@dcc @000a I thought it was possible to exploit in the recent bug because /media was being served on the root domain, same as /proxy. It just happened to propagate through media proxy because that's easier. My understanding is that it's safest to have both on subdomains.