Please upgrade here. These earlier versions are no longer being updated and have security issues.
HackerOne users: Testing against this community violates our program's Terms of Service and will result in your bounty being denied.

is my forum compromised?

Bud1Bud1 New
edited July 2010 in Vanilla 2.0 - 2.8
I'm a little concerned that my forum has been compromised. First, the other day, my settings.php file was broken causing my forum to go down; turns out it was missing a portion of the code near the bottom -- but I have not attempted to upload anything to my forum in quite some time and I don't suppose this is a file that gets rewritten automatically, so why should it have been altered at all? Its edited date on the FTP was the day my forum went down -- I did not FTP anything that day for certain.

Then different roles have different AVAILABLE permissions allotted to them -- not just different ones ticked -- but different ones showing altogether. One has an entirely unique permission: PERMISSION_SM_WRITE. None of the other roles have it. Is this normal?

After the first incident, my last logged in IP on my cPanel shows my IP only as the last having logged in -- so I don't think they're going through my cPanel. But are there some common security loopholes I need to shore up?

I'm on 1.1.5a. Will updating protect me or fix anything that has already been exploited?


  • Options
    I'm not sure what has happened but you should Definitely be upgrading your forum. There is almost certainly security updates in the later releases and bug fixes. Remember to try your update locally before you make it live and always have a backup.
  • Options
    Is there a way to upgrade directly to the latest, or do I have to go 1.1.5a -> 1.1.6 -> 1.17 and so on all the way up to 10?
  • Options
    I vaguely remember some of the upgrades you could jump and some you couldn't... Cant really help you. Each step would definitely do the job though.

    @Mark may know...
  • Options
    Here's a question that will help calm my nerves quite a bit, in a properly functioning Vanilla forum, does the settings.php file in the conf directory get rewritten/altered on its own? In mine, its last updated date is today, but I haven't done anything with it for two days. This seems decidedly suspect to me unless this is a natural part of how the Vanilla forum works. Any thoughts?
  • Options
    That is, should the settings.php file change, naturally assuming I also didn't change anything in the Settings tab while logged in as an administrator to the forum.
Sign In or Register to comment.