Hot answers tagged

3

»The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts.« (Gene Spafford) The lost password feature might potentially be a risk, but if you are keeping it or not is just a matter of risk assessment. For that assessment there surely is not ...


2

The question is not if the feature can be abused, but what is the alternative? recovering lost password is important as most users do not have access to the DB and can not manually update the DB. Removing the feature for any site with more then one user, or with users which are not technical have the potential of someone getting annoyed by the number of ...


2

The security risk here is not about the plain text but about translation. You should note that esc_html_e is not only a function for escaping HTML but also for localization (l10n). I.e. other people can translate this String but you don't know what the translation would be. It is possible that somebody translates the String and adds a link or some malicious ...


2

You should always escape your data, whatever its origin. For your example, the URLs should be escaped using esc_url(). WordPress has many functions which can be used. There's an article on Data validation on the Codex which lists the various functions available.


1

This sounds like the wrong way around and always having the danger of forgetting or misconfiguring something. If you need content separation, just use a network install. It has a little more overhead of admin but it out of the box ensures the content separation you seek.


1

I have the feeling that either those files don't exist or the location of the file has changed. Go into /plugins/wp-greet-box/js/ and see if you can locate the functions.js and the jquery.js. If the files are not there then they must have been deleted and that is why it's throwing the 404 (Not found). EDIT: Also I would remove some Plugins as a lot of ...


1

The logic of the first one is based on wordpress setting ABSPATH as part of the initialization, and therefor if it was not set you are not accessing the site via the "official" wordpress end points. The second seems to be a general PHP technique. The best way is to just write code without side effects (or if you are the owner of the site block access to ...


1

I you think you need it. For example, you are using the title in a URL and you are getting the title dinamically; so you never know exactly if the title is valid to be used in URL or not. So, it is better to use it. Just one example: it is very common that titles contain white spaces and white spaces need to be enconded to be used in URLs. I would build ...


1

Ok, seems I was on the right track... I still haven't found a WordPress function that achieves what I need, but the closest I have found is to use the get_allowed_mime_types function. I created the following function which checks if the file is within the get_allowed_mime_types array and if so returns true (file processed using wp_insert_attachment, ...



Only top voted, non community-wiki answers of a minimum length are eligible