How many times have I lectured Master Storm on issues of security, and he doesn't pass...
When PsychoRaymond set my hearts to 0 I couldn't prove it because PsychoRaymond had rw access to the logs/* (which you will probably find problems with too, spark, if you plan on looking after the IP range issues). No, rclog.txt does not record itself being uploaded. If it did you might have less problems with security, although not much. Write access to the logs folder should only be given to the manager and the owner. There is no reason for anybody to change logs.
Another thing... backup folders. Only the people creating the backups need to have write access to any backup folders. If you needed to get a script from a backup folder or you needed to see if somebody abused their rights in rclog.txt you can give them rights to read-only. Such sadness came to me when Lone told me he deleted the backup folder on Classic Dev that contained the 2 1/2 years of work and the over 1000 files I had converted in my contribution....
The IP issue is more easily fixed than the folder rights issue. If you put "rw */*" you're giving them access to everything. if you put "rw levels/*" you're leaving out classes, weapons, all the other folders etc.
NPC Code:
rw CLASSES/*
rw NPCS/*
rw WEAPONS/*
That would give you access to all the classes, weapons, and NPCs (on the NPC list, where Control-NPC is). The rest of the directories would be listed simply in the RCs file browser, and if you don't want it to be a huge hassle, keep your folder configs simple. When will people ever learn?