AJAX Upload Disabler
Component type
Categories
Maintenance status
Development status
Component created
Component changed
My employer's website was flagged by Google as "hacked" a week and a half ago. Since that time, the other web and security team members and I have been pouring over logs attempting to figure out what has happened. Eventually, we nailed down that files were being uploaded to our server as temporary files through Drupal's AJAX file uploader via public webforms without the form truly being submitted and the appropriate parties notified that a submission had occurred.
