Malicious code on WordPress

I go to that line using my favorite Editor, and surprisingly I found this strange code that I never created before:

Not sure whether is’s a virus or other malicious script and don’t really know how it’s affected on my site.
Where it come from? How to prevent it from coming back? I have not found the answer yet.

Wordpress Logos

Global variable is a variable that is accessible in every scope, in PHP it works ONLY for the same page and the file that are included after. However, some predefined variables, known as superglobals are always accessible in whole site. Both of global and superglobal variable can be redefined or overwrite it’s value.

When developing a WordPress Plugin and or Theme, sometimes you use the PHP global variable. That’s okay, but it’s HIGHLY RECOMMENDED that you not use variable name that are already defined by WordPress. Why?  Because it may break your other code that may intended to use WordPress variable.

Example

Example case:

1. You have this code somewhere in your theme:

$cat = 5; /*define cat global variable */
$paged = 2; /*define paged global variable */

/* Those variable are intended to this custom query */

query_posts("cat=$cat&posts_per_page=10&paged=$paged");
if (have_posts()) while (have_posts()) : the_post();
	echo get_the_title().'<br />';
endwhile;

The result is you will get the list of 10 post title from category 5, paged 2. That way as what you expected.

2. On the other hand, you (or other developer) also have this code:

query_posts("cat=$cat&posts_per_page=10&paged=$paged");
if (have_posts()) while (have_posts()) : the_post();
	echo get_the_title().'<br />';
endwhile;

So, do not redefine a reserved WordPress global variable unless you are know what are you doing.

The lists of WordPress Reserved Variable

Anyway, what is the variables that reserved WordPress? Here is the list, the left side is variable name, and the right side is the type:

$_template_file = string
$require_once = boolean
$posts = array
$post = object
$wp_did_header = boolean
$wp_did_template_redirect = NULL
$wp_query = object
$wp_rewrite = object
$wpdb = object
$wp_version = string
$wp = object
$id = integer
$comment = NULL
$user_ID = integer
$cat = string
$paged = integer
$error = string
$m = integer
$p = integer
$post_parent = string
$subpost = string
$subpost_id = string
$attachment = string
$attachment_id = integer
$name = string
$static = string
$pagename = string
$page_id = integer
$second = string
$minute = string
$hour = string
$day = integer
$monthnum = integer
$year = integer
$w = integer
$category_name = string
$tag = string
$tag_id = string
$author_name = string
$feed = string
$tb = string
$comments_popup = string
$meta_key = string
$meta_value = string
$preview = string
$s = string
$sentence = string
$fields = string
$category__in = array
$category__not_in = array
$category__and = array
$post__in = array
$post__not_in = array
$tag__in = array
$tag__not_in = array
$tag__and = array
$tag_slug__in = array
$tag_slug__and = array
$ignore_sticky_posts = boolean
$suppress_filters = boolean
$cache_results = boolean
$update_post_term_cache = boolean
$update_post_meta_cache = boolean
$post_type = string
$posts_per_page = integer
$nopaging = boolean
$comments_per_page = string
$no_found_rows = boolean
$order = string

Disqus Comment System

Dulu saya males pake Disqus dan tidak tertarik untuk mencobanya. “Aplikasi pihak ketiga gini lambat, dan ujung-ujungnya nitip brand di web kita”, begitulah pemikiran saya waktu itu. Sampai pada suatu hari ketika bikin web orang, saya stuck ketika minta sistem komen yang bisa login pake Twitter dan Facebook. Karena tidak ingin membuang-buang waktu, maka saya coba Disqus. Eh… ternyata sesuatu banget. #hammer. Karena tertarik, lalu saya coba juga di blog ini.

Kalau anda tertarik mencobanya, berikut tutorial cara Memasang Komentar Disqus di WordPress:

1. Pertama mendaftar di Disqus.com dulu, jangan khawatir proses pendaftarannya mudah kok, jadi tidak perlu screenshot. (Padahal lupa )

2. Install plugins Disqus dari dashboard, pada kotak pencarian ketikkan disqus lalu tekan enter, maka akan keluar plugin-plugin yang mengandung kata disqus. Pilih Disqus Comment System klik, Install Now. (lihat gambar 2)

Cara menginstall plugin Disqus di WordPress

3. Kembali ke web Disqus, kita perlu mendaftarkan blog kita ke Disqus. (Dalam satu akun Disqus, bisa dipake untuk banyak blog/website). Di dashboard Disqus, pada sidebar kiri klik tombol +Add disamping tulisan Your Sites. (lihat gambar 3)

Mendaftarkan blog ke Disqus

4. Pada halaman selanjutnya, isikan Site URL, Site Name, dan Site Short Name sesuai dengan detail blog Anda. (lihat gambar 4). Kemudian klik Continue.

Mendaftarkan blog ke Disqus

5. Selanjutnya tertuju pada halaman Settings, isi setting seperlunya. (Lihat gambar 5). Dalam tahap ini kita bisa menentukan Bahasa, jangan pilih Bahasa Indonesia, karena terjemahannya standard baku (baca : jelek) dan belum merata. Jika Anda trauma spam, isikan juga Akismet API (anti spam). Supaya pengunjung bisa menyisipkan gambar di komentar aktifkan Media Attachment.  Jangan lupa di bagian Twitter @replies isikan dengan username Twitter Anda (jika ada ). Klik Continue.

Setting komentar Disqus

6. Tahapan berikutnya, petunjuk untuk instalasi di blog, pilih WordPress (lihat gambar 6). Oh ya, abaikan bagian ini karena kita tadi sudah menginstal plugin Disqus di WordPress.

Cara menginstal Disqus di WordPress

7. Kembali ke dashboard WordPress, buka setting Disqus (di bawah menu Comments). Isikan username dan password Disqus  dan klik Next. (lihat gambar 7)

Username dan passowrd Disqus di WordPress

8. Pada halaman selanjutnya, pilih blog yang sudah kita daftarkan di Disqus tadi. Jika Anda mendaftarkan blog lebih dari satu, situs-situs tersebut akan muncul disini. Klik Next. (lihat gambar

Pilih blog yang mau dipasang Disqus

9. Pemasangan Disqus selesai. Jika Anda ingin mengexport komentar yang sudah ada ke Disqus, klik link export them now. (lihat gambar 9)

Cara mengexport/import komentar Disqus di WordPress

10. Selanjutnya di halaman export/import, klik Export Comments (lihat gambar 10)

Cara mengexport/import komentar Disqus di WordPress

11. Tunggu sampai muncul tanda check list dan tulisan Your comments have been sent to Disqus and queued for import. Klik link See the status of your import to Disqus untuk melihat status pengimporan Komentar di Disqus (lihat gambar 11)

Your comments have been sent to Disqus and queued for import

12. Status pengimporan komentar di web Disqus (lihat gambar 12). Jangan panik kalau ada tulisan Your import are 0% complete (1 still processing), karena itu menandakan proses lagi menunggu antrian untuk diimport. Proses bisa memakan waktu 1-10 menit (tergantung banyaknya komentar).  Ketika proses selesai nanti ada notifikasi di email.

Disqus comment import queue

Selamat berDisqus ria.

1. Buatlah sebuah sub-domain di cpanel, document Root nya diisi dengan /public_html/wp-content/uploads (lihat gambar 1)

Gambar 1. Create sub domain

2. Di wp-admin, buka menu Settings->Media

3. Pada field Full URL path to files, isikanhttp://img.example.com/ (lihat gambar 2) kemudian klik Save Changes untuk menyimpan setting tersebut.

Gambar 2: Full URL path to files

4. Sekarang coba bikin post baru, upload image dan insert ke post, secara otomatis URL image nya sekarang adalah http://img.example.com/tahun/bulan/nama-file.jpg  (demo: lihat path URL gambar2 attachments diatas).

Sekian, semoga bermanfaat

Wordpress Paging

Hello, In this tutorial I will show you how to make your WordPress paging looks eye-catching without using plugins. But hey, there are many plugins out there could do it automatically without any programming skills required. Yes I know, at least, I assume that you want to do it yourself by using PHP. Yes you can do it with easy.

Basically, WordPress has its own built in functions to create paging. So do not have to think about how to write database query or other complex  coding. All we need to do is create a function to generate paging, and call in the theme where you want to paging should appear.

1. Create a my_wordpress_paging() function in your functions.php under theme directory.

2. Call the function in theme file.

Then in your template (example: index.php, archive.php, category.php etc) paste this code outside the loop:

If you using TwentyTen theme, open each files named loop-xxx.php and find these lines and replace with code above:

3. Styling

Here is the basic style css for the paging links, please customize to fit your needs.

4. Parameters

• $prev, previous link text, default value ‘<< Previous’,
• $next, next link text, default value ‘Next >>’,
• $currentclass, class for current page, default ”currentpage’,
• $pagingclass, class for wrapper div, default value ‘navigation’,
• $echo, whether paging will be echoed or not, if you want to store it in a variable set it to false, default ‘true’

That’s all, any bug report or feedback are welcome. Thank you.

5. Demo?

Ah, I forget it, see this blog homepage. I already use it in this blog.

Wordpress 3.0.2

On November 30, 2010, WordPress 3.0.2 was released to the public. This is a mandatory security update for all previous WordPress versions.

For version 3.0.2, the database version (db_version in wp_options) remained at 15477.

Installation/Update Information

To download WordPress 3.0.2, update automatically from the Dashboard > Updates menu in your site’s admin area or visit http://wordpress.org/download/release-archive/.

Summary

• Fix moderate security issue where a malicious Author-level user could gain further access to the site. (r16625)

Other bugs and security hardening:

• Remove pingback/trackback blogroll whitelisting feature as it can easily be abused. (#13887)
• Fix canonical redirection for permalinks containing %category% with nested categories and paging. (#13471)
• Fix occasional irrelevant error messages on plugin activation. (#15062)
• Minor XSS fixes in request_filesystem_credentials() and when deleting a plugin. (r16367, r16373)
• Clarify the license in the readme (r15534)
• Multisite: Fix the delete_user meta capability (r15562)
• Multisite: Force current_user_can_for_blog() to run map_meta_cap() even for super admins (#15122)
• Multisite: Fix ms-files.php content type headers when requesting a URL with a query string (#14450)
• Multisite: Fix the usage of the SUBDOMAIN_INSTALL constant for upgraded WordPress MU installs (#14536)

List of Files Revised

wp-includes/ms-files.php
wp-includes/version.php
wp-includes/comment.php
wp-includes/functions.php
wp-includes/load.php
wp-includes/canonical.php
wp-includes/capabilities.php
readme.html
wp-admin/includes/plugin.php
wp-admin/includes/file.php
wp-admin/includes/update-core.php
wp-admin/plugins.php

Source: WordPress.org

Spammer

There are so many WordPress plugins tagged spam published in WordPress plugins directory. Most of the plugins is to combat spam comment in WordPress blog. However, I am not use one of those plugins, because of several reasons:  they are captcha based (eg. re-Captcha) and they are using API (eg. Akismet). In my experience, using both type of anti spam could decrease my blog performance.

For that reason I have a few tips for you to combat spam without sacrificing your web performance:

1. Never install any anti spam plugins that come with captcha, API, or remote database access.

2. Some plugins will count your spam, haha… it’s funny. Do not install such plugins.

3. Ensure you have these setting in wp-admin/options-discussion.php

- An administrator must always approve the comment ( This should be ON)
– Comment author must have a previously approved comment (This should be OFF)

4.  Use built in WordPress feature, blacklist comment. See figure below:

Comment blacklist

6. Delete spam comment automatically. To do this I have written a little plugin named Delete Spam Hourly.

Here is the code:

Actually it’s also possible to filter the search result by custom field , but I will do it later

Installation
Just install the plugin and activate. Make sure your search form is called from:

Demo:
Please see the live demo at the top right of this website.

WP Dropdown Posts
Author: takien
Contributors: takien
Donate link: Donate
Tags: post, dropdown, jump, menu
Tested up to: 0.1
Stable tag: 0.1

This plugin will show post list as dropdown

Description

This plugin will show post list as dropdown just like wp_dropdown_pages, most parameter wp_dropdown_pages are accepted too.

Screenshot

WP Dropdown Posts

Installation

1. Upload the ‘wp-dropdown-posts.php’ file to the ‘/wp-content/plugins/’ directory
2. Activate the plugin through the ‘Plugins’ menu in WordPress
3. Paste the following code to your theme file, e.g in your sidebar.php