is it ready for production

[kilburn]

Quote:Users are able to change into other user's phpMyAdmin account and browse, manipulate or delete their databases

So local user privileges were required. I don't know about you, but my clients don't usually fiddle around trying to break their server (and I would get rid of them instantly if they did). Nevertheless, some type of worm could get you on this, but there are backups to mitigate any damage. Additionally, it was quickly fixed after the report.

Quote:ispCP Omega's database password can be looked up from logs

Once again, you needed local user's privilege for that. Additionally, since ssh access is off and both ftp and php are chrooted, it was only exploitable through cgi.

So yes, we've had some security flaws. Everyone does, even more on a program covering such a wide area, requiring root operations, etc.. Despite that, our policy is to publish security flaws as soon as they are discovered and offer mitigations and patches as fast as we can. All other cp's have had security issues too, but you can't say that they all have such an open policy as we do...