Source for 0.3.2 can be obtained from: http://puzzle.dl.sourceforge.net/sourceforge/drakecms/drake_0.3.2_beta_rev1306.tar.gz admin/includes/header.php starts with: <?php if(!defined('_VALID')){header('Status: 404 Not Found');die;} so an attacker can't really call it directly. George -- theall at tenablesecurity.com