I'm not very happy about having anything other than /images be writable under my DocumentRoot - it sets off security red flags. I can't see a way to configure $compile_dir so as not to be under DocumentRoot. Is there a way? Could this be added to a future version of the extension?
Topic on Extension talk:Widgets
You could set this to /images with the "$wgWidgetsCompileDir" parameter
Ah, I turned out to be on 0.9.2. Thanks :-)