Zero-day in jQuery plugin sample code exploited for at least three years

Re:Zero-day in jQuery plugin sample code exploited for at le... by jpic on Monday October 22, 2018 @06:08AM (#18273419)

Another apache disaster, blueimp's plugin has nothing to do with it: it's common for script kiddies to try to upload php executables on php sites, and sometimes it works.

[ Parent | on HN ]

Re:Zero-day in jQuery plugin sample code exploited for at le... by blueimp on Monday October 22, 2018 @11:15AM (#18275293)

I do think that my project is responsible and not Apache, since I provided sample code that was not secure by default when used in a default Apache configuration as is.

However I wish Apache would have changed their default config in a way that would have signalled an error if an .htaccess file is present but not applied.

Something that HA user fulafel also pointed out here: https://news.ycombinator.com/item?id=18272407

[ Parent | on HN ]