<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; ">I just created a ticket in Trac for a potential security vulnerability in vtiger: <A href="http://vtiger.fosslabs.com/cgi-bin/trac.cgi/ticket/25">http://vtiger.fosslabs.com/cgi-bin/trac.cgi/ticket/25</A><DIV>I also created a post in the forums as well: http://forums.vtiger.com/viewtopic.php?t=5704</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><B>Here are the details:</B></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">I know that most good systems admins would delete the install directories (I always do), but we are likely to have quite a few of the "uninitiated admins" installing vtiger. I would hate to leave vtiger open for attack. The install docs do not mention removing the install directory either. A hack on a vtiger install would not look good if it received any kind of press. This worst case scenario would force my company to switch to offering a different product. I <SPAN class="Apple-style-span" style="text-decoration: underline;">really</SPAN> don't want to do that.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><B>Here are the contents of the ticket I </B><B>submitted:</B></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">If the install directory stays on the server after installation, an informed individual could change the admin password without any trouble at all, they could also view the mysql database and username information. With the current change in the branch, they could also change the SQL database (readonly tags removed). If the files in the install directory are removed after install, this risk will not exist. I have a diff that adds simple deletion of the install directory after completion of Setup Step 5.</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Helvetica; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><B>Here is the diff file I created for the branch:</B></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "></DIV></BODY></HTML>