it might be most secure as PHP since you can add some protection scheme to the file.

Thanks all, for the good advice.