I have a general question about config and it's placement, and I was unable to find anything about this via the search function.
I just did a new install on one site and an upgrade on another. If I followed the directions properly, config.php is kept in the main directory and chmoded to 666. It is not moved outside the public webspace, as I believe it was in previous versions.
Is it safe to have that file out there with the db and password information in it? Or was I supposed to do something else with it and I misread the instructions?
I am particularly worried right now, as there have been some hacking attempts of feminist blogger webspaces (not eFiction sites) recently, and it's entirely possible I could be targeted as well. If I've screwed up the install somehow and made my site vulnerable, I'd like to fix it ASAP.
Thanks.
Config.php needs to stay in the main webspace. The information in it can be moved to a file outside the webspace and then included in config.php as an extra layer of security. You do not need to leave it CHMOD'd at 666. It only needs to be CHMOD'd to 666 during install.
Thank you!
