AK Ted
Forum Replies Created
-
Forum: Fixing WordPress
In reply to: Bug on Password Protected PostsThis issue has been patched, see the WordPress Trac Ticket.
Forum: Fixing WordPress
In reply to: Post & Page with the same slugIn my tests it does not put the -2. If, like I said in the OP, you test post-to-post or page-to-page, it does add the -2. But if you have a post with slug “whatever”, and you later add a page “whatever”, WordPress lets you. Same slug for page & post. The post is now inaccessible.
Forum: Fixing WordPress
In reply to: WordPress giving too much info to end users on DB errorTo any concerned: I was informed on TRAC that the full error message only displays on a WP site that has WP_DEBUG set to true (rare). Case closed, as far as I’m concerned.
Off-topic: my next windmill to tilt at is re: these text inputs/textareas with spell-check. If someone can write JavaScript that can highlight code syntax, surely the browser makers can make the spell-check ignore hrefs and other attributes in tags!
Forum: Fixing WordPress
In reply to: Post & Page with the same slugWhat I’m saying is WP does *not* check for collisions between post and page. This was tested on a clean 3.5 install.
Forum: Fixing WordPress
In reply to: WordPress giving too much info to end users on DB error@songdogtech: Economy shared hosting. And yeah, while the format of GoDaddy is well-known, the
my_database_nameandxxxxxxxxstill should be kept private.Someone with a grudge could try to DDOS a known DB host address. As I said earlier, I don’t know what the ramifications of that are.
Forum: Fixing WordPress
In reply to: WordPress giving too much info to end users on DB errorThank you, esmi. The upper message is because I have WP_DEBUG set to true. This is actually my live testing/staging site, so I need the PHP errors shown. But since my “real” live domain and my testbed are using the same shared account, I assume the error page (minus the upper message) would be shown to end-users of the live site as well during any future DB server outages.
I will bring it up with GoDaddy, but I think I’ll also look into hacking my
wp-includes/wp-db.php(told to me by someone on TRAC that the error message is generated from). I really am unnerved by the fact that what I consider sensitive information is being presented to all comers.Forum: Fixing WordPress
In reply to: WordPress giving too much info to end users on DB error@esmi: Thanks for the heads up. GoDaddy will allow me to do things in php.ini like turn off display_errors. Would that stop the WP default error page from appearing to users browsing my site?
Forum: Fixing WordPress
In reply to: WordPress giving too much info to end users on DB error@riversatile: Again, this post is not about a DB problem that I’m having. Please re-read the original post. It was a temporary glitch of my host. It is no longer occurring. Nothing had changed on my site so I must assume that my DB hosting server was down.
My problem is the default WordPress behavior of passing out my personal information to the world.
I’m not trying to sound rude, but please stop posting off-topic discussion to this thread. If you think I’m mistaken in my assertions, by all means feel free to say so – with reasoning to backup your opinion. But your off-topic replies (and my responses) have changed the status of this post from
unansweredtoanswered, which means it will be seen by significantly less people.Forum: Fixing WordPress
In reply to: WordPress giving too much info to end users on DB errorThanks for the help, riversatile. I’m not trying to diagnose a DB problem. I’m pointing out what I consider to be a serious breach of my site’s security because of a default WordPress error message.
As mentioned in my original post, no one, other than those I choose, should be able to see the underlying file structure of my site and its full DB host address.
As an example, with GoDaddy, the shared hosting path for my public root is
/home/content/zz/xxxxxxxx/html/. This was shown twice on the error page.xxxxxxxxis a unique number tied to my hosting account.zzis a number that (I assume) represents a grouping of different accounts. No one on the Internet should be able to see anything abovehtml.In addition, a typical GoDaddy DB host address is
my_database_name.db.xxxxxxxx.hostedresource.com. A malicious person, maybe someone who simply dislikes something I wrote on my site, might be able to DDOS my database by simply trying to connect to it with the wrong credentials. I’m not sure what GoDaddy or any other host would do if someone made millions of attempts to connect in a short amount of time. They might be able to ignore it, or they might flag my account – I have no idea.Think of your database host like your credit card number. While it’s not critical for you to keep it secret from everyone, you only want those you trust, e.g., business you write a check to. You don’t hand it out to strangers on your business card.
Forum: Fixing WordPress
In reply to: WordPress giving too much info to end users on DB errorWould my PHP error level affect the error page that is clearly generated by WordPress?
Forum: Hacks
In reply to: Minimizing Plugin ImpactFound a better way
<?php // Plugin Name:... if ( ! is_admin() ) return; // rest of code goes here ?>Forum: Hacks
In reply to: Minimizing Plugin Impact@t-p: I’m not sure how that’s an answer to my question. Searching that page, I don’t find any occurrences of these words: best, practice, limit, or scope. Minimize is listed, but only in re: to db’s. I didn’t see anything there about what I asked.
It’s almost as if I asked “What internal temp should I cook a turkey to?” and was given a cookbook, hoping that the answer might be in there.
Forum: Plugins
In reply to: Browse Plugins By NameGood catch! Makes sense, and probably not enough demand for it. Oh, well.
Forum: Plugins
In reply to: Browse Plugins By NameBrowse in alphabetical order. They can be sorted by popularity, rating, most recently added, etc., but apparently not by name.
Forum: Plugins
In reply to: Adding CSS/JS Links to Admin HeadNevermind. I found the “correct” way to add styles to the head is to register them, then enqueue when needed:
wp_register_styleandwp_enqueue_styleHere’s some sample code that creates the menu and injects the stylesheet to the <head> only when needed:
add_action( 'admin_init', 'akt_fd_init' ); function akt_fd_init() { wp_register_style( 'akt_fd_style', plugins_url('/css/style.css', __FILE__) ); } add_action('admin_menu', 'akt_fd_create_menu'); function akt_fd_create_menu () { $akt_fd_menu = add_menu_page( 'My Options Page', 'My Option', 'administrator', 'akt_fd_menu', 'akt_fd_options'); add_action( 'admin_print_styles-' . $akt_fd_menu, 'akt_fd_add_styles' ); } function akt_fd_add_styles() { wp_enqueue_style( 'akt_fd_style' ); } function akt_fd_options () { echo '<div class="akt_bacon">bacon</div>'; }