XF 1.5 Deferred.php Admin only?

[Culv3r]

I'm just wondering if any normal forum user would need direct access to deferred.php? From my limited experience it seems as if it only runs when rebuilding caches after installing addons or changing permissions in the back end.

It appears as if someone may have used this script to attack our website so can I restrict this php file to admin use only or would it harm the functionality of the forums if I did so?

 

[Paul B]

How did they use the file to attack your site?

Loading the file directly shouldn't cause any issues: https://xenforo.com/community/deferred.php

 

[Culv3r]

I'll keep digging through our logs but it appears they used some method unfortunately to severely disrupt our site. I noticed that deferred.php was one of the links that was accessed by IP's from an unknown country. Thank you for the reply.

 

[Mike]

Deferred.php is automatically triggered when browsing the site. It's use isn't really indicative of anything (and the loading of it doesn't tell you what action it took as it's very dynamic.)