318 reputation
29
bio website
location
age
visits member for 3 years, 5 months
seen Oct 17 at 20:25

Aug
19
comment Why are passwords exportable as plain text in WordPress?
@JasmineLognnes A membership plugin could potentially hook into or replace the site's registration and log-in forms and store initial and updated passwords as plain text somewhere. It sounds like that's what might be happening here. It could be a bug. There's an unresolved ticket here from a month ago where a user posts the same issue you describe.
Aug
19
comment Why are passwords exportable as plain text in WordPress?
@JasmineLognnes It sounds like that plugin's worth investigating further. It's very hard to export plaintext passwords from the hashed ones stored in the database, but I suppose it's possible that a malicious or poorly thought-out plugin is saving passwords in plain text as they're typed when users log in? It would be worth using PhpMyAdmin to search the database for one of the plaintext passwords too – it might point to the plugin that's added those rows to the database. If you do find the culprit, don't forget to answer your own question – it would be interesting to know more.
Aug
18
comment Why are passwords exportable as plain text in WordPress?
@JasmineLognnes A couple of ways you could investigate: (A) Download the whole /wp-content/plugins/ folder to your machine, then search the plugins folder for the word, “Export” using the command line or a text editor that supports multi-file search. (B) Recreate the entire site on your local machine, then turn off plugins until the Export feature disappears.
Aug
18
comment Why are passwords exportable as plain text in WordPress?
I only see a "Delete" option under "Bulk Actions" in the Users page (WP 3.9.2) with all users selected: d.pr/i/M2YO Are you using a plugin to get the user export functionality?
Oct
18
comment What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
Many thanks – that gives me enough to work with!
Oct
16
comment What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
@CharlesClarkson I reference that page in the first sentence of my question. It says not to use the above constants, but doesn't suggest an alternative to things like WP_PLUGIN_DIR, hence my question here.
Oct
16
comment What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
(I'm specifically interested in finding the full path to installed plugins other than the plugin that contains my own code, in case that helps to explain.)
Oct
16
comment What should I use instead of WP_CONTENT_DIR and WP_PLUGIN_DIR?
Thanks for this, but your answer seems to deal with URLs rather than absolute server paths, which is what I was interested in. For example, plugins_url() returns the URL to the plugins folder, not the full path to the directory on the server. Are there similar functions for handling directories that I'm not aware of? Or is the advice not to use the WP_PLUGIN_DIR constant simply wrong?
Jun
7
comment Detecting a WordPress URL without doing a full HTTP GET?
@Rarst Yes - that's the caveat. It's possible for sites to spoof this, and there may be some that use the page_id variable already. Any sort of detection method using headers can probably be spoofed, so I don't think it's worth worrying too much about that. Which just leaves false positives for custom CMS. I couldn't think of a more WordPress-specific variable that would be less likely to be used elsewhere. Is there one?
Jan
31
comment check for shortcode in post/pages AND widgets AND template files
You're welcome. Worth noting that the original poster would need to call the hooks wp_print_styles or wp_enqueue_scripts from the plugin or shortcode function. It won't work if you use the functions wp_enqueue_style() or wp_enqueue_scripts() directly inside the plugin/hook -- those functions have to be inside whichever function the wp_print_styles and wp_enqueue_scripts hooks call.
Jan
31
comment check for shortcode in post/pages AND widgets AND template files
+1 From the developer notes for v3.3: "WordPress 3.3 allows wp_enqueue_script() to work mid-page, which means most of that Jedi logic is no longer needed."
Jan
26
comment Creating a table from shortcode avoiding wpautop for each row
Thank you for this! For others, the relevant line to strip <br/> tags from shortcodes is simply $content = str_replace('<br />', '', $content);