The Loop

Chip Bennett

00:02

Oh, it updated!

w00t!

Yay for working Plugins

GhostToast

00:17

do you guys ever IP ban? (for a wordpress site) ?

Wyck

I do some but automatically, never manually

GhostToast

i am using better wp security

have someone who hsa been repeat offender

i hate to ban IPs cause i feel like it will eventually be released and belong to another person

Wyck

I dont know anything about security plugins but bans are usually on a timer

GhostToast

ban = permanent in this plugin's language. blacklist is temporary

i guess i can increase the blacklist period

Wyck

with server you can usually do an increasing penalty, 5x bad things your out 1 hour, do it again and your out 24 hours, again and see ya for a week

Chip Bennett

00:22

I IP ban for brute-force login attempts

GhostToast

i ended up enabling apache-level password (htaccess) for even accessing /wp-admin (wp-login.php)

on one of the big hospital sites. just got way too many hits. stops mysql from checking user table

less taxing then

cause server had actually gone down

Wyck

get some sort of firewall and ddos protection , using a php plugin for security is rather meh

and by meh I mean shit

GhostToast

i hate playing sysadmin

Wyck

google has a new beta ddos service, go sighn up

GhostToast

nice

Wyck

00:25

projectshield.withgoogle.com

GhostToast

then they know everything

saw that when searching, did not trust domain

Wyck

aint nobody got time for that..cloudflare and a bunch of other have ddos as well, or just yell at host

GhostToast

i dont think my sites in need qualify under mission statement

Wyck

login bot army attack!

admin, admin, admin, admin

cloudflare is good though for the price

GhostToast

yea people say "security through obscurity is no good" but its a big component.

had a client beg us to build site in drupal for that reason

boss said "ok"

Wyck

00:31

obscurity is good but it's just not security hehe

GhostToast

i dug my heels in and just built it in php - no cms. don't feel like learning a whole new CMS for one project.

well they were afraid of wordpress

drupal's more secure because nobody cares about it, comparatively

Wyck

that's a horrible way to look at it

GhostToast

obscurity: no admin user; different table prefix; move wp-login directory

because most of these attacks are bots

i would wager that not having 'admin' user probably covers more bases than any other single step. or any other ten steps combined.

Wyck

it's always basic shit with security, bots are dumb and people are lazy

GhostToast

for strong passwords i absolutely have to remember, i favor muscle memory ones

Wyck

00:35

I wrote this a month ago or so, wycks.wordpress.com/2013/09/19/…

Chip Bennett

Sometimes, it helps to be so nerdy that you can recognize the different CSS classes as output by wp_page_menu() rather than wp_nav_menu():

0

A: wp_nav_menu in 3.7 add name class nav navbar-nav

Edit In this case, it appears that the problem is that you're not actually outputting a custom nav menu at all, but rather the menu fallback: wp_page_menu(). Notice that the classes for the list items are page-item rather than menu-item. That's a sure giveaway that the output is being generated ...

GhostToast

@ChipBennett i'm sure @user2799505 will be thrilled ;)

and that is a good eye

this isn't your first run-in with those methods :)

Wyck

00:49

@GhostToast have a look at this I don't use it, but it's a good idea that it uses the server to handle stuff, wordpress.org/plugins/wp-fail2ban

Chip Bennett

01:47

@GhostToast I may or may not have written the CSS Classes sections of the Codex entries for wp_nav_menu(), wp_page_menu(), and wp_list_pages() ;)

Rarst

08:04

The complaints from developers I've seen regarding auto updates all point to nonexistent version control / deployment practices.

Tweeted by nacin on October 28, 2013 at 5:43 AM

they should have read all about said practices in Codex and implement them, right...

Rarst

08:15

@Wyck they added easier user:me alias for that

Port

08:41

Hi every1

Rarst

hiya

Port

@Rarst how are you

Rarst

monday-ish

Port

are u know iOS development

Rarst

no

Port

08:49

kk

this group helpful for what?

Rarst

this is WordPress stack's room

Port

ok

anu

10:48

Ah, DISALLOW_FILE_MODS. Phew.

Rarst

11:08

hour or two of why isn't it working? :)

anu

I'm happy there's a way of totally disabling updates - especially as Nacin et al haven't taken Capistrano (or similar) deployment mechanisms into account (yet)

Rarst

11:22

there are constants for just updates as well, big post on it make.wordpress.org/core/2013/10/25/…

anu

@Rarst Yeah, was reading that just now. Think that for any sites that are version controlled locally and then deployed, I want to turn off all updates

Rarst

naturally...

anu

and DISALLOW_FILE_MODS seems like the best option, also means don't need to add any extra code to disable access to theme/plugin installation

PS - do you know when WCEU videos will be available?

Sisir

is there any plugin yet to do all of em with admin interface? :)

Rarst

@anu no idea, work in progress...

Sisir

12:47

update control plugin

Chip Bennett

@Sisir I just committed a bunch of updates to GitHub for Update Control over the weekend; just waiting for George to push them to SVN (or add me to the SVN committer list so I can commit it)

GhostToast

14:02

@kaiser one time you showed me you found access to a project's theme files. what is ideal permissions for theme files and/or theme folders to prevent that?

kaiser

.htaccess

GhostToast

7

A: Worthwhile to restrict direct access of theme files?

Usually, you don’t need it. But … there is at least one edge case: If a theme file is a template part, and it is using global variables from the calling context (parent file), and register_globals is on, and it is just using these variables without any security check … … an attacker can cal...

defined('ABSPATH') OR exit; <-- will that work everywhere ?

kaiser

14:18

In WordPress, yes.

As long as you don't include anything that defines ABSPATH as well :)

Maybe you could add the following check in your wp-config.php before ABSPATH gets defined: if ( defined( 'ABSPATH' ) { exit( print '<h1>YOU MUST BE KIDDING ME!</h1>' ) };

GhostToast

14:35

if ( defined( 'ABSPATH' ) { exit( print '<h1>WHO SENT YOU!?!?</h1>' ) };

GhostToast

14:47

I feel like I used to find questions worth answering on this site. Now they are either too poorly worded or are already answered before I can get to them. Or edge case, something I know too little about.

4

Chip Bennett

@GhostToast I think that's a huge part of why valuable contributors come and go, and very few stick around for the long term.

@GhostToast perhaps a solution is to start writing definitive answers for definitive questions, and work on building the knowledge base aspect of WPSE.

I'm going to work on one for the custom loop pagination question that comes up daily.

Rarst

as traffic grew we started to capture more of users out there and WP users can be very low tech level

kaiser

15:10

WordPress and the Caveman theory

GhostToast

migrating a client from medseek. they gave me their login. got this message:

Sorry, SiteMaker 6 administration requires Microsoft Internet Explorer 5.5 or greater running under Windows.

FML

also medseek seems to have zero export capability

kaiser

I'm not seeing an obvious disconnect between the current name and the site's scope. Is the current name causing problems that you're hoping to solve with a renaming? — Anna Lear 15 mins ago

sigh

@Rarst @toscho Could you stick that as notification bar on the front page?

Chip Bennett

Maybe peruse the overall question quality, as well as the non-trivial amount of questions that get closed due to being off-topic. "WordPress Answers" simply does not convey sufficiently that the site is intended for developers and administrators, asking appropriately scoped questions. — Chip Bennett 12 secs ago

toscho

@kaiser a comment? no

kaiser

@toscho not the comment. The ~~question~~ discussion as whole :)

toscho

15:22

It is already in the Community Bulletin box

kaiser

Thought it might deserve more attention that that.

toscho

as far as I know, we can only add events to the top bar now, something with a fixed end date

kaiser

And what exactly has a fixed end date? I guess questions don't have that...

toscho

indeed

mod elections for example

Howdy_McGee

16:12

are Plugin Recommendation questions allowed on the stack? I'm trying to find a better gallery plugin (like better than the default gallery shortcode) but all I can find are gallery slider type deals.

toscho

@Howdy_McGee No, these are shopping questions

Try the WordPress group on Google+ or wordpress.org forums.

Chip Bennett

Does StackOverflow intentionally keep the interesting WordPress questions (that would be in scope for WPSE), while migrating this garbage?

0

Q: Copied wordpress template page not working

I have a WordPress theme with multiply template pages Default, Blog, Contact & Portfolio. I have copied the Portfolio page and edited to create a new page template I have changed the Template Name in the php file from Portfolio to Homepage as below so i can customise the portfolio for the homepa...

Rarst

@ChipBennett you know they hadn't excluded WP from scope there? :)

Chip Bennett

@Rarst yes, I understand that (though I think it's stupid, counter-intuitive, and counter-productive). But they're keeping the good questions, and sending us the crap.

We're not their garbage disposal.

GhostToast

which hurts the overall community here

Rarst

16:21

and how would you suggest to resolve that? don't migrate anything? not quite an option

toscho

@Rarst better than migrating crap

Chip Bennett

@Rarst migrate good questions (by SE standards) that are in scope for WPSE, or don't migrate anything.

That question should have been closed by SO community moderation, not sent to us for cleanup

(And if you're going to try to tell me that what I'm saying isn't what they're doing, then I've got a bridge to sell you.)

Rarst

it's just a hard situation to quantify. we can't expect every mod out there to be an expert on what is good WP question.

GhostToast

how about migrate everything?

Rarst

@GhostToast they refused

toscho

16:24

that question is crap, even if you don’t know anything about WP

Chip Bennett

@Rarst have they migrated any good questions? Any at all? Because the only ones I remember seeing are garbage similar to that one.

toscho

@GhostToast Noo

Chip Bennett

Is there a way to see all questions migrated from SO to WPSE?

Found it: wordpress.stackexchange.com/tools?tab=migrated&daterange=

GhostToast

how come on this question, the user's name is grayed out and not a link?

the migrated question in question

Chip Bennett

@GhostToast user isn't a member of WPSE

kaiser

17:11

> Q: Why did the developer leave the restaurant?

GhostToast

> A: He couldn't stand the table layout

kaiser

jes

Sisir

17:27

what is the logic sequence for meta query? meta_key meta_compare meta_value? or meta_value meta_compare meta_key?

Wyck

key, value, compare

submitted a pull request on a github repo that completely overwrites the original codebase, it doesn't feel like collaboration..

kaiser

@Wyck to WP?

Wyck

@kaiser no to the sublime text wordpress plugin

I just deleted all the code and submitted my own, lol

requested by them since they don't want to muddy up the plugin repo, no idea if the maintainer will merge it

kinda lame to be honest the original maintainer didn't even write the parser, copied the code from another repo and doesn't update it

Sisir

take a look at this gist. Am I doing it wrong as it doesn't put any post from db. ( there is a post that has meta value set to 0). don't want to create a Q because I must doing something silly.

kaiser

17:48

@Sisir Take a look at that.

Sisir

@kaiser good one!

kaiser

And, @Sisir - as this search revealed - there's already an answer to your question.

Sisir

mine is more simple. should be enough with just comparing meta value with given unix time value

Stephen Harris

@kaiser programmer joke: !false. It's funny because its true.

2

kaiser

18:04

@Sisir if it doesn't work, then it's not simpler, just not working :) And if it works: Add it as answer and share your knowledge.

Stack Exchange

18:24

Blog - Stack Exchange: Podcast #53 – Let’s Go Rio

Alex Miller on October 28, 2013

Welcome to Stack Exchange Podcast #53 with special guest Gabe Koscky, our new Brazilian community manager, and usual suspects Jay Hanlon, Joel Spolsky, and David Fullerton. Today’s show is brought to you by the National Security Administration!

Site Milestones: We launched Astronomy, which is not the same thing as the Space Exploration site we’d previously launched. You can ask questions about gravity (the force) on Astronomy. You cannot ask questions about Gravity (the movie). Astronomy and Physics have a lot of overlap, and that’s okay! Also, you can’t say Count Dooku in Portuguese. This is an adult-only podcast. …

kaiser

18:49

in PHP on Stack Overflow Chat, 22 mins ago, by MackieeE

Yay.. My first gold badge.. shame it's the one that's rewarded for most ignored.. !

GhostToast

unsung hero?

i worked hard to get that one

Rarst

I never got that one :\

GhostToast

@Rarst and now you never shall

Rarst

:(((

GhostToast

but on the bright side, this isn't pokemon. you don't have to 'catch them all' :)

Rarst

18:57

what else there is to life?

kaiser

Since years I'm trying to get some review moderation gold badges, but @toscho works extremely hard on denying us the access to them.

in PHP on Stack Overflow Chat, 1 hour ago, by Sweetie Belle

@GhostToast pokemon

GhostToast

i wonder who this is twitter.com/pixelplow/status/394900424924200960

kaiser

Now, who's the one grabbing http://wpfavela.com and building a repo of all that #WordPress ghetto code out their?

Tweeted by unserkaiser on October 28, 2013 at 7:00 PM

Chip Bennett

Okay, I just posted a "definitive" question/answer for custom loop pagination:

0

A: How to fix pagination for custom query loops?

The Problem By default, in any given context, WordPress uses the main query to determine pagination. The main query object is stored in the $wp_query global, which is also used to output the main query loop: if ( have_posts() ) : while ( have_posts() ) : the_post(); When you use a custom quer...

Feel free to embellish. As soon as I can accept my own answer, I'll start suggesting other question be marked as duplicates of this one.

Rarst

the question is a little laconic

GhostToast

19:03

i think in that way it is generic for future use

Rarst

I would stress somewhere in very large and bold letters that this is only for completely custom loops

lkraav

@Rarst is sancho's wp-less supposed to work with your theme switcher?

Rarst

as in not for custom loops, trying to override normal one

@lkraav I have no remote idea, doesn't it?

lkraav

i'm finding that master theme less changes are getting shown over the theme-switched theme's

it's strange. just discovered it

Rarst

o_0

lkraav

19:06

i'm wondering if it's some sort of a race thing. if the cache file is always named theme.css for all branches

kaiser

@ChipBennett please show your research and your efforts :D

Rarst

@anu twitter chatter is WCEU videos might start going up around Friday

lkraav

github.com/sanchothefat/wp-less/issues/43

mehh

Rarst

wasntme winning

GhostToast

just went on big twitter following binge

if i missed anyone and you feel sad, feel free to add me and i'll add you. or however that stuff works: @_ghosttoast

Rarst

19:13

don't forget to tweet in november, although you did twice in august so that might be too much

GhostToast

i got more tweets than @ChipBennett at least

Rarst

I cannot follow Chip, it's too football

2

GhostToast

i had no idea starred comments ended up on twitter

kaiser

@Rarst always thought it's Baseball, but sadly I have to agree.

GhostToast

egg

Chip Bennett

19:23

@Rarst when overriding the main query correctly - i.e. via pre_get_posts, there are no pagination issues :)

Rarst

but I am afraid that people doing that going to take your post as solution

Chip Bennett

@kaiser no worries, guys. I use Twitter the way I want - which means lots of football during the season. So no offense if you don't follow. :)

@Rarst yep, that's a possibility. It would require completely misreading the question. And I don't think cluttering the answer with not-applicable stuff would be beneficial.

Rarst

I have full confidence in people completely misreading the question :)

GhostToast

Intermittent DNS problems can happy for a number of reasons, but check this first: http://gtrkb.com/X

Tweeted by hostgator on October 28, 2013 at 6:04 PM

No Hostgator. This never "can happy".

Chip Bennett

@Rarst I will, however, add in a mention/link regarding query_posts() dying in a fire

GhostToast

19:34

@ChipBennett we are also homeschooling our kids right now

3 and 5 yrs

kaiser

@GhostToast genius!

@ChipBennett you should really very closely, but short explain in your question to which cases that applies.

lkraav

@Rarst solved gist.github.com/lkraav/7203211

Chip Bennett

@GhostToast right behind us! (6 and almost 5)

@kaiser done

kaiser

20:11

-1

Q: I cannot change the background image on my iTheme 2 theme

I've recently created a blog (http://ackorfes.wordpress.com) and i've got a problem.I want to change the background image and upload a picture of my own.I go to "customize" ,then "BG image" and i've uploaded the picture which i want to set as background.Finally,i save my changes and it shows me t...

theme-customizer custom-background

User gets award for "Crap question of the day" ...

GhostToast

it reads like a suspense novel

kaiser

downvote, close vote, using the whole arsenal of tools.

Rarst

20:31

PSA if you hadn't seen the post WP 3.7 broke that Jaquith's method everyone been using for excluding stuff from update checks make.wordpress.org/core/2013/10/25/… have fun!

Wyck

pretty sure that will break my plugin security site, haven't looked at code in 3 years so I''ll wait till it breaks

Rarst

imagine all those long shipped private plugins helpfully tellling clients update is now available

Wyck

informationisbeautiful.net/visualizations/million-lines-of-code lol at last one

kaiser

"Responsive" ... lightbox facepalm

GhostToast

22:25

@Wyck it is the most complicated system ever known to man. probably can also successfully launch a space shuttle

Wyck

premium plugin I bet

kaiser

Assemble.io Docs generator looks pretty kool

GhostToast

tomorrow i speak with my boss re: my two year review. going to try to push for a big raise. i'm nervous.

he is sales, so knows how to hold the upper hand in terms of monetary discussions

Wyck

I just realized that I drive by the company that built healthcare.gov all the time , always wondered what they did, thought it was all space stuff.

GhostToast

that's the problem: include('space-shuttle-core.php');

not sure why site keeps timing out

Wyck

22:33

I just clicked on the careers link on thier homepage and get this gem: cgi.njoyn.com/cgi/xweb/…

GhostToast

thank god i have Flash

Wyck

70k employees geez you would think they could build a website

kaiser

One of those days where I'd love if JavaScript has interfaces.

Wyck

23:06

is there anyway to tell svn to ignore line changes when viewing a diff, could have sworn there was a way

nm found it on stack

Wyck

23:26

this question is the winner today

0

Q: How do I add a map to my site that a visitor can drop a pin on, and then my site will know the address of the dropped pin?

How do I add a map to a WordPress site that a visitor can drop a pin on, and then my site will know the address of the dropped pin? Thank you, mike

map

Transcript for