Tested trunk checkout of today. DocumentRoot of default apache VirtualHost was left browsable and showed all website and welalizer folders.. This was visible when browsing to the ip of the ispconfig server or when there was a mismatch between hostname and VirtualHost configs.