phpwcms Support Forum

When I view the conf.inc.php for phpwCMS, it lists my SQL user details, as well as the admin login name and password (albeit in encrypted format). I was wondering, if someone'd know the URl to the conf.inc.php file, could they view it, too?

Did you try to view it yourself already?

I tryed it on my localhost and on the web. All i can see is a blank site.

mfg
flopi

Okay, so did I. Still, though, the config file listing is visible by just going to http://www.mysite.com/phpwcms/config. Any ideas on how I can turn it off?

[x]

conf.inc.php does not produce any output - so there is no way to get your private data displayed as long as the webserver is responsible loading the file. Another situation would be if any script could access the file in different way. But this is a general security issue - for every script.

Oliver