Off course, but in this case, passwords would only be exposed if the config file... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

CWIZO on March 19, 2011 | parent | context | favorite | on: I think tumblr has a huge security hole

Off course, but in this case, passwords would only be exposed if the config file had a miss-typed opening PHP tag. If "test.php" had it, you wouldn't be able to see the contents of "test2.php".

drdaeman on March 19, 2011 [–]

Yes, you are right. And in this exact case they (mis-)edited the file, that contained passwords (i.e. test2.php in my improvised example).

CWIZO on March 19, 2011 | [–]

Sure, I was replying for this hypothetical situation that you guys ware discussing, where they would store passwords in a different file outside of webroot ...

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact