Recent Topics
  1. b2evolution CMS Support Forums
  2. b2evolution Support
  3. General Support
  4. Security issue after installation - Installer package public

Security issue after installation - Installer package public

1 Nov 16, 2011 22:48    

Hello Forum.
How do I remove the installer after installation?

I set up my installation in folder dir/blog, but was installed to dir/blog/blogs.
Any person following the URL can access the blog folder which has links to the installer information and can perform upgrades without any restrictions. I think this could be a security, spam and performance issue.

Anyone can access this (*=all details are visible):

Base config recap...

If you don't see correct settings here, STOP before going any further, and update your base configuration.

*MySQL Username: lee******
MySQL Password: (Set, but not shown for security reasons)
*MySQL Database name: lees*******
*MySQL Host/Server: localhost
*MySQL tables prefix: evo_

*Base URL: http://www.lee********

*Admin email: lee********

Please advise.
Thank you,

Lee.

Back to top

2 Nov 17, 2011 02:16

Welcome to the forums!

You must delete the /install directory from your server after you done with application install/update.

Back to top

3 Nov 17, 2011 11:21

sam2kb wrote:

Welcome to the forums!

You must delete the /install directory from your server after you done with application install/update.

Okay, thank you. I do like b2evolution, and it's great that it updates posts to twitter. It'd be good to update other social networks as well.

Can I move the content of dir/blog/blogs/ to dir/blog/ ? It just seems odd having to go through what is now a redundant directory. People still have access to the contents of dir/blog. Should I put a false index.php file in there to stop the directory list being displayed and hyper linked?

Also, for some reason, my blog started as blog5.php, but I don't have any other blogs.

Thank you.[img][/img]

Back to top

4 Nov 17, 2011 17:44

Can I move the content of dir/blog/blogs/ to dir/blog/ ? It just seems odd having to go through what is now a redundant directory. People still have access to the contents of dir/blog. Should I put a false index.php file in there to stop the directory list being displayed and hyper linked?

Of course you can do that, no need to keep any files outside of /blog/blogs directory

Also, for some reason, my blog started as blog5.php, but I don't have any other blogs.

Just go to Blog settings > URLs and change blog URL to "index.php"

Back to top

5 Nov 17, 2011 23:30

sam2kb wrote:

Can I move the content of dir/blog/blogs/ to dir/blog/ ? It just seems odd having to go through what is now a redundant directory. People still have access to the contents of dir/blog. Should I put a false index.php file in there to stop the directory list being displayed and hyper linked?

Of course you can do that, no need to keep any files outside of /blog/blogs directory

Also, for some reason, my blog started as blog5.php, but I don't have any other blogs.

Just go to Blog settings > URLs and change blog URL to "index.php"

Thank you for the information.
It seems that I can only have the blog index.php file in the /blogs directory as shown here: http://www.leesenglish.com/blog/blogs/

What I want is for it to be in http://www.leesenglish.com/blog, which is less messy and prevents an unused directory in the tree.

Have I got to reinstall it from the root directory?

Back to top

6 Nov 18, 2011 18:43

As far as I know all you have to do is move all your files from

/blog/blogs/

to the /blog directory

Once you have done that you will then have to open the /conf/_basic_config.php file and update the like that says:

$baseurl = 'http://www.leesenglish.com/blog/blogs/ ';

to:

$baseurl = 'http://www.leesenglish.com/blog/ ';

L

Back to top


Form is loading...