deltafactory
Forum Replies Created
-
Forum: Hacks
In reply to: wp_cache_add_non_persistent_groups()FYI I understand how object caching works. I’m working on query/object cache optimizations for a site and I’m down to 3 queries per page load. This is causing at least 2 of the hold-outs. 🙂
While it’s technically a “hint”, a caching plugin attempting to follow the intent of the call wouldn’t cache those groups. I suppose my question can be rephrased, “Why does core hint to leave these uncached?”
There’s very little about this either in the code or online docs.
I’m not sure of how expensive these queries are. I’m attempting to find out how close I can get to zero queries without page caching.
Good to know, thanks. Is there a public issue tracker for reporting bugs or contributing fixes?
Forum: Plugins
In reply to: [WordPress MU Domain Mapping] wordpress-mu-domain-mapping – Security issueYou’re welcome! Thanks for checking and sorry for thinking you were spam. 😀
Please mark as resolved if appropriate, thanks!
Forum: Plugins
In reply to: [WordPress MU Domain Mapping] wordpress-mu-domain-mapping – Security issueCan you explain how this might be used in an attack? The result is sending a redirect response to the requester.
If an “attacker” had control over the URL being chosen then they could just as easily have specified the final URL that this method would return.
Simply because user input isn’t run through an escaping function doesn’t make it vulnerable. It’s good that you’re checking for these things but it would be helpful to provide a viable scenario.
Forum: Plugins
In reply to: [WordPress MU Domain Mapping] wordpress-mu-domain-mapping – Security issueThe line numbers don’t match the latest build that I’m using but the
$wpdb->prepare()method in line 155 does the escaping.See here: http://codex.wordpress.org/Class_Reference/wpdb#Protect_Queries_Against_SQL_Injection_Attacks
Forum: Plugins
In reply to: [WordPress MU Domain Mapping] wordpress-mu-domain-mapping – Security issueI can’t tell if this is spam.
To the author: The function you reference is part of a PHP codebase but the pages and functions you reference would seem to be written JSP, or at very least in other code that uses
InitCaps()instead ofunderscore_names()for function names.The value you reference is the URI requested by the user. Can you provide an example of an XSS attack, especially one that would affect a third party?
Good to hear!
Sounds unrelated to SSL, possibly related to ALT tag changes in the latest version and error output.
Could you provide a link to your site?
Forum: Plugins
In reply to: [MinQueue] Compatibility for WPEngine and environments without exec()It looks like those files aren’t used by your plugin at all. Default minifiers are specified here:
https://github.com/mattheu/MinQueue/blob/458b4173d5871dd298bf48420a295c4e4f799ad3/PHP-Minify-Lib/Minify/Controller/Base.php#L74Without another way to specify options, the defaults can’t really change. You could either remove those unrelated files or provide a filter to send options like so here:
https://github.com/mattheu/MinQueue/blob/458b4173d5871dd298bf48420a295c4e4f799ad3/class.minqueue.php#L433$data = Minify::combine( $srcs, apply_filters( 'minqueue_minify_options', array() ) );Forum: Plugins
In reply to: [MinQueue] Advanced config fileI see the function but not the filter.
https://plugins.trac.wordpress.org/browser/minqueue/trunk/plugin.php#L70
Forum: Plugins
In reply to: [MinQueue] Advanced config file@matthew Haines-Young,
Since you’re updating the docs.. You mention the filter minqueue_options, or is there a custom filter I’m missing (which is very likely).
Do you mean to filter the call to
get_option()via filteroption_minqueue_options?Forum: Plugins
In reply to: [MinQueue] Advanced config fileYou’re right. Thanks for clarifying, all.
Forum: Plugins
In reply to: [MinQueue] Compatibility for WPEngine and environments without exec()It appears that the Java compiler isn’t always used. Would it be possible to configure options to ensure that the it’s never run?
Forum: Plugins
In reply to: [MinQueue] Advanced config fileAccording to the code I think it’s “disabled” and <anything else>. 🙂
@djdan, I believe certain characters, especially Unicode values are mangled during the process. The encoding protects the integrity of those values.
In general, I agree: I think there are better mechanisms to store this data within the WordPress API.
I don’t know if newer versions of NextGen have fixed this orphaned setting, which may be why your attempt worked.