Why is Awstats implemented? -> security risk

[petzsch]

As far as I remember there was an issue in 6.4 that could be exploited by manipulated URLs in logfiles. So this version was even affected when awstats generated static html files.

It wasn't really the nature of the bug that fuzzed me, but the time that it took to mend it in the public releases. But I guess if one is unforgiving, than even anything labeld VHCS would not be worth considering to be installed because of it's history.

Just my $0.02

I agree that there should be an option for the admin to decide about this, perhaps even to enable both and to let the reseller/customer make an individual choice (if both where enabled by the admin).