Category: security

wp_list_pages errors WordPress 2.5 and 2.6

By Lewis Wolfe, Thursday, July 31st, 2008

In the course of producing a theme that uses wp_list_pages for the standard menu, with a whole list of args, including exclude, as documented here, I find a series of non-standard behaviours - particularly when using a .mo file in the theme directory and in /wp-content/languages/

This is only with wp_list_pages for 2.5 upwards, WordPress 2.3 versions, not a problem, doing exactly what it’s supposed to…

The “official” radar seems to have no interest in the matter, so I was wondering whether any one could report their experiences…?

Browse Happy?

By Lewis Wolfe, Thursday, June 19th, 2008

Well, I never noticed that - having naturally been with Firefox since it was Phoenix and used to explode your machine with great regularity I don’t often need to touch other fine browser products….

Continue reading »

WordPress mask version display plugin

By Lewis Wolfe, Wednesday, April 30th, 2008

Further to the discussion here, over the source display of WordPress version, imposed on users of the default install of WordPress 2.5 - a plugin to regain a little control.

WordPress version 2.5 - security fix

By Lewis Wolfe, Sunday, April 27th, 2008

 WordPress 2.5 has a vulnerability - undocumented, at this stage - with more information here

From the look of the files involved, it wouldn’t seem at this stage to affect WordPress 2.3.3 as such - 2 of these files don’t exist in that version (but this is only speculation, given limited info).

WordPress security - SSL admin

By Lewis Wolfe, Friday, April 11th, 2008

A security plug-in to put the admin and login under SSL - interesting and probably not before time as an option.

Of course, you will need SSL on your domain, but certificates don’t cost anything like they used to, it’s just the fun of installing them hasn’t changed…

Continue reading »

WordPress 2.2.1

By Lewis Wolfe, Thursday, June 21st, 2007

As will probably be noticed, WordPress 2.2.1 is out - again a required update.
Of some importance is the  phpmailer security fix, which is discussed in more detail here and considered to affect “PHPMailer 1.73, when configured to use sendmail”.

PHPMailer has certainly been a great app, but maybe starting to show its age a little in terms of continuous development…

Sponsored WordPress Themes - What Problem?

By Lewis Wolfe, Tuesday, April 10th, 2007

So, how many designers of themes embark on their fine work entirely altruistically? Not many. I did a couple of themes a couple of years ago, leaving them on my web development site, and they still contribute significantly to the PR of the front page. This allows the sale of text links and is a nice little earner month by month. Theme designers do it for the exposure, direct or indirect, the vanity, ultimately the cash, (as well as that warm feeling inside of having put something back).

So it’s a issue that’s always been with us - the discussion is of sponsored themes and the practice of pre-placing links, static/dynamic, visible/invisible to humans in return for hard cash.

The “where does one draw the line” arguments.

Text Link Ads have a whole business built on a parallel practice, to little public alarm, perhaps an example of the inevitable “if you’ve got a well-designed web presence it all looks better”. I note they have just introduced sponsored links for some individual posts.

Is the assumption that sponsored themes lead to an increase in the rubbish out there, strictly accurate? - the quality of coding appears to be slightly higher, if anything…

It is always possible to take a free theme and strip out anything you don’t fancy… The converse, taking someone’s theme and rebranding as your own is far far worse, but attracts less discussion because there ain’t nothing to be done about it…

Weblogtoolscollection have made the decision not act as the police, or indeed magistrates, for the community - they say that they will permit sponsored themes to be promulgated on the site, but not given any priority and dropped in the case of any severe infraction. The talk is of “a nasty taste in the mouth”, presumably left by the naked capitalism of sponsorship left standing so close to the OpenSource ethic.

I would disagree slightly. If you do consider the situation is on fire, then fire has to be fought with fire. A certain large corporation, that started off as a search engine, drops sites with or without reason, and certainly without a second thought, on the “it’s my site and I’ll have who I want to” principle. Courage in your convictions, even balanced against the concept of free speech and distribution.

The guiding principle has to be protection - some are not as php-literate as others, and less well-placed to go through the code for anything nasty in the front/back door variety. There are certainly some simple exploits available, which I wouldn’t propose to describe in greater detail here. If you do come across anything you think dubious, announce it - but give the right of reply.

The future? Who knows, maybe a codecheck for wordpress themes - the successful bearing a seal of approval - but I’m not sure the situation has reached that stage yet…

Themes and Security

By Lewis Wolfe, Friday, February 9th, 2007

It’s very simple - don’t just upload a new theme without having a look at its code first… You are laying open your server to the complete whim of the theme programmer.

Examples of the problem here and here  are only the tip of the iceberg in terms of what could be achieved as exploit.