Admin account hacked & preventing password changes

[WildEye]

Or i suppose one could add a simple conditional to the template to exclude certain users from being able to change their passwords,

In "USERCP_SHELL" I found:

    <tr><td class="$navclass[password]" nowrap="nowrap"><a class="smallfont" href="profile.php?$session[sessionurl]do=editpassword">$vbphrase[edit_email_and_password]</a></td></tr>

And added:

<!-- HIDE ADMIN PASSWORD -->
<if condition="!is_member_of($bbuserinfo, 6)">
    <tr><td class="$navclass[password]" nowrap="nowrap"><a class="smallfont" href="profile.php?$session[sessionurl]do=editpassword">$vbphrase[edit_email_and_password]</a></td></tr>
</if>
<!-- HIDE ADMIN PASSWORD -->

The above hides the link to the change email and password page in USER CP but if you know the URL you can still access it directly. Thats where the 2nd part comes in.

And in "modifypassword"

find

<table class="tborder" cellpadding="$stylevar[cellpadding]" cellspacing="$stylevar[cellspacing]" border="0" width="100%" align="center">

Above this

<!-- HIDE ADMIN PASSWORD -->
<if condition="!is_member_of($bbuserinfo, 6)">
<!-- HIDE ADMIN PASSWORD -->

and finally above at the very bottom of the template:

 </form>

add

 <!-- HIDE ADMIN PASSWORD -->
 </if>
 <!-- HIDE ADMIN PASSWORD -->

This will give you a blank page on the change email and password page ( http://www.yoursite.com/forum/profil...o=editpassword ).

Anyway, my little hack to "solve" the underlying problem.