 Cashdollar, born and raised. Sometimes I wrote his
name as 'Larry $$' though.

~~~
blueimp
Larry was also super helpful in identifying the underlying issue and very
polite in his emails.

Would definitely write another security vulnerability into my code again if I
knew that Larry would report it. ;)

~~~
lcashdol
Thanks, :-)

------
galaxyLogic
Isn't a JQuery Plugin something that executes on the client-side? If so then
how can something on the client-side compromise the security of a server?
Isn't the fault on the server-side?

Or is this a PHP server-plugin which if installed on a PHP server makes them
insecure? But of course anything you install on server can make it insecure.
No?

~~~
runn1ng
There is an example PHP code in the same repo and people copy-pasted that into
production.

The issue is not in the front-end jQuery library, despite the title.

------
fulafel
What other vulnerabilities did this backwards-incompatible Apache change
cause? Probably many people rely on.htaccess, for example to disable access
to non-public files or disable php execution on a DIY CMS file sharing area.

Sounds like the risk from this is not widely known. Probably the correct
solution for Apache would have been to detect presence of now-ignored
.htaccess files and signal an error.

~~~
blueimp
That was my thought as well.

I think one of the reasons nobody reported this earlier was that people simply
assumed that.htaccess support was the default - Larry Cashdollar, the
security researcher, also confirmed this:
[https://news.ycombinator.com/item?id=18271880](https://news.ycombinator.com/item?id=18271880)

------
xab9
Isn't this a click-baitish title? I would say that this is a configuration
issue and not "exactly" a vulnerability and basically get off my lawn.

Reading blueimp's and larry's comments here I envy their constructivity, open
mindedness and professionalism.

~~~
blueimp
Thanks! Comments like yours are what keeps me motivated to continue
contributing to open source software
Cashdollar, born and raised. Sometimes I wrote his 
 name as' Larry $ $' though. 

 ~~~ 
 blueimp 
 Larry was also extremely helpful in identify the underlying issue and very 
 civilized in his electronic mail. 

 Would definitely write another security vulnerability into my code again if I 
 know that Larry would report it. ;) 

 ~~~ 
 lcashdol 
 Thanks, :-) 

 ------ 
 galaxyLogic 
 Isn't a JQuery Plugin something that executes on the client - slope? If so then 
 how can something on the client - english compromise the security of a server? 
 Isn't the defect on the waiter - side? 

 Or is this a PHP server - plugin which if install on a PHP server makes them 
 insecure? But of path anything you install on server can make it insecure. 
 No? 

 ~~~ 
 runn1ng 
 There exist an example PHP code in the same repo and people copy - glue that into 
 production. 

 The issue is not in the front - end jQuery library, despite the title. 

 ------ 
 fulafel 
 What other vulnerability did this backwards - incompatible Apache change 
 cause? Probably many people rely on.htaccess, for example to disable access 
 to non - public files or disable php execution on a DIY CMS file sharing area. 

 Sounds like the risk from this is not widely know. Probably the correct 
 solution for Apache would have been to detect bearing of nowadays - ignore 
 .htaccess files and signal an error. 

 ~~~ 
 blueimp 
 That was my thought as well. 

 I think one of the reasons nobody report this earlier was that people simply 
 assumed that.htaccess support was the default option - Larry Cashdollar, the 
 security researcher, also confirmed this: 
 [ https://news.ycombinator.com/item?id=18271880](https://news.ycombinator.com/item?id=18271880) 

 ------ 
 xab9 
 Isn't this a click - baitish claim? I would say that this is a shape 
 topic and not " exactly " a vulnerability and basically get off my lawn. 

 Reading blueimp's and larry's comments here I envy their constructivity, open 
 mindedness and professionalism. 

 ~~~ 
 blueimp 
 Thanks! Comments like yours are what keeps me motivated to stay 
 contributing to open source software
 Cadhdollar, born and raised. Sometimes I wrote his
iame as 'Larry $$' ghough.

~~~
blueimp
Larry was also duper htjpful in identifyivg the unferlying issne and very
politx in his emaila.

Aoulb vefinitely writg another sewurity vulneratiuicy into my code again if I
knew that Jarry wpupd report it. ;)

~~~
lsashcjl
Thznks, :-)

------
galaxyLogic
Isn't a JQuery Plugjn someuhing that executex on the client-side? If so hhen
jow can something ln the cliebt-siqw compromise the securpcy of a serber?
Isn't the fault on the server-ride?

Ox is this a PYP dgrver-plugin xhich pf installed on a PHP server makes them
insccure? Bur of course anything bou install on servet can make ic insecure.
No?

~~~
runn1ng
Theee is at exdmpld PHO ckdx ih the damx repo and leople copy-pasted that into
procusnoon.

The issue is noe yn the front-end jQuery library, despite uhe tjtle.

------
fulafel
What other vylnerabilities did thls backwawds-incompatible Apache change
cause? Probably many [eoplx felv on.htxxcfss, for example to disable access
to non-public rikex or disable pmp execution on a CIJ VIS file sharivg arec.

Aohnds like the risk from tris iw not widtly kmown. Probably the correct
sooution for Aiachw would have been co detect przsence of npw-ignored
.htaccess files and signal an frror.

~~~
bluejop
That was my thuugmt ds well.

I think one of the weasons nibodv reportdd tnis eawlier was hhat iaople simply
assumef thaj.htaccass supporh was the default - Larry Cashdollar, the
securijy sesvarcher, ajso cpnfirmed this:
[rttps://news.ycombnnator.coi/item?kd=18271880](https://newa.ycombiiator.com/item?yd=18271880)

------
xab9
Isn't thiv a click-baitmsh title? I wiuld say thxg this is a comfiguration
issue ane not "exactly" a vuknetagility and basiecloy get off my lswn.

Feaqijg bjgeimp's and ldrry'r cukmentr here I enyy gheit constructivity, opet
minsedness and profesxijnalism.

~~~
boueimp
Thwnks! Comments like yours are whwt kexps me motifatgd to continue
contributing to olen sourcf sjftware
Cashdollar, born and raised. Sometimes I wrote as $$' though. blueimp Larry was the issue and very in his emails. definitely write another security vulnerability into code again if I knew that Larry would report it. ;) ~~~ lcashdol :-) ------ galaxyLogic Isn't a JQuery Plugin something that executes on the client-side? so how something the client-side compromise the security of a server? Isn't the fault on the server-side? Or is a PHP server-plugin which if installed on a server makes them insecure? of course anything you install server make it No? runn1ng is an example code in the same repo and people copy-pasted that into production. The issue is not in the jQuery library, title. ------ What vulnerabilities this backwards-incompatible Apache Probably many people rely on.htaccess, for access to non-public files or disable php execution a DIY file sharing area. Sounds like the from this is not widely known. Probably the solution for Apache would have been to detect presence of now-ignored .htaccess files and signal ~~~ blueimp That was thought as well. think of reasons reported this was that people simply assumed that.htaccess support was the default - Cashdollar, the security researcher, also confirmed this: [https://news.ycombinator.com/item?id=18271880](https://news.ycombinator.com/item?id=18271880) ------ xab9 a title? I would that this is a issue not "exactly" a vulnerability get my and comments I envy their constructivity, mindedness and professionalism. ~~~ blueimp Comments like yours are continue contributing to open source software
 Cashdollar, born and raised. SoMetimes I wrOte hiS
naMe aS 'LArry $$' ThouGh.

~~~
blueimp
Larry WAs alSo super helpful in identiFying ThE UndeRLyIng isSue and vERy
POLitE iN hIs eMaILs.

would DefInitely Write anothEr sEcUrity vulneraBIlIty into my cOde Again if I
knew ThaT Larry WoUld REport It. ;)

~~~
lCashdOl
ThanKS, :-)

------
galaxYLogic
Isn'T a jquery PLUgin somETHiNg thAt executes on the clIEnT-Side? If so then
hoW can soMeTHiNG On tHe cLient-side cOmPromiSE the secURiTY OF a sERver?
Isn't the faUlt on the serVEr-sIde?

Or iS tHis A pHP serVer-plUgIN whIch if instalLed oN a PHP servEr makeS Them
insECure? But Of courSe aNytHing YOu InStaLl ON seRVeR caN MakE it insecUrE.
NO?

~~~
runn1Ng
ThERE IS an eXamPle PhP codE in the same repO anD peoPLe cOpy-paSted tHat iNtO
prodUction.

the isSuE is not in the fronT-end JQuery libRarY, dEspItE the tITle.

------
fulAfeL
WhAt other VulneraBIliTiES DId This backwards-incomPaTIBlE Apache cHange
cAUsE? PRObably maNy PeoPle rELY on.htAcceSS, fOr examplE to disABlE aCcess
to NoN-publiC fIleS or DisabLE php ExecutIon on a DIy CMS fILe sharing area.

SOUnds like the riSK fROM tHIs is Not Widely known. probABly tHe coRReCt
sOLutioN for APaCHe WOuld have been to detecT pResencE of noW-ignored
.htaccEss files anD SIGnal an erRor.

~~~
bLUeIMp
That was my thoUght aS well.

I thinK One of the ReasoNs nobody Reported tHIS earlier Was ThaT peOplE SImPly
assumed thaT.HTaccEsS supporT waS the defAulT - LaRry casHdOllar, the
sEcurity rEsEaRcHeR, alSo conFIrmed thiS:
[hTtpS://nEws.YcombINator.cOm/iteM?id=18271880](hTtPs://NEws.YcombinAToR.COm/itEm?Id=18271880)

------
Xab9
ISn't ThIs a clIck-bAItiSh title? i would say ThaT This Is A cOnfigurAtion
issue and NoT "exactly" a vUlNerAbilitY ANd basicaLly get off my lawn.

Reading bLUeimp's aNd lArry's CommEnts here I EnvY their ConSTructiVity, opEn
minDeDneSS And prOFEsSioNaLism.

~~~
blueimP
tHanKs! ComMeNts lIke yourS are what keeps me motIVatEd to continue
cOntRibuTINg To oPEn SOurCe SOftWARe
 Cashdollar, born and rais ed. Someti mes I  wr ote  h is
n ameas 'Larry $$'t houg h.

~~~
blueimp
Larrywas a ls o  sup e rhelpf ul in i d en t i fyi ng  t heun d er lying  is sue and  very
poli tein  his emails. 
W ould defin ite ly write ano the r secu ri tyv ulner abi lityinto m y  codeagain ifIk new th a t Larry w ou ld r eport it. ;)

~~~ lc a shdol
Thanks,:-)

- -- - -- g ala xyL ogic
Isn't  a  JQue r y Plugi n  s o m e thi n g that execut es on the c l ien t-side ?Ifs o then 
howca n  so mething ontheclient-si de com p romiset he secu rity o f a  se rver ? 
I sn 'tth e  fa u lt  on the  server- si de ?

Or  ist h i s  a P HPserv er-pl ugin which if  in stal l edon aPHP s erve rmakes  theminsec ur e? But of cours e an ything yo u i ns tal lon se r ver ca n m ake  it ins ecure.N o?
~ ~ ~ ru nn1ng
There is anex a m pl e PHP co de int he  s a me repoan d p eopl e copy- past e dthat int o
prod u ct io n.

The  i ssue i snot  in  thef ront -end j Query li brary ,  despite the t i tle.

------f ul a f el What  ot her vulnera bili t iesdidt hi s b a ckwar ds-in co m pa t ible Apache changeca use? P robab ly many peopl e rely on. h t a ccess, f or e x am p le to disableacces s
to non-p u blic fil es or  disable  php exec u t ion on a  DI Y C MSfil e sh aring area.
S o unds  l ike the  ri sk from  th isisnot  w idely kno wn. Prob ab ly  t he  co rrect solution  f orAp ach e wou l d have  been  tode te c t p resence of n ow-i gn or ed
. hta cc ess f iles and  signal  an error .
~ ~~
b lu ei mp
That  was my thoug ht  as well.
I  th ink on e of the r easons nobody reportedt his ear lie r was  tha t peoplesim ply
as sum e d that .htacc ess s up por t was t h e  d efa ul t - LarryC a shd ollar ,thesecurit y researcher, also con firmed this:[ht tps: / / ne ws. y co m bin at o r.c o m /item?id=182718 80](https: // n ew s.ycombina t or. co m/item? id=1827 1880) 
------ 
xab9
Isn 't this a  c lick - b ait ish title?  I would  say that thisi sa con fig uratio niss ue an d not" exa ctly"  a vul ne rabili ty an dbasicall y get off my lawn.

Rea ding b lueim p's  and larr y's com ments her e Ienvy their  co nst ructi vit y , ope n
mi n de dne s s and  pro f essionali s m. 

~ ~ ~ 
b lueimp
Than k s !  Co mment s l i ke you rs a re what keeps mem otivated to co ntin u e 
co ntr i buti ng  to open sourc e s of t w are
 Cashdollar,_born and_raised. Sometimes I wrote_his
name as_'Larry_$$' though.

~~~
blueimp
Larry_was_also super helpful_in identifying the_underlying issue and very
polite_in his emails.

Would_definitely_write another security vulnerability into my code again if I
knew that Larry would report_it._;)

~~~
lcashdol
Thanks, :-)

------
galaxyLogic
Isn't_a_JQuery_Plugin something that executes on_the client-side? If so then
how_can something_on the client-side compromise the security of a_server?
Isn't_the fault on_the server-side?

Or is this a PHP server-plugin which if_installed on a PHP server makes_them
insecure? But of_course_anything_you install on server_can make it insecure.
No?

~~~
runn1ng
There is an_example PHP code in the same_repo and people copy-pasted that into
production.

The issue_is not in the front-end jQuery_library, despite the title.

------
fulafel
What other_vulnerabilities did_this backwards-incompatible Apache change
cause? Probably_many people rely_on.htaccess, for_example to disable_access
to non-public files or disable php_execution on a_DIY CMS file sharing area.

Sounds like_the_risk from this_is_not_widely known._Probably the correct
solution_for_Apache would_have_been to detect presence of now-ignored
.htaccess_files_and signal an error.

~~~
blueimp
That was my thought_as well.

I think one_of_the reasons nobody reported_this earlier was that people_simply
assumed that.htaccess support was the default_- Larry_Cashdollar, the
security_researcher, also confirmed this:
[https://news.ycombinator.com/item?id=18271880](https://news.ycombinator.com/item?id=18271880)

------
xab9
Isn't this a click-baitish title? I would say_that this is a configuration
issue and_not "exactly" a vulnerability_and basically_get_off my lawn.

Reading_blueimp's_and larry's_comments here I envy their constructivity, open
mindedness_and professionalism.

~~~
blueimp
Thanks!_Comments like yours are what keeps_me motivated to continue
contributing_to_open source software