edtiley's Replies - page 4

Forum Replies Created

Viewing 15 replies - 46 through 60 (of 62 total)

← 1 2 3 4 5 →

Forum: Hacks
In reply to: Same Nonce Value Over And Over Again?

Thread Starter edtiley
(@edtiley)

13 years, 2 months ago

bc,

It’s form submissions where I find it particularly lacking.

Oh, well. Sigh.

Thanks,

Ed

Forum: Hacks
In reply to: Same Nonce Value Over And Over Again?

Thread Starter edtiley
(@edtiley)

13 years, 2 months ago

Ben,

That article was written about version 2 of WP. I assume it works the same although the functions that create and verify are “new & improved” since then.

He does point out that it is tied to the individual user and the cookie WP hands you on arrival. I can attest to that since I’ll get a different nonce if I’m logged in vs. not.

I can see there is some protection afforded in that the nonce will not work for someone on a different client, etc. So if a hacker wants to delete a post, for example, they may succeed, but only once.

On a recurrable operation like a “like” or asign a rating, it really doesn’t do much to disallow multiple instances.

Thanks

Ed

Forum: Hacks
In reply to: Same Nonce Value Over And Over Again?

Thread Starter edtiley
(@edtiley)

13 years, 2 months ago

Ben,

My understanding of a nonce is that it expires after a specified Time To Live if unused, and manually expired immediately when it is used.

So then any real benefit from a WordPress nonce (as preached for Ajax “security”) is cosmetic. It only confirms that a pre-request (create) was made, not that the foreshadowed event (verify) has actually taken place more than once.

All that really does is make the developer feel good about following “best practices” I guess.

Again, if I’m missing something here, please enlighten me.

Thanks,

Ed

Forum: Hacks
In reply to: Same Nonce Value Over And Over Again?

Thread Starter edtiley
(@edtiley)

13 years, 2 months ago

A little more depth.

I’m creating a nonce and putting its value into a hidden input in a form. When the submit button is clicked, the action of the form (a function in a class) recieves and verifies the nonce before doing anything.

If I reload the page (even if I’ve closed the browser (FF or IE)between loads) I’m getting the same nonce value over and over.

If I clear browser history, I’ll get a different nonce in the hidden field, but again I’ll get it over and over.

The ajaxurl gets the nonce in $_POST and verifies it. It never gets rejected even after it’s been used over and over.

What am I missing here? I don’t see the “security” in a nonce that let’s itself be used over and over.

Forum: Hacks
In reply to: Bulk insert of data into a custom table

Thread Starter edtiley
(@edtiley)

13 years, 4 months ago

Your help is appreciated. Thanks, again.

Forum: Hacks
In reply to: Bulk insert of data into a custom table

Thread Starter edtiley
(@edtiley)

13 years, 4 months ago

Many thanks! I didn’t think of editing a filename.sql file.

For whatever reason (probably protection against timeouts) the .sql file batches the records to be INSERTed in groups of just under 1,000. I edited it into one big INSERT SQL command.

The resulting character string was about two megs, so I put it in a separate php file as a function to return the string ( to keep the plugin.php file lean and trim) and used include() to bring in the data during the activation process.

One little call $wpdb->query($sql); pulls it all in.

Creates the table and fills it. GREAT STUFF!

Thanks again,

Ed

Forum: Hacks
In reply to: Bulk insert of data into a custom table

Thread Starter edtiley
(@edtiley)

13 years, 4 months ago

My apologies! I misread Option 2 (long day).

Let me play with that

Thanks, I’ll let you know how it works out.

Ed

Forum: Hacks
In reply to: Bulk insert of data into a custom table

Thread Starter edtiley
(@edtiley)

13 years, 4 months ago

>> prevent errors and/or duplicate records

Well you need an uninstall function as part of the plugin’s class for that.

Concering the options you outlined:

1> is unworkable because it creates a cost center (think free plugin = unsustainable nightmare)

2> Ya can’t dump phpMyAdmin on noobs who may not have Cpanel access

3> would be much preferred. The data is in Access, Excell, CSV or any other format if need be. How would you create an array of all those records in order to pass them through a for each loop? Each record is five fields of character data. 50 bytes of data each record, max.

Forum: Hacks
In reply to: OOP Plugin – Exposing Class Functions

Thread Starter edtiley
(@edtiley)

13 years, 5 months ago

Sorry for the lag in replying, it has been quite the week.

It was in fact that the function was returning a value that was not getting printed properly.

When echo was substituted for return in the function, it worked as expected.

Thanks for helping me clarify all that.

Forum: Hacks
In reply to: OOP Plugin – Exposing Class Functions

Thread Starter edtiley
(@edtiley)

13 years, 5 months ago

Again, perhaps it is that the function was returning a string, rather than using echo.

I’ll smash this out on the morrow.

Thanks

Ed

Forum: Hacks
In reply to: OOP Plugin – Exposing Class Functions
Thread Starter edtiley
(@edtiley)

13 years, 5 months ago
OK, guests are gone <grin>

Even if I take your last example, and make the call loop_end, the function is not firing. In my template file I have:
```
$result = '#'.do_action('loop_end') ;
 echo $result.'&<br>'  ;
```
Perhaps it is because the function returns a value instead of echoing it, and do_action somehow returns something different than the return value of the function.

STILL!!! That’s not the point.

If plugin.php contains the following:
```
<?php
	function hereman1() {
	    	echo 'Yup, I am Here' ;
	}

      add_action( 'loop_end', 'hereman1') ;
?>
```
Then right after the comments there appears a line that says, ‘Yup, I am Here’ because the function fires when WP ends the loop.

So how do I get a plugin written in oop to do the same.

THAT’S the question!

Thanks again for putting up with me.

Ed
Forum: Hacks
In reply to: OOP Plugin – Exposing Class Functions

Thread Starter edtiley
(@edtiley)

13 years, 5 months ago

I don’t think end_loop is a good tag since, like init, is is an action hook name that WP fires when the loop is finished.

I need to play with this a bit.

What I’m trying to do is create a plugin that fires automatically, without needing a spcific action call whenever the loop finishes on a page.

I’ve seen other plugins do it without having to modify theme files, so I know it can be done, but I can’t seem to even get a simple public function to fire.

Sigh!!! Thanks for your help, I’ll get back to you.

Forum: Hacks
In reply to: OOP Plugin – Exposing Class Functions
Thread Starter edtiley
(@edtiley)

13 years, 5 months ago
OK you have me thouroughly confused now. The end_loop hook is no longer in play. I replaced it with init several messages back.

Let’s fresh out a second.

My plugin.php reads as follows:
```
<?php

class PHZplug {

   function __construct() {

      add_action( 'init', array( $this, 'hereman1' ) );
	} 

	public function hereman1() {
	    	return 'Yup, I am Here' ;
	}
}
$newplug = new PHZplug() ;
?>
```
In the constructor is the add_action, and the public function hereman1 returns a string.

In the template file I have:
```
$result = do_action('hereman1') ;
 echo $result.'aaaaa<br>'  ;
```
Now I don’t get the unidentified function error, but I’m not getting the return value of the function either.
Forum: Hacks
In reply to: OOP Plugin – Exposing Class Functions

Thread Starter edtiley
(@edtiley)

13 years, 5 months ago

I think that light just came on.

So,how the do you get a plugin to “just do a job” so that templates don’t have to be edited?

Say, for example, I want my plugin to run every time at the end of a post or page?

Forum: Hacks
In reply to: OOP Plugin – Exposing Class Functions

Thread Starter edtiley
(@edtiley)

13 years, 5 months ago

The template file doesn’t call do action.

Viewing 15 replies - 46 through 60 (of 62 total)

← 1 2 3 4 5 →