Connect with us

Tips & Tricks

WordPress Security Hacks

Published

on

Hi guys this is my first post on wpcult the great site Austin built.  Hope you guys find it usefull.

If you run a blog using the wordpress software then your blog is a target to hackers.  Below I will list some hacks and just how they can help you keep your business/site safe.

The following is  code to Block Bad Queries and protect your blog from malicious URL Requests.

Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin

<?php
/*
Plugin Name: Block Bad Queries
Plugin URI:
http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI:
http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
  if(!current_user_can(‘level_10’)) {
    if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
      strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
      strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
      strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
      strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
        @header(“HTTP/1.1 414 Request-URI Too Long”);
 @header(“Status: 414 Request-URI Too Long”);
 @header(“Connection: Close”);
 @exit;
    }
  }
}
?>

 This Great plugin was made by Jeff Starr of Digging into WordPress

 

 

Protecting your blog with .htaccess 

.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.

 This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

 

Thanks to Oussama for this great hack

Tips & Tricks

Can′t add pagination on WooThemes Thick Theme

Published

on

Everything I have tried has led to nothing. And I have tried six way’s from Sunday to get my main posts to paginate.

example one:

<?php $paged = (get_query_var('paged')) ? get_query_var('paged') : 1; 
query_posts('offset=1&showposts=' . get_option('woo_other_entries') . '&cat=-' . $GLOBALS['ex_asides'] . '&paged=$paged' ); ?>

example two:

<?php 
global $myOffset; 
global $wp_query;
$myOffset = 1;
$paged = intval(get_query_var('paged')) ? get_query_var('paged') : 1;
$temp = $wp_query;
$wp_query= null;
$wp_query = new WP_Query();
$wp_query->query(array(
	'offset' => $myOffset,
	'category__not_in' => array($GLOBALS['ex_asides'],7,84),
	'paged' => $paged,
	'showposts' => get_option('woo_other_entries'),
	)); ?>

example three:

<?php 
global $myOffset;
$myOffset = 1;
$wp_query = new WP_Query();
$wp_query->query(array(
	'offset' => $myOffset,
	'category__not_in' => array($GLOBALS['ex_asides'],7,84),
	'paged' => $paged,
	'showposts' => get_option('woo_other_entries'),
	)); ?>

And after those tries, I just can’t get more pages beyond the option’s that I choose, and can only pull an archive via the browse more link.

Any suggestions or anything?

Continue Reading

Tips & Tricks

Pulling custom fields from outside the loop

Published

on

In the last post “Creating a custom widget” I showed you how to create a custom widget. Well in this post I will show you how I used my custom widget to display all post with a certain custom field from outside the WordPress loop.

In the last post I used this tag:

<?php include(TEMPLATEPATH . '/includes/showcase.php'); ?>

Now I will show you what the file showcase.php has:

<ul>
<?php
global $wpdb;

$sql = "SELECT wposts.*
	FROM $wpdb->posts wposts, $wpdb->postmeta wpostmeta
	WHERE wposts.ID = wpostmeta.post_id
	AND wpostmeta.meta_key = 'gallery-url'
	AND wposts.post_status = 'publish'
	AND wposts.post_type = 'post'
	ORDER BY wposts.post_date DESC LIMIT 8";

$pageposts = $wpdb->get_results($sql, OBJECT);
$output = $pre_HTML;

foreach ($pageposts as $post) : setup_postdata($post);  ?>

<li><a href="<?php echo get_post_meta($post->ID, "gallery-url", $single = true); ?>" title="Link to <?php the_title(); ?>">
<img src="<?php echo get_post_meta($post->ID, "image", $single = true); ?>" alt="<?php the_title(); ?>" /></a></li>

<?php endforeach; ?>

</ul>

That’s it! The most important item you may want to change for your own custom field is the line : AND wpostmeta.meta_key = 'gallery-url'. Where you would change the text in bold to match your own custom field value.

Update:

Check out Austin from PressedWords comment below.

With his great advise I was able to figure out why all my attempts to use the query_post weren’t working. it came down to this line of code: <?php echo get_post_meta($post->ID, "gallery-url", $single = true); ?>, that was what I had in my code, and the $post->ID is the reason my code would not echo or print the custom field’s value. Solution? replace $post->ID with get_the_ID(). HA, so simple.

Continue Reading

Tips & Tricks

Creating a custom widget

Published

on

Today let’s learn a simple quick trick on how to create a custom widget. For my example I will show you how I created my Showcase widget located in the middle, to the right of the posts.

First under your functions.php file type in the following:

<?php // Custom Widget
function MyCustomWidget() { ?>
<li class="widget">
    <h2 class="heading">Latest Showcase</h2>
        <ul>
        	<?php include(TEMPLATEPATH . '/includes/showcase.php'); ?>
        </ul>
</li>

<?php }

register_sidebar_widget('The Custom Widget for Showcase', 'MyCustomWidget'); ?>
  • Always make sure your code is between the <?php and ?> for it to work.
  • Once we call the function, the rest is assuming html code that you may or may not need.
  • For instance, you may just put in a picture and call it a day. But my code starts with <li< because my sidebar’s start and end with <ul<.
  • Any way, once your done, just set the final “register_sidebar_widget('the widget title', 'the name of the function');

That’s it! Now you have a custom widget with what ever you want!

Continue Reading

Trending