• Resolved mikeotgaar

    (@mikeotgaar)


    Josh – Your plugin may have been hacked – Version 4.3 to 4.3.1.3 (maybe others)

    When active, a link is being placed in the footer area <p style="position: absolute; top: -987px (and other similar values)">By Castglosvb (and other names) <a href="(to casino and options trading sites" title="casino online (and other)">online casino (and other)</a></p> Link removed

    The name, title and link changes with each page refresh

    The link is placed in the same footer region as the “Powered by WordPress” etc

    I’ve checked this on 2 live sites as well as a fresh install WP3.6 Beta test site and confirm all have this action. Disabling the plugin stops the link embed. I downloaded fresh copies from the repository and confirm both 4.3 to 4.3.1.3 have these bad links

    I’ve posted a list of discovered links and names etc, and a copy of the html page so you can see the original source code from my dev site page (line 143) at http://www.graphicline.co.za/zimage/utmce-bad-links.zip

    I’m going back to ver 3.0 (This version is clean) in the meantime for my live sites.

    http://wordpress.org/extend/plugins/ultimate-tinymce/

Viewing 6 replies - 16 through 21 (of 21 total)
  • ronbme

    (@ronbme)

    I doubt that anyone has put in more time and effort on their plugin than Josh. Most people don’t even know the half of it. Josh has sacrificed a lot more than most people know to develop this plugin.

    I wonder about open-source development myself. That would be a shame to see that end. We need young budding programmers to get their feet wet with open-source development and we need some of us old-timers to help them along.

    A lot of these “free” WordPress plugins are better than the paid software people throw their money away on. Trust me on that one. I’ve wasted more money on bad software than I care to think about.

    Josh has thrown just about everything into this plugin except the kitchen sink. Yeah, he tried something new. Instead of jumping on him with both feet and crying that the world is coming to an end, you could have posted to his private forum, as some did, and he would have explained.

    I would rather encourage good programmers to continue creating good software than trashing them for no benefit.

    Anyway, this is a great plugin and will continue to be.

    Keep up the good work, Josh!

    Ron

    dcell59

    (@dcell59)

    So you’re trashing me over this? Let’s have some perspective. I got this plugin from this site, which has a forum for this, and this was the topic discussing the issue.

    I expected it to improve the editor I use to edit my pages and posts, and then this “experiment” sticks hidden links to an options trading site in the UK and an online gambling site on my pages where the editor doesn’t even reside. I think I had a right to be upset over this. I thought I handled it pretty calmly in the end.

    ronbme

    (@ronbme)

    Well, if I didn’t mention you by name then maybe I wasn’t addressing this to you, right?

    I think you made some valid points. And I think you did handle it pretty calmly in the end.

    I just can’t see some people trashing a very good plugin that is being used by over one million people. That’s like throwing the baby out with the bath water, don’t you think?

    There are too many plugins out there that people just aren’t updating anymore for whatever reason. I think we should be encouraging, rather than discouraging, plugin authors to keep improving their plugins.

    Mike saw a problem with the plugin and asked Josh about it. Josh gave him an answer and also how to disable the feature.

    Giving a plugin author feedback is the way to do it. Bashing them about how one got “ripped off” by “free” software is not. (I’m not saying you did that.)

    It could be worse. You could have paid for the software, had it almost destroy one of your websites and then have the author not respond for over a month (and counting).

    Ron

    Thread Starter mikeotgaar

    (@mikeotgaar)

    @ronbme
    Very valid point about paid for plugins, themes and stuff – Some (a lot) are really poorly supported.
    I’ve recently had a commercial theme dev and a commercial plugin dev both say “it’s a plugin/theme conflict” (WP3.5) – strange when the conflict was with a theme specially designed to use the plugin!
    It was simply an issue with the new java handling method in 3.5.

    On the other side – Josh’s FREE plugin gave very few issues when 3.5 came out (well, none that I found anyway), and looks like it’s already OK for 3.6

    @dcell59
    I don’t think the remarks were meant for you – your reports and replies were polite!

    I’m certainly not going to scrap a darn excellent and useful plugin because of a small undersight.

    ronbme

    (@ronbme)

    Thanks Mike!

    Normally I try to stay ahead of Josh and set up the next version of WP for testing with Ultimate TinyMCE. I’ve been pretty busy lately and haven’t even set up WP 3.6. Glad to hear that UT isn’t having any conflicts. I do want to get WP 3.6 set up and check out some of the new features.

    It gets more complicated these days because you have to set up a WP MultiSite and single install of WP for testing. That’s 2 for the current version of WP and 2 for the upcoming version.

    The reason you didn’t see very many issues with Josh’s plugin and WP 3.5 is because he had already tested it on that platform before it came out.

    I’m amazed that some software companies are still in business with the junk they put out. And they even put up forums but never respond to questions. Makes me wonder what they do all day.

    I never worry about that with Josh. He’s so busy that he needs people telling him to slow down. I’ve had some ideas about new features in UT, but I don’t tell Josh because I’m afraid he might put those on his todo list too. LOL!

    Ron

    Plugin Author Josh

    (@josh401)

    @ronbme, @mikeotgaar : Thank you both! Very, very valid points.

    @dcell59 : No, I don’t believe that remark was aimed toward you either 🙂 You do raise some very valid issues.

    Bottom line : I forgot to make it an option. Simple as that. I wrote the code, tested it, got excited.. and forgot to make it an option.

    I have already cleared it with the mods… and we can re-enable this via am opt-in feature.. which was the original intent.

    This feature is going to allow everyone who uses ultimate tinymce to share their website links between each other. The link, which will only be seen by SEO bots, will be hidden off-screen with CSS. It will not be seen by the website owner, or any of the users. It is simply an “insider” (ultimate tinymce) link sharing feature. The casino was something from my testing. No one else will be allowed to use this… unless they are also using Ultimate Tinymce.

    This is proven to be one of the fastest ways to get websites better indexed by search engines.

    But… I don’t know. Again… do I want to spend all my time developing another awesome feature.. which might get me ridiculed again?? Not sure… lol.

Viewing 6 replies - 16 through 21 (of 21 total)
  • The topic ‘Hacked?’ is closed to new replies.