I'm sorry if I haven't made it clear before (though i believe I've apologised a few times for this) but I do apologise for any impact this caused. Once the impact of this was apparent we immediately dropped other items and focussed on resolving it (without reopening the identified security vulnerability) and were able to get a new release out in record time (despite half of the team being enroute to dnnworld)
Security issues tend to be a seperate classification from other items as security of the platform overrides other requirements, and sometimes will require functionality to be compromised e.g. we remove the ability for admins to upload skins as skins can contain code (which would allow an admin the ability to steal hosts credentials/execute sql etc.). This was an unpopular change (I still field requests to add it back in regularly) but in this case necessary as security trumped functionality. This is not arrogance from myself or the security team, we think hard about these functional changes as any reduction in functionality always has an impact.
In the case of this bug, I made a similar judgement call where I felt the fix was serious enough to require immeadiate resolution -the plan had always been to put the fix in place and then later update it to provide the users more control (to be able to enable/disable on individual html modules). However, I underestimated how many people were using this functionality - this was solely my fault and probably comes from me never personally using this approach. Whilst we do have code-reviews in place and the code was reviewed by another engineer, they similarly did not anticipate the impact. Since then we have put in place a process by which security items are reviewed by folks from our business and QA areas, as well as other engineers and architects, to ensure a broader consensus of users (and users with different approaches and technical levels) is reached, so that a security fix should never have this issue again.
Over the years I've checked in fixes for 58 different security issues, and this is the first one that's had this level of impact. Whilst I fully appreciate the severity of the impact, I hope that shows that we do work hard to maintain the balance of ensuring the security of the platform whilst not impacting the requirements of it's users - that said one mistake was still one too many, and not one we hope to ever repeat in the future.
Cathal