Hacker News Reader

Wow. That's actually really bad. I just patched my php.ini to disallow file uploads because thankfully, we don't need them anyway. Others might not be so lucky though.

Also, I'm assuming that by "move try_files" you really mean "copy a variation of try_files". Sorry for being pedantic, and correct me if I'm wrong.

View on HN

Yes, you're right. I actually did move the line in my testing, but for it to work properly, you would want to duplicate it. I'll update my comment. :)

I should also mention that merely allowing uploads via php.ini is not an issue: you need to be storing them somewhere web accessible. A good rule of thumb for this: if you could put a PHP script in the uploads directory and have it execute, you have a potential problem.

Reply on news.ycombinator.com