Posts Tagged wordpress
Debugging is a hell of a drug
Posted by visual77 in programming on July 18th, 2009
Lately, I’ve been spending some time on the Wordpress support forums just helping debug issues. I don’t really know much about Wordpress, but nothing makes you learn the ins and outs of a system like isolating and fixing bugs. I set up a new Wordpress site on one of my virtual machines just to do these tests. If I trash it too much while debugging, I can always just scrap and start over and get myself cleaned up again.
While setting up this new Wordpress site, I somehow managed to trigger the no credentials updating system that visual77.com and septuro.com use, but I’m not sure how I did that. Whenever you update or install a plugin, it often asks for FTP / SSH credentials to transfer the data, but neither visual77.com nor septuro.com require credentials. Every other Wordpress site I have set up does require credentials – but this test bed does not. It may be a permissions issue, and since this test site is 0777 for everything, I have sufficient permissions. I’d never set a live site to 0777 for everything, but since it is on a virtual machine that is inaccessible outside of my network, it’s safe to do that.
I’m having a good time on the Wordpress support forums with these bugs – anything I can replicate, I can fix. Much of my early PHP days was just based on trying to make small tweaks to PHPNuke, and that helped me learn much more rapidly than some boring tutorials or bullshit code exercises. I learn by doing, and doing stuff on fully built systems is my favorite way to understand the system. At this rate, I’ll know Wordpress as well as the creators within a month and I can start debugging Wordpress core bugs.
A fix for the Wordpress Sociable plugin Method Not Implemented error!
Posted by visual77 in programming on June 4th, 2009
In my last post, I mentioned I was hitting an error in my Wordpress installation where anytime I tried to save the Sociable settings, I got this error:
Method Not Implemented POST to /wp-admin/options-general.php not supported.
I dug around a bit further, looking into the error logs on my Apache server and I found this…
[Thu Jun 04 09:48:15 2009] [error] [client ***.***.***.***] ModSecurity: Access denied with code 501 (phase 2). Pattern match "(?:\\b(?:(?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe)|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo\\b\\W*?\\by+)\\b|c(?:md(?:(?:32)?\\.exe\\b|\\b\\W*?\\/c)|d(?:\\b\\W*?[\\\\/]|\\W*?\\.\\.)|hmod.{0,40}? ..." at ARGS:site_order. [id "950006"] [msg "System Command Injection. Matched signature <|ping>"] [severity "CRITICAL"] [hostname "*********"] [uri "/wp-admin/options-general.php?page=Sociable"]
That’s a pretty big error, but the important things are:
- ModSecurity – this is a security error, not a technical error. It spotted something it doesn’t like.
- Pattern match – that is a big regex. I didn’t want to reverse engineer it (and luckily, I didn’t have to do that), but if it came to it, I would’ve figured what it was seeking.
- System Command Injection – the server thought it saw an injection attack and blocked it outright.
Basically, when the Sociable form is sent through post data, some part of the information sent is flagged as a potential injection, and the server rejects the data outright. I saved the sociable page to my computer and set up a .php file to dump post data, then I sent the form to that page. This was so I could see what the post data looked like. This is what I got, after unchecking all of the checkboxes and clearing all text fields:
Array
(
[_wpnonce] => c05fbc3c51
[_wp_http_referer] => /wp-admin/options-general.php?page=Sociable
[site_order] => BarraPunto|Bitacoras.com|BlinkList|BlogMemes Fr|BlogMemes Sp|blogmarks|Blogosphere News|blogtercimlap|Faves|co.mments|connotea|Current|del.icio.us|Design Float|Digg|Diigo|DotNetKicks|DZone|eKudos|email|Facebook|Fark|Fleck|FriendFeed|FSDaily|Global Grind|Google|Gwar|Haohao|HealthRanker|HelloTxt|Hemidemi|Identi.ca|IndianPad|Internetmedia|Kirtsy|laaik.it|LinkArena|LinkaGoGo|LinkedIn|Linkter|Live|Meneame|MisterWong|MisterWong.DE|Mixx|muti|MyShare|MySpace|MSNReporter|N4G|Netvibes|NewsVine|Netvouz|NuJIJ|Ping.fm|ppnow|PDF|Print|Propeller|Ratimarks|Rec6|Reddit|RSS|Scoopeo|Segnalo|Simpy|Slashdot|Socialogs|SphereIt|Sphinn|StumbleUpon|Symbaloo|Technorati|ThisNext|Tipd|TwitThis|Upnews|Webnews.de|Webride|Wikio|Wikio FR|Wikio IT|Wists|Wykop|Xerpi|YahooBuzz|Yahoo! Bookmarks|Yigg
[tagline] =>
[imagedir] =>
[save] => Save Changes
)
Whoa! What is that site_order thing in there? That’s a pretty weird looking block of text. Weird enough that it might just be flagged as injection. I started hunting down where that comes from, and identified it in /wp-content/plugins/sociable/sociable.php and removed it. After removing that line, the error stopped showing up! I can no longer change the site order of the social sites, but that’s a small price to pay for being able to save my settings!
To fix this error:
- Open /wp-content/plugins/sociable/sociable.php
- Find the line that looks like this (it was line 855 for me)
<input type="hidden" id="site_order" name="site_order" value="<?php echo join('|', array_keys($sociable_known_sites)) ?>" /> - Delete it!
- Save the file.
That is it. You lose the ability to reorder the sites, but you get past the error. Some apache servers apparently see this post data as an injection attempt and block it, so we just remove this line and it no longer sees this injection attempt.