Posts Tagged wordpress
Drupal migration
Posted by visual77 in programming on August 30, 2011
In the past 6 months, I’ve been using Drupal quite a bit and have made the decision to migrate my site from WordPress to Drupal. I’m more familiar with Drupal 6.x than Drupal 7.x right now, but I can easily change that. The decision to migrate really came to a head when I made my last post about the statepicker module and realized I have no ability to show off this module on my own site. Not only is this site running software that isn’t Drupal, but WordPress is a platform that I don’t foresee myself spending much time in its development community.
My time with Drupal has really changed my opinion of it from ‘meh’ to semi-awestruck. The main point that I keep thinking about is that I have yet needed to hack in any changes to Drupal. Every module I’ve written and every customization I’ve done has been neatly tucked into the sites folder, where custom content is intended to be handled. Unlike the other platforms I’ve used (mostly Kohana and WordPress), I have not needed to go edit things I shouldn’t be editing to reach my desired result.
I’ll be doing the migration over the next month or so. As of right now, I just have a blank Drupal 7.7 install floating in a git repository. I have a lot of work before it’s suitable to replace this WordPress build.
Debugging is a hell of a drug
Posted by visual77 in programming on July 18, 2009
Lately, I’ve been spending some time on the WordPress support forums just helping debug issues. I don’t really know much about WordPress, but nothing makes you learn the ins and outs of a system like isolating and fixing bugs. I set up a new WordPress site on one of my virtual machines just to do these tests. If I trash it too much while debugging, I can always just scrap and start over and get myself cleaned up again.
While setting up this new WordPress site, I somehow managed to trigger the no credentials updating system that visual77.com and septuro.com use, but I’m not sure how I did that. Whenever you update or install a plugin, it often asks for FTP / SSH credentials to transfer the data, but neither visual77.com nor septuro.com require credentials. Every other WordPress site I have set up does require credentials – but this test bed does not. It may be a permissions issue, and since this test site is 0777 for everything, I have sufficient permissions. I’d never set a live site to 0777 for everything, but since it is on a virtual machine that is inaccessible outside of my network, it’s safe to do that.
I’m having a good time on the WordPress support forums with these bugs – anything I can replicate, I can fix. Much of my early PHP days was just based on trying to make small tweaks to PHPNuke, and that helped me learn much more rapidly than some boring tutorials or bullshit code exercises. I learn by doing, and doing stuff on fully built systems is my favorite way to understand the system. At this rate, I’ll know WordPress as well as the creators within a month and I can start debugging WordPress core bugs.
A fix for the WordPress Sociable plugin Method Not Implemented error!
Posted by visual77 in programming on June 4, 2009
In my last post, I mentioned I was hitting an error in my WordPress installation where anytime I tried to save the Sociable settings, I got this error:
Method Not Implemented POST to /wp-admin/options-general.php not supported.
I dug around a bit further, looking into the error logs on my Apache server and I found this…
[Thu Jun 04 09:48:15 2009] [error] [client ***.***.***.***] ModSecurity: Access denied with code 501 (phase 2). Pattern match "(?:\\b(?:(?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe)|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo\\b\\W*?\\by+)\\b|c(?:md(?:(?:32)?\\.exe\\b|\\b\\W*?\\/c)|d(?:\\b\\W*?[\\\\/]|\\W*?\\.\\.)|hmod.{0,40}? ..." at ARGS:site_order. [id "950006"] [msg "System Command Injection. Matched signature <|ping>"] [severity "CRITICAL"] [hostname "*********"] [uri "/wp-admin/options-general.php?page=Sociable"]
That’s a pretty big error, but the important things are:
- ModSecurity – this is a security error, not a technical error. It spotted something it doesn’t like.
- Pattern match – that is a big regex. I didn’t want to reverse engineer it (and luckily, I didn’t have to do that), but if it came to it, I would’ve figured what it was seeking.
- System Command Injection – the server thought it saw an injection attack and blocked it outright.
Basically, when the Sociable form is sent through post data, some part of the information sent is flagged as a potential injection, and the server rejects the data outright. I saved the sociable page to my computer and set up a .php file to dump post data, then I sent the form to that page. This was so I could see what the post data looked like. This is what I got, after unchecking all of the checkboxes and clearing all text fields:
Array
(
[_wpnonce] => c05fbc3c51
[_wp_http_referer] => /wp-admin/options-general.php?page=Sociable
[site_order] => BarraPunto|Bitacoras.com|BlinkList|BlogMemes Fr|BlogMemes Sp|blogmarks|Blogosphere News|blogtercimlap|Faves|co.mments|connotea|Current|del.icio.us|Design Float|Digg|Diigo|DotNetKicks|DZone|eKudos|email|Facebook|Fark|Fleck|FriendFeed|FSDaily|Global Grind|Google|Gwar|Haohao|HealthRanker|HelloTxt|Hemidemi|Identi.ca|IndianPad|Internetmedia|Kirtsy|laaik.it|LinkArena|LinkaGoGo|LinkedIn|Linkter|Live|Meneame|MisterWong|MisterWong.DE|Mixx|muti|MyShare|MySpace|MSNReporter|N4G|Netvibes|NewsVine|Netvouz|NuJIJ|Ping.fm|ppnow|PDF|Print|Propeller|Ratimarks|Rec6|Reddit|RSS|Scoopeo|Segnalo|Simpy|Slashdot|Socialogs|SphereIt|Sphinn|StumbleUpon|Symbaloo|Technorati|ThisNext|Tipd|TwitThis|Upnews|Webnews.de|Webride|Wikio|Wikio FR|Wikio IT|Wists|Wykop|Xerpi|YahooBuzz|Yahoo! Bookmarks|Yigg
[tagline] =>
[imagedir] =>
[save] => Save Changes
)
Whoa! What is that site_order thing in there? That’s a pretty weird looking block of text. Weird enough that it might just be flagged as injection. I started hunting down where that comes from, and identified it in /wp-content/plugins/sociable/sociable.php and removed it. After removing that line, the error stopped showing up! I can no longer change the site order of the social sites, but that’s a small price to pay for being able to save my settings!
To fix this error:
- Open /wp-content/plugins/sociable/sociable.php
- Find the line that looks like this (it was line 855 for me)
<input type="hidden" id="site_order" name="site_order" value="<?php echo join('|', array_keys($sociable_known_sites)) ?>" /> - Delete it!
- Save the file.
That is it. You lose the ability to reorder the sites, but you get past the error. Some apache servers apparently see this post data as an injection attempt and block it, so we just remove this line and it no longer sees this injection attempt.