A curious case of "you are not allowed" in WordPress

Register a custom taxonomy. Everything looks great, except for one "tiny" problem: any attempt to Add New results in immediate "You are not allowed" message!

Blame Yoast, of course! :)
He suggested "is_admin, but not DOING_AJAX". So, the "register taxonomy" was hooked on "not AJAX". Oooooopsi!

Re-hooked. Ta-da!

WordPress security : disallow author query

Friday afternoon. Looking at the access log... here are some "nice" requests. Happened at the same millisecond, and look very "hack-ish" to me.

54.80.2.64 - - [16/Oct/2015:18:46:25 +0000] "HEAD /?author=5 HTTP/1.1" 404 159 "-" "-"
54.80.2.64 - - [16/Oct/2015:18:46:25 +0000] "HEAD /?author=1 HTTP/1.1" 404 159 "-" "-"
54.80.2.64 - - [16/Oct/2015:18:46:25 +0000] "HEAD /?author=3 HTTP/1.1" 404 159 "-" "-"
54.80.2.64 - - [16/Oct/2015:18:46:25 +0000] "HEAD /?author=2 HTTP/1.1" 404 159 "-" "-"
54.80.2.64 - - [16/Oct/2015:18:46:25 +0000] "HEAD /?author=4 HTTP/1.1" 404 159 "-" "-"

Well, they all resulted in 404 Page not found...

...because I have this in .htaccess:

# - Do not allow author query to avoid real names exposure
RewriteCond %{QUERY_STRING} ^author=\d+
RewriteRule ^ - [R=404,L]

It's that simple. :)

WPGlobus multilingual plugin (Checking Facebook post embedding....)

WPGlobus will work with any WordPress theme. Some configuration is required to translate the theme options.
Posted by WPGlobus on Monday, September 28, 2015

Notes:

1. Do not need this:
<div id="fb-root"></div>
Facebook perfectly works without, and having multiple DIVs with the same id is wrong. So, just remove.

2. To see what's embedded, must not be logged to FB as a page, only as a person.

3. Do not expect any links from it. It's JS, iframe, etc. Link in the post: www.wpglobus.com - multilingual plugin for WordPress

PHPStorm: mark a single file as excluded

PHPStorm allows to mark a folder as "Excluded" (Go to Project view, right-click on a folder and choose "Mark Directory as... Excluded". Then, all the files in that folder will be ignored by the PHPStorm when it looks for functions, constants, etc. So, for example, if you have an older versions of a library, in "archive" folder, you can exclude it, and Code Inspection will not refer to those older method definitions, constants, etc.

But what if you need to exclude just a single file? The only way I found was to mark it as a plain text:



It's particularly useful for WordPress projects: those two files

wp-admin/load-scripts.php
wp-admin/load-styles.php

have tons of "dummy" methods:

/**
* @ignore
*/
function add_filter() {}

- with no parameters or bodies. PHPStorm finds them, considers no params and a void return and issues useless inspection errors.

UPDATE:
There is an alternative solution, suggested by Slava Abakumov: add the file(s) to the Settings->Editor->File Types->Ignore...
The drawback is that the file disappears completely from the Project view, and even by typing its name, you won't be able to find it. Ignored completely. This can be quite inconvenient if you want to ignore a file, but still be able to edit it.




--------
A Pro-tip from the creators of WPGlobus Multilingual Plugin for WordPress

makepot.php for single textdomain only

Here is a patch to the entry.php file that allows to ignore all strings that are not from a single textdomain.
Ugly. Hard-coded. Enjoy :)

WooCommerce: SQL to fix sorting by date

In one of the projects, I needed to import a product data from a non-WP website to WooCommerce.

After importing, the "Sort by newness" did not work correctly, because the post dates were all the same.

A simple SQL solved my problem:

WordPress Tip: Export WooCommerce category list (SQL, CSV, Excel)

Run this SQL in phpMyAdmin, and then click Export link at the bottom to save as CSV for Excel or other format.

Note: tested only on one level of subcategories.

Gist revisions are welcome: https://gist.github.com/tivnet/d9cca4a4f4cfebe143bc

Making a WordPress.org plugin: SVN, GitHub, PHPUnit and Travis-CI [Part 1]

This is my first experiment to publish an open-source code. It was quite a "challenge", after years of working exclusively for corporate clients and myself, to write something that can go to "the wild" :-))

WordPress version:
http://wordpress.org/plugins/tivwp-dm-development-manager/
GitHub version:
https://github.com/TIVWP/tivwp-dm

Here is a shortened list of what's involved in making a public plugin and publish it on WordPress.org site:

• Write a bullet-proof PHP code (mission impossible, but approach as close as you can)
• Organize the code in a special way: names of the files, folders, special headers, screenshots, readme.txt and so on.
  
• Place your plugin somewhere so that WordPress staff can check it out and approve. (Hint: GitHub is a good place for that)
• Apply here: http://wordpress.org/plugins/add/. Note: the name of your plugin will become it's "slug" in the URL, so choose carefully!
• Wait for the approval, and if you never used SVN before, take this time to learn the basics.
• SVN-Commit your code once approved.
• Wait for reviews and support request.............. :-)

Notes:

• Folders structure and readme.md on GitHub are not exactly the same as on WordPress.org
• You can setup Travis-CI calling PHPUnit to test your code automatically. It's not an easy thing to setup - but highly recommended.

To Read:

https://codex.wordpress.org/Plugin_Submission_and_Promotion

http://code.tutsplus.com/articles/how-to-publish-to-the-wordpress-plugin-repository--wp-20637

I'll try to find time and write more details [Part 2,3,...] soon.

WordPress: How to exclude plugin/theme files from Poedit catalog

► The Problem:

I use some third-party files in my WordPress plugin (or theme). When I run Poedit to built language files, it scans the main plugin folder and puts all text strings found in the .po file, including those from the third-party.

► The Solution?

Vaclav Slavik, the author of Poedit, placed a "wontfix" resolution on that, years ago. See http://www.poedit.net/trac/ticket/359 and http://www.poedit.net/trac/ticket/253.

So, there is no official solution to this.

► So, what to do?

Separate the 3rd party files from yours.

For example, put all your .php files into the "includes" folder, and 3rd party files - into the "vendor" folder. Then, in Poedit -> Catalog -> Properties -> Sources paths tab, instead of the "." (current folder), write "includes".

Poedit will scan only the "includes" and will ignore the "vendor" folder.

List of Front and Admin WordPress Actions

Below is a list of core WordPress actions as of WP-3.9-beta1.
I obtained this list by printing the $tag parameter in both do_action() and do_action_ref_array() functions while running a front page and an admin page.
This list cannot be considered complete. Please use it for quick reference only.

Link to the spreadsheet on Google Drive:
https://docs.google.com/spreadsheets/d/1-84REYUiT2bBREDV_d_m0skwEstvs-ANAWN3UumePV4/edit?usp=sharing

"An error occurred in the upload..." (WordPress Media)

Seeing "An error occurred in the upload..." message when calling WP Media interface on the front?

I believe, that's a core problem, but here is a workaround that I am using quite often in my projects.

Admins won't have this bug, but regular users - will. Because we are on a page, which $post was not created by this regular user, so he does not have the editing capabilities... and Media needs them.

// Preserve the current Post
// (just in case, you may not need it)
$oldPost = $GLOBALS['post'];
// Make it a dummy
$GLOBALS['post'] = 0;

// For example, the editor, with "Media" button:
wp_editor($content, $editor_id, $settings);
// Or "Upload Avatar" code from the WPUA plugin
do_action( 'show_user_profile', $current_user );

// Restore
$GLOBALS['post'] = $oldPost;

// Be happy

A Nostradamus Prophecy might speak about WordPress?

Years will pass quickly
Causing great tremors around the City of Matteus.
The Core will move at the speed of light,
And then Two Numbers will match


/**
 * The WordPress version string
 *
 * @global string $wp_version
 */

$wp_version = '3.8-beta-1';

/**

 * Holds the required PHP version

 *

 * @global string $required_php_version

 */

$required_php_version = '5.2.4';

WordPress: remove admin menu items

There are several well-written WordPress plugins that allow removing and re-ordering admin menu items. However, if you want something quick and simple for your site, the code snippet below may be useful. It removes all menus, except for Dashboard and WooCommerce "Products".

Feel free to modify is as necessary.

► Tip: you can print_r($menu) to see what to keep.

add_action('admin_menu', function () {
 if (current_user_can('administrator')) {
  return;
 }

 /**
  * Keep only specific menu items and remove all others
  */
 global $menu;
 $hMenu = $menu;
 foreach ($hMenu as $nMenuIndex => $hMenuItem) {
  if (in_array($hMenuItem[2], array(
       'index.php',
       'edit.php?post_type=product',
      ))
  ) {
   continue;
  }
  unset($menu[$nMenuIndex]);
 }
}

2 Great Articles on Custom Post Types in WordPress

By Justin Tadlock:
http://justintadlock.com/archives/2010/04/29/custom-post-types-in-wordpress

In WordPress 3.0, we’ll have the capability to easily create and manage content via custom post types. Not only that, but you won’t have to rely on a plugin to do this for you. It can be done via your theme’s functions.php file with a few lines of code.

By Richard Shepherd:
http://blog.teamtreehouse.com/create-your-first-wordpress-custom-post-type

...I think the great thing about WordPress is we can use it in the way we feel it should be used. There might be a different or better way, but there is no wrong way to do something (unless it doesn’t work!).

► Both articles provide a great introduction to the custom post types, with detailed PHP code examples. Custom types allow to associate additional information (fields) with a specific group of WordPress posts, and distinguish those posts from others in the admin interface. Having them, it's possible to extend WordPress to a powerful dabatase application.

Thesis 2.0 multisite CSS (thesis_do=css)

Note: this is a quick patch to Thesis 2.0.1, not optimized, not approved by the Thesis authors and not tested thoroughly.

Problem:

In the WPMU environment, Thesis CSS link looks like:

...?thesis_do=css&ref=...

instead of "normal" link to a .css file

Details:

The code responsible for that resides in the lib/core/skin/box.php, in class class thesis_stylesheets_link :

'url' => !is_multisite() ? THESIS_USER_SKIN_URL . '/css.css' : site_url("?thesis_do=css&ref=". THESIS_MS_CSS_VAL . time()),

Note that the time() call at the end makes this link not cacheable.

The patch:

1. In the box.php:

public function html() {
global $wpdb;
$styles = $links = array();
$styles['layout'] = array(

'url' => THESIS_USER_SKIN_URL . '/css' . (is_multisite() ? $wpdb->blogid : '') . '.css',

2. In lib/core/skin/css.php

public function write($skin, $custom) {
global $wpdb;
$css = $this->reset() . $this->update(apply_filters('thesis_css', $skin), $custom);
$css = strip_tags($css);
if (is_multisite()) {
update_option('thesis_raw_css', $css);
wp_cache_flush();
$lid = @fopen(THESIS_USER_SKIN . '/css' . $wpdb->blogid . '.css', 'w');
@fwrite($lid, trim($css));
@fclose($lid); 
}

Is WordPress good for building sites? A SEO Group discussion on LinkedIn

This is an excerpt from discussion on the Search Engine Land’s LinkedIn group:
http://lnkd.in/gigffm - copied almost as-is (fixed a couple of typos)

►LP: I found this article to be a good read:
http://biztwozero.com/Home/6181

► My reply
---------------
@LP: I am with you on this (PHP, etc.), and I already expressed my opinion about the quality of PHP code in WordPress and potential security risks - in other discussions (look for my recent posts).

However, do not take that specific article as a 100% truth. While correct in general, many specific details are not.

Why don't you just try for yourself? Installing WP takes literally 5 minutes, as long as you have Apache/MySQL/PHP at your disposal. MySQL can be anywhere, of course, and you can specify the remote host. Apache and PHP can be at your PC, so you can easily play with the themes, plugins and the core code - as a PHP programmer and not as a WP user. You will see everything.
The question is, however, what is your goal and what do you compare WP with? If you are building a "non-mission-critical" website, who cares that WP will throw PHP notices on every line of its lousy code? Disable all errors and sleep well :-)

If you compare to other open-source CMS/Blogging platforms - they will suffer more or less from the same "diseases".

If, however, you desperately need a solution for content editing, and you do not want to spend $ on a commercial - there are two ways, in my opinion: a) take WordPress, find a premium theme, which will provide you with all the functionality (that will cost $ instead of $$$) - and use ONLY that theme and only their plugins. Once you start mixing plugins from different vendors, one day you upgrade one, and it will bring down another, because they do not know each other, and write whatever they want, overriding the core functionality.

Or b) Because WP writes into MySQL table, you can use PHP to extract the content from there and publish it your way. That's similar to having a premium theme, but also allows you to put WP on a different server, solving thus some security problems (the WP can be installed even at your home, as I said)

There is a1) - write the Premium Theme yourself :-)

I tried the a) and a1) approaches since WP was born, and each time I ended up with version b) or with no WP at all....