I'm convinced of the added value of the protector module, but i would like to remark a minor security risk in the config.

If someone can get direct access to the database, IE the hosting company ... if if if ...

Protector stores the rescue password unencrypted in the xoops_config table

field: conf_name: passwd_disabling_bip
field: conf_title: _MI_PROTECTOR_PASSWD_BIP
field: conf_value: ***unencrypted password***


storing the pass MD5 encrypted seems more secure in my case

i've just noticed a new version 2.35 of protector, but the risc still exists

I have also noticed some problems , when I use relative urls in real html code enabled comments of the polls modules, I hope to find out why tomorrow.

Xoops Forum