byc

And here’s the logs of the hacker’s path through my site during his session on it:

[log content censored for your protection]

Actually don’t rename wp-login.php. Go in and edit it to disable the lost password functionality for the time being. Go to line 369 and add an extra line after it with “break;”

So before is:
case ‘lostpassword’ :
case ‘retrievepassword’ :

After is:

case ‘lostpassword’ :
break;
case ‘retrievepassword’ :

hello?

Nevermind, found the db flag for it.

Hmm looks like WordPress MU might be a better solution for me.

Ok, I’ve created the contributor. I see the login and it looks like they would get access to the admin panel, but limited view. How do I restrict other aspects of the contributor account? I noticed that logging in as a contributor I can see posts and comments created by other accounts. I’d like to restrict it so they can only see their OWN postings and not even be able to edit comments.

Ok I reviewed it. So I’ve set it so that users are automatically contributors. The question is, if a new user comes to my site and would like to contribute an entry, where would they go to register? The only way I see so far is if they try to leave a comment, then they’ll see a place to enter name/username.

To further explain, I’d like to create a site where anyone that comes to the site can create entries that go into a queue where I can review them and publish.