deltafactory
Forum Replies Created
-
Forum: Plugins
In reply to: [Login with Amazon] Improper use of sessions@robertark, some of the adjustments discussed are implemented here.
https://github.com/deltafactory/login-with-amazon-wordpress
I’m also starting to think through the changes and process to link an existing user to an Amazon account regardless of email address on file.
Forum: Plugins
In reply to: [Login with Amazon] Improper use of sessionsJust to clarify something that’s poorly documented within WordPress, the WP Sessions that were introduced relatively recently only track different login instances of the same user across browsers. I believe the session ID *does* factor into the generation of a nonce so that the same user’s nonce across browsers will be different.
What it doesn’t do is provide a replacement for PHP Sessions in the form of persistent key/value storage. Many in the community have been pushing for such a mechanism, as implemented here (https://wordpress.org/plugins/wp-session-manager/), a related implementation that’s bundled with WooCommerce, and probably others as well.
I’ll be implementing the session-less, wp_nonce-based approach since it solves this exact problem. I’m open to further discussion of security concerns.
Forum: Plugins
In reply to: [Login with Amazon] Improper use of sessionsIf implemented as a replacement for the CSRF authenticator, the nonce isn’t used to authenticate or authorize. It’s used as a secret component to prevent cross-site forgery. Said another way, knowing the nonce value doesn’t grant access to a resource on its own.
In any case, it does exactly what you want: generate a “short-lived” repeatable random value, without additional persistence requirements.
FWIW, hosting providers frown upon Sessions and I thought I recalled WPEngine disabling them entirely. I imagine setting the value to a cookie would reduce security.
Forum: Plugins
In reply to: [Login with Amazon] Improper use of sessions@login-with-amazon, I believe WP nonces will effectively replace the CSRF authenticator without use of sessions.
https://codex.wordpress.org/WordPress_NoncesEven if it’s imperfect for your purposes, the routines for generating the nonce should give you a starting point for a deterministic, unique, repeatable value instead of a stored random value.
I will be working on some LWA-based enhancements and may use this plugin as a starting point. If the developers are willing to accept patches, I’ll be happy to follow up.
Fatal errors like this and the timeout issue reported here (https://wordpress.org/support/topic/better-handling-of-large-user-basees/) prevent the plugin from activating.
Therefore, I cannot use the support icon on the plugin pages.
In the meantime it looks like this is the best option, correct?
http://www.mailpoet.com/support/sales-pre-sales-questions/@wysija, not sure if you saw this.
Also, is there a better venue through which to submit bug reports instead of general tech support?
From the stack trace it looks like you’re running it under a Multisite. In the FAQ they mention that running under Multisite “works but isn’t supported.”
You may have found one of the untested and unsupported aspects of the plugin.
To @wysija, perhaps you can detect when running under Multisite and add an admin notice/disclaimed until you’re ready.
To @selindmarkl, more detail on how to recreate the error may help their developers.
In the interim, do you have any suggestions on how to work around this?
Separately, is this forum the best place to report bugs to developers?
Forum: Plugins
In reply to: [Memcached Object Cache] Cannot redeclare wp_cache_add()Please follow the installation instructions.
https://wordpress.org/plugins/memcached/#installationThough it’s listed in the directory and recognized as a plugin (because it has the Plugin headers), it is really a “drop-in”.
Drop-Ins are explained here:
https://hakre.wordpress.com/2010/05/01/must-use-and-drop-ins-plugins/After trying to track down some odd graphing behavior, I’m finding that date calculation with respect to timezones is an issue.
To your issue, make sure that your WP site has the correct timezone under Settings -> General. While I believe that hits are tracked correctly relative to the site’s configured timezone, the reporting queries do not select the correct data.
This could be addressed by the author if recognized as the problem that it is.
Forum: Plugins
In reply to: [HyperDB] mysqli and PHP7 support? – mysql_connect() being deprecatedWe had deployed it with no issues, though we needed to update the heartbeat routines to use the new methods instead of old functions (about 3 lines…)
Forum: Plugins
In reply to: [Contact Form 7] Submit button missing!It does for me. After removing/commenting out the line, make sure your cached CSS is refreshed.
Forum: Plugins
In reply to: [Contact Form 7] contact form 7 listo country – Required fieldTo make it a required field, add an asterisk next to the field shortcode:
[select* your-country data:countries.olympic]I’m not sure if you can specify a label for the “include_blank” option, besides the default “—” but that would be a nice feature.
Forum: Plugins
In reply to: [Contact Form 7] Contact Form 7 don’t allow me to upload a file above 2mbThis may be a limit set in your server’s PHP configuration. If you go to the Media section in admin, can you upload files larger that 2M? If not, then look at your web host’s knowledgebase for raising upload limits.
I’ll do what I can. Post here and all of us in the community will do what it can to help!