The page said to come here. 🙂

So will this be an automatic change on upgrade or will I need to do something with my current AdminCP location beforehand?

Out of interest, why has this facility been changed for V5?

Many thanks.

 

"We would recommend removing the constant and ensuring the admin folder is uploaded."

I remember somewhere to have hidden the admin folder at some point, somehow.
My question would be how and where do I undo this (Also when?) and where exactly is this remove setting for this "constant"?

 

Its set in your constants.php file

 

If this is the case, why did Invision change their admincp location from default?

While I appreciate the attempt, you're actually incorrect. Just because you cant access it, doesnt mean its not present

 

While I appreciate the attempt, you're actually incorrect. Just because you cant access it, doesnt mean its not present

I mistook the default for admincp instead of just admin. My mistake on that one. But regardless of the point, security through obscurity is a fantastic layer of security and one that should not be removed. Sure, you can block the page in your firewall or Cloudflare rules, but there's no easy way to make this dynamic. Anytime you add or remove a user with ACP access, you now have to whitelist their IP, many of which are dynamic and change every other day.

It’s simple enough to keep and is especially useful for adding an extra layer of security to your suite. If you truly think obscurity isn’t a secure measure, let me introduce you to steganography! (Directed at Jim)

 

Which is why we advise on 2 factor authentication. Although, I have to be honest, if you have that many coming and going admin, you have more issues with security than hiding a folder

Stenagraphy - Noun - the practice of concealing messages or information within other nonsecret text or data.

I'm not actually sure the defininition of Stenagraphy states it is a secure measure. However, lets skip past that part and assume it absolutely is.

What my colleague stated was "Security through obscurity isn't the best method of security." This is not in any way the same sentence as "security isnt a secure measure". Its probably not wise to misquote people, as it can cause confusion for others, and lead them believe we have said things that we actually haven't.

What Jim said there is correct. Its not the best method of security. No matter whether or not you want to have security by obscurity or not, it doesn't make it the best method.

Listen, we get it. You would prefer to have this option. However this has now already been removed in version 5, and we advise on 2 factor authentication.

I'm not trying to beat anyone up over this, but I don't see how the coming and going of those with admin access is relevant to security. Not everyone with ACP access has full access. We utilize the in-depth permission system to give team members certain scopes to work with. But even with a small team that rarely changes, their IP will change quite often, which means using a firewall to block access will be impossible without some type of custom integration.

2FA does solve the problem, but I (and I'm sure others) would prefer not to have the page accessible to anyone. Given IPS is a well-known software, the default location is easily accessible and is a very common path that many other CMS's use. It would make me feel better being able to set a unique name so people can't stumble upon it, even if it's secure.

Was there any particular reason this feature had to go? I agree it didn't make much sense in regards to security, but it didn't hurt? I feel like the usefulness of this was underestimated when this was decided upon. The lack of a deprecation warning until now seems a bit odd as well. Surely this is going to be overlooked up until IPS5.

Hmm, the question was if it's automated, not where it is and how to change it. But I think I can safely say it's not automated.
@marafa , @Stefan Johansson_72643 My thought about this is, if you rely on it, only change it back just before you are going to upgrade to v5.

@Jim MI understand that being in possesion of all the in and outs of this software makes certain questions seem rather obvious. But myself not being of the technical branch, fiddeling around with code or other severly sensitive items Invision Community forum software wise, makes me always very nervous. Afraid I f* up, I rather touch nothing until I'm absolutely sure I won't fork up my forum. And even then I'm hessitant. 

It's something I notice with your help guides. They often start at "H" and end on "P" and everything before or after that is, I guess, assumed obvious. But for me I'm left with even more questions than I started with. It leaves large parts of this software for me unused as the help guides, don't tell the whole story from A to Z, but merly touch upon things. 

I would prefer if I could place the admin panel on its own subdomain. Much better for security when using Cloudflare One and deploying Zero Trust for the admin domain. 

https://www.cloudflare.com/case-studies/cloudflare-one/
 

Edited November 17, 2024Nov 17 by KT Walrus

I'd like to get back to the default folder in prep for v5, so if I am understanding correctly, rename my adminxxxx folder back to "admin" and completely remove the custom name from constants.php?

Thank you

 

That is correct 🙂 

Jim, do I need to replace the name in constants with the default name? Or just eliminate that line altogether?

 

Jim, do I need to replace the name in constants with the default name? Or just eliminate that line altogether?

Completely remove 😉