security related user level problem

[Ihad]

it is undesirable to let any user but the site admin see the database login and password info.

I suggest to add the following line to templates.php in wp-admin directory:
line 18:
if (stristr($file, 'config') &amp;&amp; $user_level < 10)
die(('<p>You do not have sufficient permissions to edit config files for this blog.</p>'));

I chose stristr since it is case insensitve.

[Ihad]

addendum: i added the if clause at the wrong spot. the second file is the correct one.
add:
---
if (stristr($file, 'config') && $user_level <= 9) {

die(('<p>You do not have sufficient permissions to edit config files for this blog.</p>'));

}

---
at line 87 under require_once('admin-header.php'); in teh default: section

cheers
ai

[Froosh]

Directly related to bug #69 (Almost a duplicate except this is really a patch for it...)

[Froosh]

Added and actual patch against current CVS (2004-12-08)