I think tumblr has a huge security hole

Re:I think tumblr has a huge security hole by CWIZO on Saturday March 19, 2011 @10:05AM (#2343594)

That custom error handler was never set, because the code you see above never even executed. The reason was, like said many times already, a miss-typed opening PHP tag, which tells PHP where PHP code is. If that tag is missing or miss-typed the code is just returned to the browser like HTML.

The point is that no server configuration can save you from an error like this.

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by moe on Saturday March 19, 2011 @11:08AM (#2343760)

The point is that no server configuration can save you from an error like this.

Huh? Yes you can protect against errors like this; http://news.ycombinator.com/item?id=2343675

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by eli on Saturday March 19, 2011 @11:34AM (#2343808)

Well, off the top of my head, mod_security has rules that scan outgoing data for password or code leakage.

A deployment strategy that requires testing that pages show what you expect them to show would also likely catch it.

[ Parent | on HN ]

Re:I think tumblr has a huge security hole by nbpoole on Saturday March 19, 2011 @10:38AM (#2343678)

If the custom error handler was never set, the PHP notices wouldn't look like that.

[ Parent | on HN ]