Um...I was pointed out by somebody that if you type in:
FORUM-DIRECTORY/index.php~ it'll reveal the whole index.php source.
Did I miss something and should have deleted it?
Well, when I type it in for my forum...it shows the whole code.... like I described
In my forum directory, there's a index.php~ file
It depends on your server configuration and for some configurations it may allow those files to be displayed. This normally is not a security issue unless you have password's or other information that you wish not to share in those files. The ~ are only created if a mod/upgrade package updates those files.
It is chmodded to 666. And it won't allow me to change the permissions. Should I delete it?
I'll just back those files up, delete them and see what happens.
I wouldn't delete them then you can't unistall the mods.
It really issn't a security issue unless you have custom code you do not want to share. Since anyone can download a copy of the SMF code.
Is there any way I could just hide them from the public?
Might want to talk to your host about their configuration if they can block ~ files from being shown or write an htaccess script to deny access to them.
Ok, thanks!
I was panicked for a bit :P
For info you can disable backups from the packages -> options menu if you prefer.
Ok, thanks
If you are on Apache and can use an htaccess file, adding this should stop external access of the files:
<FilesMatch "\.(php~)$">
Order Allow,Deny
Deny from all
</FilesMatch>
Note I didn't get a chance to test this.
Also, being able to see the source of these backup files isn't a security issue in and of itself. It only becomes an issue if you embed passwords and the like in the SMF source, which is a very bad practice.
I checked through that whole code for passwords. I know I didn't add anything into that code, but I just wanted to make sure.
The only file that SMF uses to store info for database passwords is Settings.php, and it is backed up to Settings_bak.php to prevent the contents from being shown.
As a warning, if you use an editor directly on the shell of the server, some programs will create a similar backup. This means if you edit Settings.php directly on the server, you might encounter an issue. Just remember to check afterwards if you do this.
Ok -- thanks!