New answers tagged

9

There is no definite answer as each plugin, whether available in a repo or not, should be handled on its own merit. Also, who says that that plugin caused your site to get hacked, it might have being a loophole in another plugin or even your theme. Just in general, one should avoid using plugins and themes that are not actively being maintained as it does ...


4

If I follow the description right the vulnerability refers to PHP applications which read, trust, and use HTTP_PROXY environment value (which might be compromised). From quick search through WordPress core source code I found no instances of that value being accessed. Since WP ships its own HTTP client implementation its also not affected by upstream ...


0

Input/output related security issue can be roughly sorted into two buckets: someone manages to read information they are not supposed to; someone manages to write information they are not supposed to. Localize is not capable of writing anything into site, so you are safe on that front. On the read side it's not much different from just echoing things ...


1

See documentation here but don't miss the note 2 and the following points : AJAX on the front-end is more complicated, ajaxurl is not defined so you have to call it with wp_localize_script(). you have to use wp_ajax_nopriv_{action} for non logged in users there could be security issue !!! About the third point : Be careful because you give access to ...


0

wp_config was set up to force SSL by overwriting $_SERVER['HTTPS'], I respolved the issue. I assume someone was trying to make SSL work behind the proxy at one point. It would actually be a much better solution ( specifically for asset links ) to use the double slash //


0

What's the risk? On a poorly configured shared host, every customer's PHP will execute as the same user (let's say apache for discussion). This setup is surprisingly common. If you're on such a host and use WordPress to install the plugin using direct file access, all of your plugin files will belong to apache. A legitimate user on the same server would ...


2

The solution to restrict access to author's archives with .htaccess rule does pretty decent job. However, not everyone can edit or have access to .htaccess, especially on shared hosting accounts. The code below require PHP version 5.3+. Here is the solution which deals with the problem on WordPress level. Put this code in your theme's function.php file: &...


2

Nulled theme basically mean cracked/hacked, the distributors of nulled themes often hide popups/ads in them to earn money, which you can't see until a user complain about it or you check the website on google speed test for example where you see image of the website, they aren't secured at all, and it is doesn't worth using them. Expected behavior of nulled ...


0

I think the answer is "it depends" -- on how flexible and/or "slick" you want the solution to be. The quickest/easiest thing to do would be to create a custom post type (there are tried/true plugins out there that can help establish this) -- and then in your theme functions.php (or in a very simple plugin), put in logic that redirects non-logged in users to ...


2

I guess there is $_SERVER['HTTP_ORIGIN'] property which can be helpful for this point, or even HTTP_REFERER, hooking into the init hook to make sure nothing runs until this origin is allowed, something like: add_action("init", function() { global $pagenow; if ( "xmlrpc.php" !== $pagenow ) return; // xmlrpc.php only $domains = array( "example.com"...


0

I found an answer here i will give this a try.. Confirmation required on email change


0

I would even go as far as setting up .htaccess to rewrite the request to https for a specific folder, aka /wp-admin/ For example RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteCond %{REQUEST_URI} wp-admin RewriteRule ^(.*)$ https://www.yourdomain.com/wp-admin/$1 [R,L] Also it looks like FORCE_SSL_LOGIN was depreciated since 4.0, so in your ...


0

I use this bash command to reset WordPress file permissions quickly and easily, just navigate to your root WP folder and run both: directories find . -type d -exec chmod 755 {} \; files find . -type f -exec chmod 644 {} \;


0

To verify nonces in Ajax requests, check_ajax_referrer() should be used instead of wp_verify_nonce(): Crete the nonce: $nonce = wp_create_nonce( 'vote-nonce-' . get_the_ID() ); Include it in JavaScript: jQuery(document).ready(function(){ jQuery(".post-voting").click(function(){ vote_nonce = <?php echo $nonce; ?> vote_id = jQuery(this)....



Top 50 recent answers are included