Search Results for '\"wordpress\'
-
Search Results
-
HttpOnly cookies are a security advancement that is finally supported now by all major browsers (Firefox eventually got it right in 3.1, while IE 7 still has a bug but it generally works).
HttpOnly means a cookie cannot be read by javascript in the browser, only by the server (via PHP, etc.) This practically stops XSS exploits and makes it much harder if not impossible in most cases.
HttpOnly may “save your bacon” when a plugin has a security hole (like Private Messaging and bb-Reputation 0.0.5) and prevent a malicious script from forwarding your keymaster cookie to someone else via a XSS script.
I manged to get them to include HttpOnly in WordPress 2.7 and bbPress 1.0 but it’s still not in older WordPress or bbPress 0.9 because they worried about backward compatibility with some WordPress plugins that try to directly read the cookie (bad technique) instead of using server-side helpers.
However there are NO bbPress plugins that direct read the auth cookie and very few WordPress plugins still do this. I am not 100% positive how it will affect ajax but it shouldn’t because it’s still authorized on the server-side via PHP.
So if you’d like to try out HttpOnly on your bbPress 0.9, here’s how, it’s as simple as a mini-plugin. Note that if you are already using a cookie replacement plugin like my “Freshly Baked Cookies” or “Year Long Cookies” you will need to edit them instead of using the following (you can only use one cookie replacement plugin at a time).
I’d appreciate any feedback or experiences with this, especially if it causes problems:
Save this as
_HttpOnly.phpand upload into yourmy-plugins/directory:<?php
/*
Plugin Name: HttpOnly Auth Cookie
*/
function wp_set_auth_cookie($user_id, $remember = false) {
global $bb;
if ( $remember ) {
$expiration = $expire = time() + 1209600;
} else {
$expiration = time() + 172800;
$expire = 0;
}
$cookie = wp_generate_auth_cookie($user_id, $expiration);
do_action('set_auth_cookie', $cookie, $expire);
setcookie($bb->authcookie, $cookie, $expire, $bb->cookiepath, $bb->cookiedomain. '; HttpOnly' );
if ( $bb->cookiepath != $bb->sitecookiepath )
setcookie($bb->authcookie, $cookie, $expire, $bb->sitecookiepath, $bb->cookiedomain. '; HttpOnly' );
}
?>To prove it’s working, you CANNOT use the Firefox webdeveloper plugin because that looks at the cookie in Firefox’s chrome, not at the user level. What you have to do is
1. prove you can see your bbpress/wordpress cookie by typing or copying this to your browser address bar
javascript:alert(document.cookie);2. install the plugin
3. log out and then log in
4. again type or copy this to your browser address bar
javascript:alert(document.cookie);5. if it’s working, you should NOT see your wordpress/bbpress cookie in the alert
Currently the only plugin I am aware of that tries to read the cookie directly in WordPress is the
WP-UserOnlineplugin from GamerZ, and he may have even fixed that by now in the newest versions. However there may be others, so test your setup.Hello,
Next days (or weeks) I sill start a new project. It will take long to develop and probably it will be finished later this year. I think it will 6 months or a bit more. It must be integrated with the latest version of WordPress.
So, I’m thinking about starting the project with the 1.0 alpha versions. I know it’s not as stable or secure as 0.9.x but hope it will be later this year. I’ve seen there are lots of changes from 0.9 to 1.0 and perhaps will be easiest to merge the new 1.0 versions than 0.9 to 1.0…
What’s your opinion? It’s the best idea to start the project with the alpha version ? Or you would start it with 0.9x and in the future you will make all arrangements to upgrade it? Consider that it will be finished this year fall.
Thanks for your comments,
Txanny.
Ok, thanks for your help
I’m going to try more of these queries. I find them very useful to integrate small details.
That is with bbPress 1.0 right? the object_type is for 1.0
Yes, it is bb 1.06a with wp 2.7
I tried with get_var and I get the same error for get_var;
Fatal error: Call to a member function get_var() on a non-object in….
but then I changed $bbdb for $wpdb and it works. Why? I don’t understand this.
Topic: link back to blog
Hi,
There is an answer to this question posted a year ago, but when I open the header.php file from my bb-templates/kakumei folder all that is there is “>”. I tried adding the code there, but it deleted the header. Is it located in another place?
I’m using bbpress 0.9.0.4 and wordpress 2.7.1.
Thanks!
When I post code samples in my bbPress install, all quote marks show up like this:
"This includes when I use backticks and/or buttons. Neither work.
For instance, when I post this code:
<div class="box">This is a box</div>It becomes:
<div class="box">This is a box</div>I am using the beta version of bbPress with WordPress integration. I have deactivate all plugins and switched themes, so I know it is a problem with my bbPress code.
Thoughts?
[code] buttons. Neither work.
For instance, when I post this code:
<div class="box">This is a box</div>It becomes:
<div class="box">This is a box</div>I am using the beta version of bbPress with WordPress integration. I have deactivate all plugins and switched themes, so I know it is a problem with my bbPress code.
Thoughts?
