professor99
Forum Replies Created
-
NOTE: The following technical info is for those who experience similar problems.
Somehow Access Control is triggering to Frontend function wpuf_get_pages() to run before all the plugins have been loaded.
wpuf_get_pages calls get_pages which is hooked by Access Control and calls is_user_logged_in() which is in wp-includes/pluggable.php which doesn’t get loaded till after the plugins have been loaded as shown from wp-settings.php (called at WordPress init)
wp-settings.php ================ // Load active plugins. foreach ( wp_get_active_and_valid_plugins() as $plugin ) include_once( $plugin ); unset( $plugin ); // Load pluggable functions. require( ABSPATH . WPINC . '/pluggable.php' ); require( ABSPATH . WPINC . '/pluggable-deprecated.php' );The idea here is that plugins can substitute their own versions of the functions in pluggable.php.
Also tried disabling the the calling of load_textload in the Frontend file wpuf.php. Made no difference to the bug so this definitely isnt the cause.
Actually the load_textdomain warning you posting is generating by the CodeStyling plugin. The problem with is_logged_in() still occurs with this disabled.
Ahhh…I think the textdomin functions might be the cause.
Access Control hooks the ‘get_pages’ WordPress function and substitutes it’s own get_pages function which calls is_user_logged_in() and crashes because somehow the WordPress has managed to lose track of it’s included file wp-includes/pluggable.php which contains is_user_logged_in().
get_pages() is used by Frontend. Both Frontend and Access Control set the text domain.
Strange it works for me but not you.
Now investigating further.
Hi Kyle,
Frontend Version 1.1 as you are using either displays all attachments that are images or lists them otherwise.
You have two options here.
1. The development version only lists attachments added by the attachment field. However I’m considering adding an ‘Display images’ option due to the comments here(Rkarels comment).
2. You can modify the code in wpuf-functions.php to do what you want.
Simply change the code for wpuf_show_meta_front( $content ) to this
function wpuf_show_meta_front( $content ) { global $wpdb, $post; //check, if custom field is enabled $enabled = wpuf_get_option( 'enable_custom_field' ); $show_custom = wpuf_get_option( 'cf_show_front' ); $show_attachment = wpuf_get_option( 'att_show_front' ); if ( $enabled == 'on' && $show_custom == 'on' ) { $extra = ''; $fields = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}wpuf_customfields ORDER BY <code>region</code> DESC", OBJECT ); if ( $wpdb->num_rows > 0 ) { $extra .= '<ul class="wpuf_customs">'; foreach ($fields as $field) { $meta = get_post_meta( $post->ID, $field->field, true ); if ( $meta ) { $extra .= sprintf( '<li><label>%s</label> : %s</li>', $field->label, make_clickable( $meta ) ); } } $extra .= '<ul>'; $content .= $extra; } } if ( $show_attachment == 'on' ) { $attach = ''; $attachments = wpfu_get_attachments( $post->ID ); if ( $attachments ) { $attach = '<ul class="wpuf-attachments">'; foreach ($attachments as $file) { //if the attachment is image, show the image. else show the link // if ( wpuf_is_file_image( $file['url'], $file['mime'] ) ) { // $thumb = wp_get_attachment_image_src( $file['id'] ); // $attach .= sprintf( '<li><a href="%s"><img src="%s" alt="%s" /></a></li>', $file['url'], $thumb[0], esc_attr( $file['title'] ) ); // } else { $attach .= sprintf( '<li><a href="%s" title="%s">%s</a></li>', $file['url'], esc_attr( $file['title'] ), $file['title'] ); // } } $attach .= '</ul>'; } if ( $attach ) { $content .= $attach; } } return $content; }You can’t disable the user from typing in HTML but you can strip it and javascript out after they have submitted it.
For the Frontend Version 1.1 use the filters wpuf_add_post_args and wpuf_edit_post_args and code to suit what you want left in or taken out.
See wpuf-edit-post.php and wpuf-add-post.php for details of these filters.Of other note you have to restrict users to only the ‘Basic’ text editor as the ‘Rich Text’ editors use HTML.
Mind you WordPress does sanitize out most HTML/Javascript nasties using WordPress functions such as sanitize_post() so your concerns are already mostly addressed.
Is it works for you that is fine but be wary of problems you haven’t encountered yet, updates to come, and other plugins that may throw spanners into your works. admin_url() and related functions are used everywhere.
Given this I think you have three options.
1. Stay with your present scheme and workarounds but be aware of problems to come.
2. Make everything https by either of the two options given in the link I gave you in the last post. This is the easist, most problem free, secure, and future proof method
3. Use a partial implementation of the rewrite scheme given in the previous link for the parts you want secure.
The ‘cheating’ message comes from wpuf-add-post.php:submit_post() and is the result of it not recognising the nonce _wpnonce sent as part of the post. Since nonce’s are connected to both the user_id and the login session maybe a http session and a https are deemed to be different.
The initial page get is http.However the last POSTs to admin.ajax.php are using https and I suspect this and added with the XFrame problem may be causing your problem.
Why is your server generating a mix of http and https calls? Any idea?
Ahhh. I check of the initial page load reveals this.
var wpuf = {"ajaxurl":"https:\/\/www.culture.info\/wp-admin\/admin-ajax.php","submit_msg":"Submit PostThat would do it. Where does this come from? Well it comes from enqueue_scripts() in wpuf.php.
function enqueue_scripts() { ... wp_localize_script( 'wpuf', 'wpuf', array( 'ajaxurl' => admin_url( 'admin-ajax.php' ), 'submit_msg' => $submit_msg, 'update_msg' => $update_msg, 'postingMsg' => $posting_msg, 'deleteMsg' => $delete_msg, 'confirmMsg' => __( 'Are you sure?', 'wpuf' ), 'delete_confirm_msg' => __('Are you sure to delete this post?', 'wpuf' ), 'nonce' => wp_create_nonce( 'wpuf_nonce' ), ) ); .... }So the WordPress function admin_url() is the den of our culprit. And who lives behind these doors….Your Site Address as provided by the option ‘Site Address (URL)’ in the WordPress General Settings page.
This wont work properly especially with the media library. However Ve haf vays of making you tock https
Hi Rkarel,
I definitely see your point. If the internet consisting of only web programmers it would be virtually a much simpler world. Users! God love them!
As to the Media Library even though the new WordPress library is much improved in a lot of regards it’s still a minefield for users and of course they have access to all other images there which is both a curse and a bonus.
So your submission for a media type gallery here is probably apt. We did in the old version just display images down the line on the submission page but it looked horrible particulary when images were huge. However I gather the need is for an image gallery on both the submission page and the resultant post. This probably is a bit of work and I have no idea of any WordPress functionality that would help.
Does anybody have any ideas on how such a thing should look and work (Maybe another plugin that does this well). Note we have to allow for non image files as well.
Hi wp student
Not a bug (no prize :(). This adds the url of the page (HTTP_REFERRER) that linked to your frontend add/edit page (if defined) as a query option which is useful if you want to display a thank you message before auto-redirecting to this page.
I’m yet to look at the log but it seems I misunderstood your previous message.
Hi Jonga,
You mention below of having to use SSL to solve the problem is not normal behaviour as Frontend generally works fine for http. This sounds like a server problem too. Could your please send me the logs with the ‘Cheating?’ message in it as well.
Then, to resolve the error where I was receiving a ‘Cheating?’ message when submitting (which was the next error after the fix above), I realised that my configuration was throwing an error due to me not using SSL on the submission page. I changed this so that the WPUF Add post and edit post pages now use SSL and this resolved the error.
Could you please tell us which theme you are using as this may help other users who may experience this problem.
This more than likely is related to your theme or WordPress settings if it happens when all other plugins are deactivated.
Could you test to see if it happens with the WordPress 2011 and 2012 themes.
If it happens for all themes it could be related to WordPress settings for rewriting links. get_page_permastruct() is a member of class WP_Rewrite and for some unknown reason that hasn’t been defined before this function is called.
link-template.php is a standard WordPress file and it is generally a bad idea to edit this as it may be overwritten on the next upgrade so be wary.
Not sure what your really talking about when you state the following.
However (perhaps related to that) on the page I have [wpuf_edit] that ends up editing its own page page!
If it’s related to the standard WordPress edit link on the bottom of each page the development version fixes this. See the code for wpuf_suppress_edit_post_link() in wpuf_functions.php if you dont want to use the development version.
Thanks jonga. Could you post details of your fixes here in order to help other users who might experience the same problem.
Thanks ninofrenn,
That could be a good option to have for subscribers.