User:Leucosticte/Insecure settings

The following are insecure settings.

Enabling upload and execution of arbitrary PHP scripts

$wgStrictFileExtensions = false;
$wgFileBlacklist = array();
$wgVerifyMimeType = false;