|
Anybody encounter any recent WP security problems? I've got a friend's site that keeps getting exploited. I've got his WP at 3.4.2, and have removed all plugins, and poo poo still goes wrong. Basically every night someone gets in and changes the mysql database account's password (and does nothing else). I was looking at the logs and I'm seeing two vectors for attacks: 1. xmlrpc in wordpress, with several hits for things like: code:2. Checking for the presence of cPanel (Godaddy, it's there) e.g.: code:
|
#
?
Nov 1, 2012 02:11
|
|
|
|
| # ? Jun 5, 2024 18:13 |
|
|
Does anyone have experience with Pods, specifically pods 2.0? I have two pods right now: artist and album. There can be many albums attributed to an artist. I am looking for a way for users to create a line in a new pod called "collection" which will include album_ID, user_ID, and extra info like type (cd, vinyl, tape, etc) and condition. The intent would be to be able to go to that user's page and see all the records they have, their condition and type. Is there a straightforward way to create an add form that will create the collection pods based on who is logged in, and what record you are viewing?
|
|
#
?
Nov 2, 2012 18:09
|
|
|
So, a broad, all encompassing question: Wordpress security. Waaay back in the thread, I spoke about how I was porting my old (Plone-based) personal & professional website to Wordpress. Things move along slowly, but I'm happy with the functionality and the way things are working. But before I finish it up and let it go live, I'd like to get things tied down. And there is a massive number of things you can do about security. Here's what I've done: * Moved wp-config.php out of the root directory * Installed plugin for backing up site * Installed the Bulletproof plugin for setting up .htaccess files correctly * Changed the name and location of the wp-content dir * Stripped wordpress and version signatures from headers * Deleted the admin user, added a (differently named) admin account and an editor account for the actual posting * generated and used the random keys * only used plugins and themes from the official site, uninstalled unnecessary plugins * used randomly generated passwords everywhere * checked and adjusted file permissions following Bulletproof and a few other programs * scanned with sitecheck * changed table prefix to a random one Other advice? Note: this is self-hosted on my own machine. The machine software is updated automatically. Is there any way I can get notice of the WP software being updated, other than through the WP dashboard?
|
|
#
?
Nov 9, 2012 14:21
|
|
|
Scaramouche posted:But they never actually try to do anything with cPanel, or at least nothing that shows up in the logs. So I've narrowed it down to either WordPress or cPanel, and was wondering if there's some new exploit hotness in WordPress that you guys have heard about that I haven't? I have about thirty sites all running Wordpress from AWS and don't see this behavior at all. Can you get the PHP version info and poo poo like that from the server host? My experience with Godaddy hosting is that they have kept their third party web apps woefully behind in security updates. outlier posted:So, a broad, all encompassing question: Wordpress security. You've got pretty much everything covered, to be honest. The only other thing I'd recommend is making sure the SQL database isn't accessible from the outside and only from your hosted machine. quickedit: Also, change the table prefix to something random, and the database name to something random.
|
|
#
?
Nov 9, 2012 16:08
|
|
|
I have a Wordpress user who isn't getting the bar at the top of the control panel and other important UI elements on the Dashboard or the Edit Post page. On the post listing page, for example, everything seems fine. According to Firebug, most of the Javascript from the other pages isn't being loaded from the server when I'm on the Dashboard. There's no errors in the console. Anyone seen this before? It only affects some users, but not admins.
|
|
#
?
Nov 14, 2012 17:42
|
|
|
rt4 posted:Anyone seen this before? It only affects some users, but not admins. I did have a similar situation that upon investigation turned out to occur only with particular browsers on a particular machine. I concluded that either an extension (say for adblocking) or the firewall / proxy on that machine was blocking the javascript. However I never identified the exact problem as that machine stopped being used and it didn't occur elsewhere.
|
|
#
?
Nov 15, 2012 12:19
|
|
|
I'm in the process of building a Wordpress theme backend to tie together with my front-end designs. My intent is to make it extremely easy for even basic users to get up and running with all the content types and configuration they might need, as well as customization all out of the box. It will also be highly configurable regarding which content types etc are used, which would make it easy for theme developers to grab and attach to their own themes, configure it and deliver to clients. I'm adding in some security stuff, and a lot of neat options, but I am trying to get more input from Wordpress users/developers as far as functionality and features you'd want out of a new backend. I'd appreciate any thoughts and insights you guys might have. edit: my current intent is to sell themes, but to give the back-end away to people who might get use out of it and combine it with their own front-ends. I haven't quite figured out the details on that yet but keep in mind that it's for a broad userbase to play with.
|
|
#
?
Nov 20, 2012 14:59
|
|
|
I'm using the facebook plugin for comments, but somehow people are able to bypass facebook bit and getting access to the default wordpress comment system to leave spam. I'm not quite sure what the point is - as far as I can tell, they aren't being displayed publically anywhere - but it's still annoying. Is there a way of disabling access the standard comments and leaving the facebook ones available? Switching things in the post settings puts either both of them on or both off.
|
|
#
?
Nov 22, 2012 14:11
|
|
|
What theme are you using? I would take a look at your comments.php and comment out (hah) any of the comment-related forms.
|
|
#
?
Nov 23, 2012 15:15
|
|
|
I'm trying to make a loop that will only display one post per author on a blog with many authors. Secondary (or tertiary) recent posts by the same author will still show up in another loop below the main one. Here's the way it's currently setup with some extraneous stuff taken out. code:
|
|
#
?
Nov 25, 2012 00:34
|
|
|
Hey guys, I thought I might ask here in regards to cost before throwing up an ad in SA-Mart. My GF is looking to set up a semi-professional blog to promote ideas and share information in her job field. We already have a domain and hosting setup through Lithium, and have decided it might be easier to pay someone to get her setup completely. A new theme wouldn't be necessary, but things would include, -a clean, professional style theme -social media connections, both to her and able to link to -RSS feed -easy way to post updates through the WordPress interface, including photos and video -some basic SEO, just to get her in google -ability to connect with other like-minded blogs -attach documents for viewing and download -any plugins 'you' feel are essential or would help with the site I'm not looking for an exact quote, more so a ballpark figure so we know what we're getting into. Thanks guys!
|
|
#
?
Nov 25, 2012 01:47
|
|
|
Can anybody recommend a decent plugin for posting nice looking code snippets? Line numbers is the part I really want, but syntax highlighting would be nice too. WP-Syntax's lack of support for the rich editor is a dealbreaker (plus for some reason I can't get it to work at all now, even after deleting and reinstalling the plugin). GeSHi Source Colorer looks promising but it's not very well documented and I can't figure out how to make it work. Anything else out there?
|
|
#
?
Nov 25, 2012 18:38
|
|
|
h_double posted:Can anybody recommend a decent plugin for posting nice looking code snippets? Line numbers is the part I really want, but syntax highlighting would be nice too. WP Code Highlight maybe? http://wordpress.org/extend/plugins/wp-code-highlight/
|
|
#
?
Nov 25, 2012 22:53
|
|
|
Is anyone familiar with Wp Ecommerce on Wordpress? Or better yet, the UPS api? My commerce site works fine, but the UPS shipping calculations are based on the overall weight for ONE shipment. I'd like to calculate it based on MULTIPLE shipments. I've looked on the UPS api and on WpEcommerce and I cannot find any "parameter" i can pass thru to UPS. Any help is much appreciated.
|
|
#
?
Nov 28, 2012 04:08
|
|
|
1. Is it possible to get the name of the author of a comment in the comment reply link? Like "Reply to fuf" instead of just "Reply". 2. There's no way of controlling the text that facebook selects when you use a share button, right? It's annoying that it gets the post title from the title of the page but then repeats it in the little text summary bit. fuf fucked around with this message at 20:15 on Nov 28, 2012 |
|
#
?
Nov 28, 2012 19:55
|
|
|
fuf posted:
If it's a single page/post you should be setting the title/description open graph tags to help Facebook's scraper. If it's a list of posts, each with their own button, the button should be sharing the post's permalink instead of the archive link.
|
|
#
?
Nov 28, 2012 23:36
|
|
|
Now that I think about it, using Filezilla's view/edit file function to develop a website is probably a bad idea. Are there any hands-down best options for wordpress development environments in linux? I'm personally the sort to rate software options with accessible video-tutorials higher than options that are more effective/flexible, as long as it meets a baseline of supported bells and whistles.
|
|
#
?
Nov 29, 2012 19:14
|
|
|
the kawaiiest posted:WP Code Highlight maybe? The problem is, none of the syntax highlighter plugins I've seen (WP Code Highlight, WP-Syntax, GeSHi Source Colorer) work with the visual/WYSIWIG editor -- as in, if I toggle to the visual editor for even a second, it screws up the included code -- changing "<" to "& lt", losing the indentation, etc. I wonder, is there a way I could put the snippet in a separate file/location and include it into the main document so that it wouldn't be molested by the visual editor? h_double fucked around with this message at 19:59 on Nov 29, 2012 |
|
#
?
Nov 29, 2012 19:48
|
|
|
I need some help with this menu. I'm pretty good but new with Wordpress and I'm building this site for a client. I have a horizontal parent menu in the header and the child menu loads onto a left sidebar. I got the sidebar child menu down, but the child menu has its own sub-nav that needs to stay hidden and then load on a click into the sidebar below the child menu. I want to leave this menu easily editable in the admin menus. Basically it's like this code:Would this be best down through a plug-in, function file, or JS? I would prefer to stay away from JS. Everything I've looked for just brings up accordion menus. BTW I don't know why this is designed this way when I think static sub-sub-navs would work just fine since we're using it on another page. 
cheese eats mouse fucked around with this message at 21:40 on Nov 29, 2012 |
|
#
?
Nov 29, 2012 21:37
|
|
|
h_double posted:The problem is, none of the syntax highlighter plugins I've seen (WP Code Highlight, WP-Syntax, GeSHi Source Colorer) work with the visual/WYSIWIG editor -- as in, if I toggle to the visual editor for even a second, it screws up the included code -- changing "<" to "& lt", losing the indentation, etc. If you're posting code, why do you need the visual editor?
|
|
#
?
Nov 29, 2012 22:22
|
|
|
the kawaiiest posted:If you're posting code, why do you need the visual editor? It's code snippets mixed in with other content, as part of an article. I don't need the visual editor for the actual code snippets, the problem is that if I put some code in a post, then want to use the visual editor to add in a table or play with the layout or something, just the act of switching to the visual editor usually mangles the code snippet.
|
|
#
?
Nov 30, 2012 07:02
|
|
|
Cheekio posted:Now that I think about it, using Filezilla's view/edit file function to develop a website is probably a bad idea. Are there any hands-down best options for wordpress development environments in linux? I'm personally the sort to rate software options with accessible video-tutorials higher than options that are more effective/flexible, as long as it meets a baseline of supported bells and whistles. I would do one of two things: - If your computer can handle it, make a Virtual Machine that is identical to your hosted environment, or as close as you can get. I'm hosting all my sites at Amazon these days, so it is very easy to get identical environments. For instance, I have a shell script set up to configure nginx and PHP and the like as much as possible on a new instance if needed. Point your machine at https://www.whateversite.com as the virtual machine IP address, and then just move the files up to the hosted server when ready. Kind of clunky but this is how I used to do it. - Look into a local LAMP stack if you are using apache and just edit the files directly.
|
|
#
?
Nov 30, 2012 15:36
|
|
|
h_double posted:It's code snippets mixed in with other content, as part of an article.
|
|
#
?
Dec 1, 2012 11:38
|
|
|
Create a shortcode for whatever you're trying to do an then just drop the shortcode in the visual editor. If you need to edit the script do it in your functions.php where you've set this up.
|
|
#
?
Dec 1, 2012 18:26
|
|
|
I've been tasked with remaking a website and they want a members list like can be seen on http://www.extremism-and-democracy.com/ead/index.php?option=com_sobi2&Itemid=53 and they want it to be easily updatable. Does anyone have any suggestions for how to do it? I assume that the easiest way is to store the information in a database and have a plugin that pulls from it or? I'm open to any suggestions.
|
|
#
?
Dec 2, 2012 19:09
|
|
|
Sad Panda posted:I've been tasked with remaking a website and they want a members list like can be seen on http://www.extremism-and-democracy.com/ead/index.php?option=com_sobi2&Itemid=53 and they want it to be easily updatable. Does anyone have any suggestions for how to do it? I assume that the easiest way is to store the information in a database and have a plugin that pulls from it or? I'm open to any suggestions. Use the Types plugin to create a custom post type/taxonomy for Members. The navigation I'd probably do as a menu and have a taxonomy as the first letter or something. A pain in the rear end to set up but I did something similar for a "State Map Members" page for a client.
|
|
#
?
Dec 3, 2012 01:41
|
|
|
I'm probably going about this all wrong, but I'm curious to hear intelligent thoughts. (mine are all out.  ).I'm building a wordpress site, where recipes are put into posts. You can filter on a number of attributes, like: Type: [ ] breakfast [ ] lunch [ ] diner Allergies: [ ] Soy-free [ ] Gluten-free [ ] Nut-free Kicthen: [ ] Oriental [ ] African [ ] Caribbean And so on... When the user was finished with his selection, I'd go through all the selected checkboxes, and pass these on to the page that filters the posts. The plan was to then search for all posts that contain ALL of the selected tags. If somebody checked breakfast, Soy-free AND Oriental, i only want to return recipes that match all three. That works great, however (and you can probably see where this is going)... As soon as the user selects both breakfast, lunch, soy-free and oriental, the whole thing breaks down. Because now the thing needs to work with categories:(Lunch OR breakfast) AND Soy-free AND Oriental. Now these properties are set on the posts with tags. I can work out logic that reads the checkboxes per group and present them to WP, but then what? What i need is some sort of: $my_query = new WP_Query( array('tag_slug__in' => array(implode['Group1']), array('tag_slug__in' => array(implode['Group2']), array('tag_slug__in' => array(implode['Group3']), array('tag_slug__in' => array(implode['Group4']), )); But i haven't a drat clue how i could get the WP query interface to behave in such a manner.
|
|
#
?
Dec 3, 2012 23:32
|
|
|
shelper posted:I'm probably going about this all wrong, but I'm curious to hear intelligent thoughts. (mine are all out. I'd probably tackle this using taxonomies instead of tags. Make Type, Allergies and Kitchen taxonomies and use the tax_query argument of get_posts or WP_query. e.g: php:<?
$posts = get_posts(
'tax_query' => array(
'relation' => 'AND',
array(
'taxonomy' => 'type',
'field' => 'slug',
'terms' => array('breakfast', 'dinner')
),
array(
'taxonomy' => 'allergies',
'field' => 'slug',
'terms' => array('soy-free')
),
)
);
?>
|
|
#
?
Dec 4, 2012 15:00
|
|
|
I would also do that with Taxonomies and use something like the Query Multiple Taxonomies widget.
|
|
#
?
Dec 4, 2012 15:53
|
|
|
Shucks, you guys are terrific! I haven't even gotten to the actual problem i had earlier yet, and I'm already happy with this solution. Giving my client the opportunity to easily edit multiple categories? And then showing those on the search page but only when they actually have posts, along with their parent categories? Taxonomies are the poo poo! You two are seriously my heroes.
|
|
#
?
Dec 4, 2012 23:20
|
|
|
edit: nevermind!
lol internet. fucked around with this message at 20:07 on Dec 5, 2012 |
|
#
?
Dec 5, 2012 18:39
|
|
|
I am looking to hack together a new theme and have found that all the sliders plugins i have used cannot support a background image. Its for a mobile apps portfolio and i want a landscape iphone which the screen of is a slider with easily changeable images. Like this one but in landscape. http://bit.ly/TEDUxD
|
|
#
?
Dec 6, 2012 14:41
|
|
|
Gyshall posted:Use the Types plugin to create a custom post type/taxonomy for Members. The navigation I'd probably do as a menu and have a taxonomy as the first letter or something. A pain in the rear end to set up but I did something similar for a "State Map Members" page for a client. I tried that and my head hurt working on it. I found http://we.bsit.es/wordpress/2011/12/how-to-make-a-wordpress-member-list-with-custom-fields-and-import-a-csv-user-list/ which is not the ideal way, but seems to work. One thing, I've used the User Meta plugin to add custom fields. Is there any way to make it so wordpress shows the custom fields in the regular user menu?
|
|
#
?
Dec 9, 2012 05:58
|
|
|
I had someone put a Twitter sidebar widget on my blog that matched my format, but unfortunately it only displays the last twitter post or no posts at all. Is there a better way to keep my Twitter feed updated in this widget? The blog is hppt://www.DClaiborne.com and here is the code for the widget they used: code:And finally, where do I need to go so I can place an option at the bottom of my home page (under the post summaries) for people to view older posts, next page, etc.? Alfalfa fucked around with this message at 15:12 on Dec 9, 2012 |
|
#
?
Dec 9, 2012 15:05
|
|
|
Help! I was just notified my WP site stopped working. I hadn't touched anything so I thought this was weird. I'm getting a internal server error 500, so I start digging around my logs. I'm seeing the following: quote:mod_rewrite: maximum number of internal redirects reached. Assuming configuration error. use 'RewriteOptions MaxRedirects' to increase the limit if necessary Again, I haven't touched anything in a bit but had kept my installation and plugins up to date. I've been Googling around and I've tried the following: 1.Disabling permalinks via phpMyAdmin since I cannot login to the wp-admin (same error). No luck. 2. Deleting my root directory's .htaccess file and resetting it to the WP standard. Nothing. 3. Yelling at my computer screen to no avail. 4. Trying out various other "solution" .htaccess files that Google has provided. No dice. 5. Renamed my plugin directory and created a new plugin directory that's empty to reset my plugins (along with the entry in the wp_options) table that says which plugins are active. Please help, has anyone experienced this previously with their WP installations?
|
|
#
?
Dec 10, 2012 21:49
|
|
|
Alfalfa: I'm not familiar with the widget, but it looks to just have a very long time-out between refreshes. If you wait long enough, you eventually see more tweets. I'd try playing around with the interval parameter a bit. I screwed around with it a bit myself, but the documentation for this thing is abysmal, and i somehow made it unable to stop creating new tweets. In other news, the taxonomy recipe search works great, so i thought I'd add the cherry on top with an ingredient search, that just searches the post content. And man, am i just blind or is this not possible at all with get_posts?
|
|
#
?
Dec 10, 2012 23:04
|
|
|
Doh004 posted:Help! I was just notified my WP site stopped working. I hadn't touched anything so I thought this was weird.
|
|
#
?
Dec 11, 2012 00:22
|
|
|
porkface posted:Does this happen the same for both the https://www.sitename.com and sitename.com URLs? Yes 
|
|
#
?
Dec 11, 2012 01:15
|
|
|
Has your host updated Apache, PHP, or MySQL recently? Are you able to pull a copy of the DB and WP directory to your local system and does it run there (with a hosts file entry)? I would use this to rule out something malicious or specific to Wordpress before diving deep on Apache configs.
|
|
#
?
Dec 11, 2012 01:51
|
|
|
|
| # ? Jun 5, 2024 18:13 |
|
|
porkface posted:Has your host updated Apache, PHP, or MySQL recently? Only thing I upgraded (its my own dedicated server) was our CSF firewall. This is a box running up to date cPanel (I would love to get rid of it now). I'll try running it locally to see what's going on.
|
|
#
?
Dec 11, 2012 05:07
|
|