Security issue

[TheGuy12]

Hello,

I have a security issue with my SMF forum, and I'm not sure how to fix it.

Basically, admins can access .php files using the error log and therefore read its content, which should not be possible.

Can I somehow prevent this?

It shows the .php file in some kind of text viewer, with lines numbers.


Regards

[Arantor]

No, you can't. But honestly, admins have way more power, like actually editing the files.

If you don't  trust them, don't make them admins.

[Kindred]

yup...   an admin basically has full access to your file system through both the package manager and the theme manager...   so, showing them a part of the php file in the error log is not actually a security issue in any real way.

Heck, they can see the source code of EVERY one of the SMF file by downloading the script for themselves.

[LiroyvH]

Gentle reminder that editing files can be prevented by having sane file permissions.

[Bob Perry of Web Presence Consulting]

All of the above, yes and also realize that those "admins" you've allowed can also change YOUR profile so that you are no longer an admin...

[drewactual]

There are three admins on my primary site, and all of them are me.  ... There are two decoy admins that hopefully draw fire from outsiders.  I once locked myself out years ago while far away from I box, and this is the only reason there are three.

[Arantor]

Also I'd note that the base code is downloadable by anyone, so... the base code is visible to anyone anyway.