Hey everyone,
the forum is up again. From what I could figure out we *did* have a
security problem. The forum installer was not properly locked and thus
allowed anyone who accidentally stumbled on it to change the database
connection configuration. ouch.
Interestingly enough I was able to trace the person who did this in
the logs and even got their email address. I don't think it was a
deliberate attack, but an accident by a very novice user who was
actually thinking they're in their own wiki installer. I emailed them
for a confirmation, but I don't know if I will hear back from them.
Anyway form what I can see, no malicious activity was done and there
was no access to other user accounts. I deleted the installer, created
the lock file and also denied access to the installer in the
webserver. The other admins can find some more details on what I did
in the admin wiki.
Nevertheless we need to think about replacing the forum software
rather soon. It is no longer maintained and does not work with PHP 7.
Personally I would like to switch to discourse, but we need to figure
out how to transfer the posts over. If anyone has experience with
running an instance, please let me know. I could use some help setting
up a test version.
Andi
--
splitbrain.org
--
DokuWiki mailing list - more info at
http://www.dokuwiki.org/mailinglist
