I think tumblr has a huge security hole

Re:I think tumblr has a huge security hole by wladimir on Saturday March 19, 2011 @09:39AM (#2343541)

Files outside the web root are not accessible by the user via HTTP, so I don't see the issue with that?

Unless you include it from somewhere in the web root, but that's the other insecure-by-default behaviour I was hinting at. With a secure-by-default web framework, it's not possible to get the code to show at all because it's not intermingled with the content.

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by russss on Saturday March 19, 2011 @09:46AM (#2343554)

If there are no PHP files in the web root then what does your web site do?

Every block of PHP code must begin with '<?php', regardless of where it's located, or whether it's included from another file.

I do agree with you that this is a silly behaviour. But it's nothing to do with the web root.

[ Parent | on HN ]