Forum Replies Created

Viewing 12 replies - 1 through 12 (of 12 total)
  • Thread Starter pressward

    (@pressward)

    Thanks, Ryan, the vulnerabilities website helps a lot.

    back to wp_usermeta session_tokens; I have test-installed and am exploring WP 4.1. In the session_tokens meta_value I am seing a long hex string (as the top key). Is it related to the wordpress_logged_in_****** stuff in the cookie? Same thing but encrypted maybe?

    thanks

    Thread Starter pressward

    (@pressward)

    Considering that the WordPress version you are using is not safe

    Thanks. I will now seek to upgrade. I’ve done a few minor hacks in the installation a while ago, and will have to review and back up that stuff, so I can replicate it later, or just as a diary of my activities :-)), before I upgrade.

    Speaking of “safe”, I am surprised there is no WP forum dedicated to security… (correct me if i’m wrong) So, I guess, the next logical thing is to turn to the “hacks” forum, where people would surely know about being “hacked” (maliciously) :-)), even if the forum is mostly for intentional, constructive hacks …

    Anyhow, I started researching the vulnerabilities of the older versions and saw stuff about SQL injections, and the “security-by-obscurity” defense of renaming all the SQL tables (to something obscure)… But I already did that… How else can 3.4 be unsafe?

    Any useful links to pertinent security issues would be appreciated, of course.

    Thread Starter pressward

    (@pressward)

    Thanks. I forgot to state the version i am dealing with — it’s quite old at this point: 3.4.2

    If you check the wp_usermeta table, you should see an entry called session_tokens, which contains a user’s active session information.

    I don’t see the session_tokens meta_key entry in wp_usermeta. Has this been added in newer versions than mine? (I did make sure some user is logged in at the time I checked, and I checked across all “user_id” rows)

    Forum: Hacks
    In reply to: weird CSS
    Thread Starter pressward

    (@pressward)

    Hmm… Looks like I had messy, asymmetrical/inconsistently-nested <label>, <span>, <input> and <textarea> tags, and this apparently made the cursor jump out of the textarea box.

    I still don’t know how exactly (whether it was the combination of bad html and some other code up the chain of scripts/styles), but cleaning up the html seems to have fixed it.

    thanks.

    Forum: Hacks
    In reply to: weird CSS
    Thread Starter pressward

    (@pressward)

    slight correction of my previous post.

    I should have said “the REFERENCE” in:

    “, the REFERENCE TO THE element you’re inspecting is highlighted in bold.”

    Forum: Hacks
    In reply to: weird CSS
    Thread Starter pressward

    (@pressward)

    @odai: You rock!

    I’ve been to that section of Chrome before, but, until you pointed it out, I’ve had to spend many minutes drilling down the tree, expanding the outline, just to get to one element I wanted to inspect. Always wondering if there’s a quicker way. Plus I never fully realized how thorough and useful the information in the right panel really was!

    It’s awesomely comprehensive — and, yes, it has an “Event Listeners” section (in addition to “Styles”, “Metrics”, “Properties”), and each section is super-thorough/verbose, exhibiting the contextual chunks of code and references to code files affecting the element. It spells out EVERYTHING, including directives which are overridden by other directives (those are crossed out), and in multi-element css, the element you’re inspecting is highlighted in bold.

    I have not yet thoroughly read through all of my textarea’s info to solve my problem — there is a lot of it — but I hurry to post this confirmation here. Probably would be a useful bit of info on the Plugin development forum here, also.

    To be sure this is on-topic: This Chrome feature is definitely a useful utility for hacking and extending CMS’s like WordPress.

    (Have not tried firebug for this yet)

    Thread Starter pressward

    (@pressward)

    Hah! Was about to close this thread as “solved” and then it occurred to me: Well, at least THIS much can be argued (right?):

    a unique index across ALL THREE columns (user_id, meta_key, meta_value)…

    (a) … would be/should be safe and proper

    (b) … might POSSIBLY be useful (at some point)… though I can’t readily say how ;-))

    Thread Starter pressward

    (@pressward)

    My hunch was right; I WAS overlooking something trivial. I had not seen the template-switching controls in the drop-down box inside the “quick-edit” for individual posts. Switching from default to sidebar template gave me what I want, for the inclusion of the sidebar.

    I would still like to know how to get page category inside the php code (say, inside “sidebar.php”).

    Actually, I think I know the code:

    $categories = get_the_category();
    $cat_id = $categories[0]->cat_ID;

    But, a number of posts confirm that the id value will only be returned when the above code is “inside the loop”

    So… being that I am a newbie, if anyone could explain which loop that refers to, I would be grateful.

    I’ll mark this thread as “solved”, regardless, shortly. (The category id issue might need a separate thread)

    Thread Starter pressward

    (@pressward)

    Thanks. I’ll try your suggestions.

    Meanwhile, I seem to have achieved something adequate, with quick & dirty methods:

    I added tag-specific styling to the primary div in “page.php” :

    <div id=”primary” style=”float:left;width:700px;background:#9c9;”>

    But what’s the WP-PHP to get the current request’s category? I could then insert the sidebar based on category.

    Thread Starter pressward

    (@pressward)

    I’m using twentyeleven for 3.4.2. I’m so new, I really don’t know how to use templates. I don’t see a GUI way to do it, so I’m assuming it’s a PHP hack?

    This is mind-numbing. I practically spent a whole day trying to do something that should be a checkbox away: [x] Show sidebar on every page

    or something more elaborate like the widget controller plugin (lots of conditions, and they are widget-specific!)

    My website is still an embarrassing mess. I’ll “publish” it when it reaches minimal coherence

    Thread Starter pressward

    (@pressward)

    good point. Didn’t know about multiple-value situations. I’ll drop my unique index.

    Speaking of database modifications, I added a timestamp column to wp_options and other tables, in order to track changes and study the internals (I’m new to WP). Hope THAT doesn’t blow anything up.

    Thread Starter pressward

    (@pressward)

    bump

Viewing 12 replies - 1 through 12 (of 12 total)