Tightenting Community Server Control Panel Security
By default, the web.config file of Community Server allows any registered user access to the Control Panel, including Setup.aspx and 2 pages hidden from the Control Panel UI that have functionality. To prevent registered users from accessing these files and the Control Panel, change web.config in /ControlPanel to the below. Before doing so, it's a good idea to create a role called ResourceOwner and assign it to all blog authors and file and photo gallery owners as the below change will not allow any of them access to modify their blogs and photo and file galleries since they aren't in the list of allowed roles that can access the Control Panel.
<
configuration
>
<
system.web
>
<
authorization
>
<
allow
roles
=
"
SystemAdministrator,BlogAdministrator,ForumsAdministrator,Moderator,GalleryAdministrator,FileAdministrator,ReaderAdministrator,MembershipAdministrator,ResourceOwner
"
/>
<
deny
users
=
"
*
"
/>
authorization
>
system.web
>
<
location
path
=
"
settings.aspx
"
>
<
system.web
>
<
authorization
>
<
allow
roles
=
"
SystemAdministrator
"
/>
<
deny
users
=
"
*
"
/>
authorization
>
system.web
>
location
>
<
location
path
=
"
Setup.aspx
"
>
<
system.web
>
<
authorization
>
<
allow
roles
=
"
SystemAdministrator,BlogAdministrator,ForumsAdministrator,GalleryAdministrator,FileAdministrator,ReaderAdministrator,MembershipAdministrator
"
/>
<
deny
users
=
"
*
"
/>
authorization
>
system.web
>
location
>
<
location
path
=
"
license.aspx
"
>
<
system.web
>
<
authorization
>
<
allow
roles
=
"
SystemAdministrator
"
/>
<
deny
users
=
"
*
"
/>
authorization
>
system.web
>
location
>
configuration
>