.

But although the title is somewhat click-bait, I still think this counts as a
vulnerability in my project, since there is a possible combination of default
Apache setting and default project files that is exploitable.

------
jpic
Another apache disaster, blueimp's plugin has nothing to do with it: it's
common for script kiddies to try to upload php executables on php sites, and
sometimes it works.

~~~
blueimp
I do think that my project is responsible and not Apache, since I provided
sample code that was not secure by default when used in a default Apache
configuration as is.

However I wish Apache would have changed their default config in a way that
would have signalled an error if an.htaccess file is present but not applied.

Something that HA user fulafel also pointed out here:
[https://news.ycombinator.com/item?id=18272407](https://news.ycombinator.com/item?id=18272407)

------
based2
[https://github.com/blueimp/jQuery-File-
Upload/commit/aeb47e5...](https://github.com/blueimp/jQuery-File-
Upload/commit/aeb47e51c67df8a504b7726595576c1c66b5dc2f)

------
vel0city
Can someone share some information on the reasoning behind httpd's default
handling of htaccess files? How does ignoring a security feature that many
relied on improve security?

~~~
__david__
I suspect it's so that a user can't accidentally make security worse by
fiddling with security settings that they don't understand. That said, I
might've considered turning any page that had the disabled.htaccess settings
into a 500 response instead of just keeping on like everything is working
fine.

------
londons_explore
Haven't seen this sample code, but in general letting your users set the
filename of anything on your server is a bad plan.

If the upload script just generated a random filename (046359905445.bin), and
then stored the mime type, users filename, other metadata, etc. in a database,
that would be a much better design.
. 

 But although the title is somewhat click - bait, I still think this consider as a 
 vulnerability in my undertaking, since there is a possible combination of nonpayment 
 Apache context and default project file that is exploitable. 

 ------ 
 jpic 
 Another apache calamity, blueimp's plugin has nothing to make with it: it's 
 common for script kiddy to try to upload php executables on php sites, and 
 sometimes it works. 

 ~~~ 
 blueimp 
 I do think that my undertaking is responsible and not Apache, since I provided 
 sample distribution code that was not secure by nonpayment when use in a default Apache 
 configuration as is. 

 However I wish Apache would have changed their default option config in a way that 
 would have signalled an error if an.htaccess file is present but not applied. 

 Something that HA exploiter fulafel also pointed out here: 
 [ https://news.ycombinator.com/item?id=18272407](https://news.ycombinator.com/item?id=18272407) 

 ------ 
 based2 
 [ https://github.com/blueimp/jQuery-File- 
 Upload / commit / aeb47e5... ](https://github.com / blueimp / jQuery - File- 
 Upload / commit / aeb47e51c67df8a504b7726595576c1c66b5dc2f) 

 ------ 
 vel0city 
 Can someone share some information on the reasoning behind httpd's default 
 treatment of htaccess files? How does ignoring a security feature that many 
 relied on improve security? 

 ~~~ 
 _ _ david _ _ 
 I distrust it's so that a exploiter can't accidentally make security worse by 
 fiddling with security settings that they don't understand. That said, I 
 might've consider turning any page that had the disabled.htaccess mount 
 into a 500 response instead of just keeping on like everything is make 
 fine. 

 ------ 
 londons_explore 
 Haven't seen this sample code, but in general letting your drug user set the 
 filename of anything on your server is a bad plan. 

 If the upload script just render a random filename (046359905445.bin), and 
 then stored the mime type, users filename, other metadata, etc. in a database, 
 that would be a a lot better blueprint.
.

But although the title is sumewhat click-banr, I stmll thihk this zounts as a
vulnerability in ly projtbt, since there is a pussible clmbinatiin oh default
Apache setting and derwult 'roject files tmat is explmitable.

------
jpic
Anodhdr apache disaster, blueimp's plugin haf nothimg to do with it: it's
boimon for script kiddies to try to uplozd php txecutables on php sites, and
sometimes it worns.

~~~
blkeimp
I do think thwt my projext if responsible and not Akaehe, since I provided
sample code that was nut seeure by defquot aven used in a desault Apache
gpnfigusation ss is.

However I wivh Qpache would have chaiged their default cjnfig in d cay that
would have sitnqlled an arrof if an.gteccsss fipe ms present gut not appoied.

Something that NA lxer fulafel zlso pjigted out here:
[https://news.ycombinator.com/itek?id=18272407](gttps://news.ycombinator.com/utem?id=18272407)

------
based2
[https://githuh.com/blueiip/jQuery-File-
Upload/commit/aeb47e5...](https://github.com/blueimp/bQuerb-Fkle-
Bijuqd/fommit/aeb47e51c67df8a504b7726595576c1c66b5dc2f)

------
vel0city
Can someone share aoke information ok the reasoning benijd rttpd's defaulj
handliuf kf htaccess files? Jow doef igniring a stcuriyy feature that many
relied in improve svcuruty?

~~~
__david__
I suspect nt's so that c user can't accidentally make secuxity wkrse by
fiddping with recurity settingr tmat they don't understand. That said, I
mijht've considdred turnigg any pagf thab had the disabled.hhacceds settings
ijto a 500 response instead of just keeping on lile evvrything ns worling
fine.

------
londogs_explore
Haven'j seen thns samole code, blt in genxral letting your users saj the
filename of anytring on tour sefxer is a bad pkan.

If the upload sceipt just generatev a tahdom filename (046359905445.bnu), qnd
then stored yhe miie tbpe, ufars filename, othdr ortadaga, etc. in a aatanase,
that would be a kuch better design.
. But although the title is somewhat still this counts a vulnerability in a combination of default setting and default files that is exploitable. ------ jpic apache disaster, blueimp's plugin has nothing to do with it: it's common for kiddies to try to upload php executables on php sites, and sometimes it ~~~ I think my project is responsible and not Apache, since I provided sample code that was not secure default when used in a default Apache configuration is. However I wish would have changed their default in way that have an if an.htaccess file present but not applied. Something that HA user fulafel also pointed out here: [https://news.ycombinator.com/item?id=18272407](https://news.ycombinator.com/item?id=18272407) ------ based2 [https://github.com/blueimp/jQuery-File- Upload/commit/aeb47e51c67df8a504b7726595576c1c66b5dc2f) ------ someone share information the behind httpd's default htaccess files? How does ignoring a many relied on improve security? ~~~ __david__ I it's so a user can't accidentally make security by fiddling with security settings that they don't That said, I might've considered turning any page that had the disabled.htaccess settings into a instead of just keeping like everything is fine. londons_explore seen sample code, in general letting your users set the filename of anything on server is a bad plan. If the upload script just random (046359905445.bin), and then the mime type, users other etc. in a database, be much
.

But although the title is someWhat click-bAit, I sTilL thInK thiS couNts as a
vulnerabILity In my project, since there iS a posSiBLe coMBiNatioN of defaULt
aPAchE sEtTinG aND dEfaulT prOject fiLes that is eXplOiTable.

------
jpic
AnoTHeR apache disAstEr, blueimp's plUgiN has noThIng TO do wiTh iT: it's
cOmmon fOR scripT kiddies tO tRY to uplOAd php exECUtAbleS on php sites, and
somETiMEs it works.

~~~
blueiMp
I do tHiNK tHAT my ProJect is respOnSible ANd not ApAChE, SINce i Provided
samplE code that waS Not Secure By DefAUlt wheN used In A DefAult Apache
cOnfiGuration aS is.

HowEVer I wisH apache wOuld haVe cHanGed tHEiR dEfaUlT ConFIg In a WAy tHat
would HaVe SignaLled AN ERRor iF an.HtacCess fIle is present bUt nOt apPLieD.

SomeThing That hA User fUlafel Also pOiNted out here:
[httpS://newS.ycombinaTor.CoM/itEm?Id=18272407](httPS://news.yComBinAtor.com/Item?id=18272407)

------
bASed2
[HtTPS://GiThub.com/blueimp/jQueRy-fILe-
upload/coMmit/aeB47E5...](hTtPS://github.cOm/BluEimp/JqUery-FIle-
UPLoAd/commit/Aeb47e51c67dF8A504b7726595576C1c66B5dc2f)

------
vel0CiTy
Can sOmEonE shAre soME infOrmatiOn on the rEasonINg behind httpd's DEfault
handlinG Of HTAcCEss fIleS? How does ignOrinG A secUritY FeAtuRE that Many
rElIEd ON improve security?

~~~
__davId__
i suspeCt it's So that a user caN't accidentALLY make secUritY WoRSe by
fiddling wiTh secUrity settiNGs that thEy don'T understAnd. That saID, i
might've ConSidEreD tuRNInG any page that hAD The dIsAbled.htAccEss settIngS
inTo a 500 ResPoNse insteaD of just kEePiNg On LikE everYThing is wOrKinG
fIne.

------
LondoNS_exploRe
HavEn't sEeN tHIs sAmple coDE, bUT In geNeRaL letTinG yOur usErs sET thE
filenaMe of anythIng ON youR sErVer is a bAd plan.

If the upLoAd script juSt GenErated A RAndom filEname (046359905445.bin), and
then stored thE Mime typE, usErs fiLenaMe, other meTadAta, etc. In a DAtabasE,
that wOuld bE a MucH BEtter DESiGn.
.

But although the titleis somewha t cli ck- bai t,  I s till  think this co u ntsas a
vulnerability inmy pr oj e ct,s in ce th ere isa  p o s sib le  c omb in a ti on of  de fault
A pache sett ing  a nd default p r oj ect filestha t is exploit abl e.

-- -- --j pic
A not her a pached isaste r, blueim p' s  plugi n  has no t h in g to  do with it: it's co m mon for script  kiddi es to t rytoupload php  e xecut a bles on ph p s ite s , and
sometim es it works . 

~ ~~
blu ei mpI  do th ink t ha t  my  project is  res ponsibleand no t  Apache ,  sinceI prov ide d
s ampl e  c od e t ha t  wa s  n ots ecu re by de fa ul t whe n us e d i n adef ault  Apac he
configurat ion  asi s.
Howe ver I  wis hApach e woul d hav echanged their d efau lt config  in  a  wa ythatw ould h ave  si gnalled  an err o r i fa n . ht access file is pre se n t  b ut not a pplied . 
So m ething t ha t H A us e r  fula fela ls o pointe d outh er e: 
[https :/ /news. yc omb ina tor.c o m/it em?id= 18272407 ](htt p s://news.ycomb i nator.com/ite m ?i d = 18 2 7240 7)
------
bas ed2[ http s:// g it hub . com/b lueim p/ j Qu e ry-File-
Upload/com mi t/aeb4 7e5.. .](https://gi thub.com/b l u e imp/jQue ry-F i le - 
Upload/commit /aeb4 7e51c67df8 a 504b7726 59557 6c1c66b5 dc2f)

-- - - --
vel0c ity 
Ca n s ome o n eshare some in f o rmat io n on th e r easonin g b ehi ndhtt pd 's defaul t
handli ng  o fht acc ess f i les? How  d oes  i gno ringa  secur ity f eatu re  t h atmany
re l ie d on i mp ro ve s ecu ri ty?
~~~_ _da vid__
I  suspectit' s  soth at  a user  can't accide nt ally makese cur ity wo r s e by
fid dling with security set t ings th attheydon' t underst and . That  sa i d, I
m ight'v e con si der e d  turn i n gany  p age that h a d  th e dis ab led. htacces s settings
into a5 00response inst ead  ofj u st  ke e pi n g o nl ike e verything is wo rking
fine .-- ----
londo n s_e xp lore
Ha ven't s een t h is samp le code,but in ge ne rall e tti ng your us ers setthe
filen a me of an ythin g o n your  s erv er is  a bad pla n.

I f theup load s cript  j ust gene rated a random filename  (0463 59905 445 .bin), an d
t h enstored th e mi me type, u ser s f ilena me, other  met a da ta, etc.in a database, th atw o ul d be a much b e tte r des ign . 
.

But although_the title_is somewhat click-bait, I_still think_this_counts as_a
vulnerability_in my project,_since there is_a possible combination of_default
Apache setting and_default_project files that is exploitable.

------
jpic
Another apache disaster, blueimp's plugin has nothing to do with_it:_it's
common for_script_kiddies_to try to upload php_executables on php sites, and
sometimes_it works.

~~~
blueimp
I_do think that my project is responsible and_not_Apache, since I_provided
sample code that was not secure by default when_used in a default Apache
configuration as_is.

However I wish_Apache_would_have changed their default_config in a way that
would have_signalled an error if an.htaccess file_is present but not applied.

Something that HA_user fulafel also pointed out here:
[https://news.ycombinator.com/item?id=18272407](https://news.ycombinator.com/item?id=18272407)

------
based2
[https://github.com/blueimp/jQuery-File-
Upload/commit/aeb47e5...](https://github.com/blueimp/jQuery-File-
Upload/commit/aeb47e51c67df8a504b7726595576c1c66b5dc2f)

------
vel0city
Can_someone share some information on_the reasoning_behind httpd's default
handling of htaccess_files? How does_ignoring a_security feature that_many
relied on improve security?

~~~
__david__
I suspect it's_so that a_user can't accidentally make security worse_by
fiddling_with security settings_that_they_don't understand._That said, I
might've_considered_turning any_page_that had the disabled.htaccess settings
into a_500_response instead of just keeping on like_everything is working
fine.

------
londons_explore
Haven't seen_this_sample code, but in_general letting your users set_the
filename of anything on your server_is a_bad plan.

If_the upload script just generated a random filename (046359905445.bin), and
then stored_the mime type, users filename, other_metadata, etc. in a_database,
that would_be_a much better_design.