diff --git a/lang/strings_english.txt b/lang/strings_english.txt index 5a2165e2c2..131b19c1d1 100644 --- a/lang/strings_english.txt +++ b/lang/strings_english.txt @@ -656,7 +656,7 @@ $s_click_to_login = 'Login'; # login.php $s_warning_plain_password_authentication = 'Warning: Plain password authentication is used, this will expose your passwords to administrators.'; $s_warning_default_administrator_account_present = 'Warning: You should disable the default \'administrator\' account or change its password.'; -$s_warning_admin_directory_present = 'Warning: Admin directory should be removed.'; +$s_warning_admin_directory_present = 'Warning: "admin" directory should be removed, or access to it restricted.'; $s_warning_change_setting = 'Warning: "%1$s" is not set to its default value (%2$s).'; $s_warning_security_hazard = 'This is a potential security hazard as it can expose sensitive information.'; $s_warning_integrity_hazard = 'This will cause MantisBT to continue when errors occurs and may lead to system/data integrity issues.'; diff --git a/login_page.php b/login_page.php index 4d3d05aa22..1b514802d4 100644 --- a/login_page.php +++ b/login_page.php @@ -140,6 +140,13 @@ $t_warnings = array(); $t_upgrade_required = false; if( config_get_global( 'admin_checks' ) == ON && file_exists( dirname( __FILE__ ) .'/admin' ) ) { + # Check if the admin directory is accessible + $t_admin_dir = dirname( __FILE__ ) . '/admin'; + $t_admin_dir_is_accessible = @file_exists( $t_admin_dir . '/.' ); + if( $t_admin_dir_is_accessible ) { + $t_warnings[] = lang_get( 'warning_admin_directory_present' ); + } + # Generate a warning if default user administrator/root is valid. $t_admin_user_id = user_get_id_by_name( 'administrator' ); if( $t_admin_user_id !== false ) {