[Merriweather]

Originally Posted by Been Told

But I'm unsure about installing this - maybe the developer can make a statement in regards to what oatsy said? That'd make my decision easier.

The developer has not posted since early December 2006 and has ignored a PM I sent for support on this mod. My guess is that it is no longer supported.

Without knowing what file the hackers used and how the files got there, I think it's unfair to assume it was the cause of this mod, though I also respect the need for clarification on the mod's security.

I have tested my personal installation of this mod and am not able to upload a .php, .html or .htaccess file.

My guess is that the hackers hit oatsey some other way, and that the folder holding oatsey's hosted images has been CHMODED to 777 (all permissions to all groups) which in itself is a security risk. You're better off using 755. On a shared server, nothing should ever be world-writable with mode 666 or 777. Doing so can potentially allows other users of the server to change your files. A hacker may have uploaded a bona-fide image file through the mod and then hacked the file through the server, which is not a problem with the mod itself.

Of course, I have no proof of this, but in my experience, you cannot use this mod to upload anything other than images.