Are Your Plugins Secure? Part 2: Permissions and Nonces

http://wprealm.com/blog/are-your-plugins-secure-part-2/

Following on from “Are your plugins secure?, this post is a simple breakdown on what to look for security-wise when auditing plugins. In the previous post I covered basic data santisation, however that sort of protection means diddly squat if a plugin allows a random member of the public is able to do do something only meant for you!

For WordPress plugins to allow user submitted inputs, it either needs to allow anyone to submit data, or it needs to perform some sort of authentication to prove that the user submitting the data is indeed who they say they are. Continue reading <span class="meta-nav">→</span>

Are your plugins secure?

http://wprealm.com/blog/are-your-plugins-secure/

WordPress has an irritatingly bad reputation for security. This is mostly due to misinformation and partly due to WordPress taking the rap for flawed security either at server level, or at the theme/plugin level. Server security issues can be reduced by using a well respected webhost such as HostGator or WP Engine. Theme and plugin security can be much harder if you are unable to security audit the code you are using. A quick search through the WordPress plugin repository by a trained eye can show up a scary proportion of plugins with security flaws. Unfortunately, unless you understand how security attacks occur and what type of code causes security flaws there is no way to know if a plugin is usable or not. Continue reading <span class="meta-nav">→</span>

TalkPress: Is bbPress Finally Coming to WordPress.com?

http://wprealm.com/blog/talkpress-is-back/

Those of you who have been in the community for a long time will remember the TalkPress project. It was intended as a hosted platform for running bbPress forums, essentially a bbPress version of WordPress.com. It was first mentioned by Matt Mullenweg back in January 2008. Nothing much was heard of it until it was mentioned again in April 2009.

There was an initial joke website setup for the project at TalkPress.com which was powered by phpBB and included humorous posts from prominent members of the WordPress and bbPress community joking about how it was a huge upgrade for them. Later on the site was updated properly to explain it’s real purpose of providing a killer hosted service for a fee to those looking for a scalable forum solution. It was later announced in May 2009 that Health.com would be changing to use the TalkPress platform to power it’s forums. Little was heard about it from then on and it seems that Health.com no longer uses TalkPress.

Fast forward a few years Continue reading <span class="meta-nav">→</span>

Your Chance To Work With WordPress In Oslo, Norway

Ryan Hellyer who has been a long time member of the WPTavern community has given me a heads up that Metronet is currently looking for a WordPress Code Poet. Sounds like any other typical WordPress job posting right? Well, that is until you read the following lines within the job posting: “The opportunity to live and work in Norway, the best country in the world according to many surveys. Assistance with relocation and accommodation.“. So if you’re a WordPress Code Poet looking for an opportunity to work in Oslo, Norway this may be the best chance you’ll get! I’ve also learned that Ronald Huereca who wrote the book, WordPress And Ajax and who is the author of the Ajax Edit Comments plugin is a part of this development company.

If you’re interested in the job opening, you should highly consider the fact that they are only looking for people who are willing to relocate to Oslo, Norway at this point.

SitePoint bbPress Theme Community Project

ryan hellyerThis is a guest blog post written by Ryan Hellyer, who operates PixoPoint.com. While you’re there, check out his WordPress Menu Plugin

I’m involved with the development of a new bbPress theme. This in itself would not normally be particularly interesting, people develop new themes for forums all the time. However this is a theme with a difference!

My first forway into theming for bbPress was during an episode of WordPress Weekly when Jeff Chandler said that bbPress was not up to scratch for use as the WP Tavern forum software. He cited the shear number of plugins that needed to be installed to achieve very basic functionality as reason for not using it. As a proof of concept, I installed plugins which were capable of achieving almost all of the functionality Jeff asked for during the hour long show. However, even though these plugins were capable of adding the functionality required and were very easy to implement, they often didn’t do it in a fashion suitable for all themes. For users to style their forum the way they wanted it to, they would need to have modified those core plugins and in turn prevent them from being upgradeable.

Later on I messed around with building a template generator for bbPress. I didn’t have time to build a custom theme from scratch, so I simply modified the default Kakumei theme which came with bbPress. Unfortunately the Kakumei theme uses some odd-ball coding techniques which did not gel well with my own code. I needed a theme which was coded to modern standards and without using strange positioning methods to place things onto the screen. I hacked at the code I was using, but even now the themes exported from the bbPress template generator contain many annoying coding bugs.

What did become apparent to me at the time though, was that bbPress was actually more powerful for the average developer than any other forum software out there. If any of you have ever tried coding a new forum theme from scratch you will be able to testify to the fact that they are almost always extraordinarily difficult to work with. In fact they are so complicated that most forum softwares never have any custom themes made for them, they are almost always knock off’s of the default theme. bbPress on the other hand is a dream to work with. The number of template files is low and the ones provided with Kakumei are fairly well laid out and so are easy to find your way around.

I seriously contemplated building a custom bbPress theme, but after taking a serious look at the way that WordPress itself is developing into the most popular web based software of all time, I decided that the best approach to changing the way that themes are built would be to use the same approach used by bbPress’s cousin WordPress. With WordPress, there is a bustling industry of themers churning out designs, new code, new techniques etc. all of the time. WordPress themers across the world are constantly borrowing code from one another in an attempt to stay ahead of the race to create the best theme around.

The competitive themeing industry that WordPress has is not present in any forum software. Creating this sort of competition myself would be impossible as all I could do is to compete with myself (pointless). So after some thought, I decided that the best approach to tackle this problem head on is to create a community of developers who can contribute back to a single theme project each in a small way. Experts from there respective areas will be able to contribute to the areas of themeing which they are best at – HTML/CSS coders can handle the markup/CSS, programmers can handle any custom PHP, javascript experts can handle writing any client side coding used and graphic designers and usability/accessibility experts can contribute to the overall design. This way, although there is no competition necessarily, each section will be contributed to by experts in that particular area of development.

We are running the project over at SitePoint.com where the SitePoint staff (including myself) are organizing a community wide development of the new theme. At this stage the community are working out the basic wireframe/UI side of things before moving on to the design and coding of the theme. If you would like to be involved, please sign up at SitePoint and join in the conversation, we are very keen to get as much input as possible on the new project.

I don’t know of any projects which have been organized in a similar fashion to this. It may not work as expected, but it should be a fun learning experience none the less. I look forward to seeing your input over at SitePoint 🙂

More information is available in the “SitePoint bbPress theme community project Announcement Post“.

WordPress.com Not Just For Blogging

startupgeeklogoIn a recent episode of WordPress Weekly, I discussed with Ryan Hellyer on why anyone would use WordPress.com for a serious blog or venture. In my opinion, if someone were serious about their project, they would get their own domain, hosting, etc and do it all themselves. However, I came across a post by StartupGeek.org which ended up explaining a cool idea on how to use WordPress.com to host a user guide.

I started looking into online help systems around the open source ecosystem. It seemed that everything I found was either overly complex or required time from my development & system administration team.

As my frustration level grew I realized that WordPress was a solution I could use. With WordPress.com I didn’t need technical help from my overloaded developer team. I didn’t need any training since I already know the application from blogging. And of course, the price is just right for a start-up company.

I think this was a great idea on the part of David Abramowski, one I wouldn’t have thought about myself since I consider WordPress.com to be all about blogging. Obviously, it’s not.

Wanna WordPress Wiki

http://wptavern.com/wanna-wordpress-wiki

The following guest post was written by Ryan Hellyer who operates PixoPoint.com While you’re there, check out his WordPress Template Generator You can also catch him in the Tavern forum under the username Ryan.

Have you ever tried using MediaWiki, the platform used to power the mighty Wikipedia project? If you have, then you will have noticed how difficult it is to work with.

With the advent of Post Revisions in WordPress 2.6, it was only a matter of time before someone tried to convert WordPress from a blogging platform into a Wiki platform.

The bright folks over at Instinct Entertainment, makers of the WP e-Commerce Plugin, have released the WordPress Wiki plugin which converts an innocent WordPress blog/site into a Wiki.

Installation

Simply copy the Plugin files to your WordPress plugins folder, activate it in your admin panel and the plugin will add a checkbox to the end of your posts and pages editing panel. When checked, the post or page in question will be given ‘Wiki functionality’.

WordPress Wiki admin panel view
WordPress Wiki admin panel view

How it works

Once you have chosen a page or post to have ‘Wiki functionality‘ it will display a list of post revisions on that page or post. You can then click any of those revisions to revert or edit the Wiki.

WordPress Wiki post view
WordPress Wiki post view

How useful is it?

This plugin does not offer the shear flexibility of a full-blown Wiki system like Media Wiki, Wikka Wiki or any of the other common Wiki software out there. However, it does offer a number of advantages due to being built within WordPress including:

  • Easier integration within blogs
  • Easy theming with the WordPress theming system
  • Huge array of existing plugins and themes
  • Simple installation
  • Very well documented core software

Wiki software is still a specialist area of web development. Whereas blogs, forums, CMS’s etc. are all heavily used across the internet, Wiki’s are much less common and suffer from lack of development because of this. Hopefully the new WordPress Wiki plugin will help make it easier for more people to add a Wiki to their own site.

What will you use it for?

Beyond the obvious uses as a simple Wiki system using WordPress as the backend, do you think there would be a use for such a plugin in a traditional blog? Post your replies in the comments.