Plugin Security Vulnerabilities

Hi Dan,

I can assure you that though I did not catch the bug before it was publicly posted, I was quick to remove the multiple upload functionality along with the effected files and if you would’ve checked the developers page you would’ve seen that I also removed all previous versions including ones that did not contain the security whole. Please do the proper research before spouting off. Thanks!

The fact that you’ve removed previous versions is exactly my concern. There is no way to verify that sane changes have been made.

I am “spouting off,” because your actions have prevented proper research from being possible.

-Dan

Removing the files from the repository prevents someone from attempting to use a version that would open their server up to having a malicious script uploaded. Anyone doing “Research” could clearly find what the exploit was without the files on the repo and also confirm that the files were removed completely.

Sorry that I don’t feel compelled to rehash an issue that has already been resolved, but if you feel like you hit a dead end in your research and need pointed in the direction of where to look, feel free to email me directly and I will be happy to help.

Thanks!

What you did may have been well-intentioned, but the logic is severely flawed. One of the primary benefits of open source development is that other developers can independently verify that a plugin does what it claims. By removing the previous versions, all you have achieved is making it necessary for someone attempting to verify that previous security vulnerabilities to go through the entire source, versus being able to simply run a diff across the versions.

If someone goes into the developers tab and manually pulls down a version other than the current version, it is safe to assume that they are an advanced user and intended to do so. You as an open source developer have the responsibility to make such actions possible, especially when security vulnerabilities are in play.

I will not consider this issue as resolved until the code history is restored.

-Dan

Sorry but I will not be restoring the code. If someone is an advanced user and wants that information, they will know where to find it. Considering your a plugin developer and have plugins published here on wordpress you should know how to use Trac.

You are welcome to keep this issue open as long as you would like. This is not a support issue and has been marked as such. If you feel that strongly about this issue, please direct further communication to support[at]wordpress[dot]org

Thanks!

I do indeed know how to use Trac. That does not make this any less of an unscrupulous action on your part.

-Dan