News for hackers. Stuff that matters.

A comment on I think tumblr has a huge security hole. Parent comment

Re:I think tumblr has a huge security hole by CWIZO on Saturday March 19, 2011 @10:07AM (#2343605)
Off course, but in this case, passwords would only be exposed if the config file had a miss-typed opening PHP tag. If "test.php" had it, you wouldn't be able to see the contents of "test2.php".
[ Parent | on HN ]
Re:I think tumblr has a huge security hole by drdaeman on Saturday March 19, 2011 @10:09AM (#2343606)
Yes, you are right. And in this exact case they (mis-)edited the file, that contained passwords (i.e. test2.php in my improvised example).
[ Parent | on HN ]
Re:I think tumblr has a huge security hole by CWIZO on Saturday March 19, 2011 @10:14AM (#2343618)
Sure, I was replying for this hypothetical situation that you guys ware discussing, where they would store passwords in a different file outside of webroot ...
[ Parent | on HN ]