New answers tagged

3

Well, AUTH_KEY and it´s brothers where introduced in WordPress 2.6 to improve safety for logged in users. They are used to encrypt and validate the information in your backend login cookie. While revealing the AUTH_KEY alone might not be a real security issue, you should nevertheless not output/use this anywhere to give less surface for attacks. ...


1

Question 1. so where it is defined before Answer: It is defined in WordPress core. Here a quick online reference or for a local reference take a look at the following file in the root of WordPress: wp-settings.php. In that file (around line 18) following code is shown: define( 'WPINC', 'wp-includes' ); Question 2. and it is not abort the ...


1

WPINC is defined by WP before plugins are loaded; so, the fact that it is already defined indicates the plugin is being loaded by WP rather than a direct request.


1

This sounds like the wrong way around and always having the danger of forgetting or misconfiguring something. If you need content separation, just use a network install. It has a little more overhead of admin but it out of the box ensures the content separation you seek.


0

Escaping is used to produce valid HTML or other formats, and it depends on context. Escaping a url in something like <a href="<?php echo $url?>".... is needed in order to replace any "&" characters with & (although browsers will most likely fix it for you if you don't do it). Escaping a url in an input element like <input ...


2

You should always escape your data, whatever its origin. For your example, the URLs should be escaped using esc_url(). WordPress has many functions which can be used. There's an article on Data validation on the Codex which lists the various functions available.


0

Here is how you can find the list of roles without any plugins or function http://screencast.com/t/uaWsGLAR3Sh


1

I have the feeling that either those files don't exist or the location of the file has changed. Go into /plugins/wp-greet-box/js/ and see if you can locate the functions.js and the jquery.js. If the files are not there then they must have been deleted and that is why it's throwing the 404 (Not found). EDIT: Also I would remove some Plugins as a lot of ...


2

The security risk here is not about the plain text but about translation. You should note that esc_html_e is not only a function for escaping HTML but also for localization (l10n). I.e. other people can translate this String but you don't know what the translation would be. It is possible that somebody translates the String and adds a link or some malicious ...


1

I you think you need it. For example, you are using the title in a URL and you are getting the title dinamically; so you never know exactly if the title is valid to be used in URL or not. So, it is better to use it. Just one example: it is very common that titles contain white spaces and white spaces need to be enconded to be used in URLs. I would build ...


0

Based on the add_feed function, here's a prototype implementation of remove_feed: /** * Remove a feed type like /atom1/. * * @global WP_Rewrite $wp_rewrite * * @param string $feedname Feed name. * @return string Feed action name. */ function remove_feed( $feedname ) { global $wp_rewrite; if ( in_array( $feedname, ...


0

In my opinion, the only way to do this (within the context of WordPress) is: if ( ! defined( 'ABSPATH' ) ) // Or some other WordPress constant exit; The second technique is vague and does give the same level of checking (it only checks that the filename of the main PHP file matches itself, not whether WordPress is loaded, nor if it's another file of ...


0

About changing the login url, i already did by mysel. It help me protect my site and prevent brute force You can change it in htaccess. But you also need to add the filter to replace old login url in wordpress. Example to my website: File .htaccess: RewriteRule ^signin(.*) wp-login.php?%{QUERY_STRING} In your theme or custom plugin, you can add the ...



Top 50 recent answers are included