It came to light recently that a vulnerability exists in a script used widely by WordPress Theme authors, including those by Elegant Themes, which I highly recommend.

This is an easy bug to fix, but that requires users to update their WordPress themes (not just the core installation), and we know that site maintenance is an easy thing to postpone in a busy world.

What’s the risk?

If attack.php is a hacker shell app like Alucar shell, you have access to the server with whatever priveleges the web server account has. e.g. you can read /etc/passwd

That is to say, the hacker could do anything – replace your site, mine your data, lock you out, anything. No doubt you’ve come across hijacked sites reduced to skulls and flames proclaiming ‘Hacked!’ in Russian or Brazilian?

The user reporting the vulnerability said:

My server was compromised earlier today. I tracked it down to timthumb.php and confirmed the attack script was in the timthumb cache directory.

A file containing a base64 encoded Alucar shell was uploaded, executed and the attacker used the shell to inject ads into my blog. He/she may have done a lot more damage that I’m not aware of yet.

What to do?

Verify your automated backup system, and keep your WordPress installation, your plugins and your themes updated!

Thanks to Nick at ET for the swift notice. Read the original report.

Wordpress Training Melbourne

In a previous tip I mentioned using the Finder Sidebar for speeding up your workflow, but since the 10.6.7 update, the behaviour of the Finder Sidebar has changed.

Where we used to be able to simply drag an item out, in 10.6.7 the item simply snaps back to the sidebar (or ‘shelf’, as some call it).

Solutions

• Hold Command whilst dragging items out of the Finder Sidebar
• Right Click the item you want to remove, and select ‘Remove from Sidebar’

Unfortunately, there’s no mention of this in the OSX 10.6.7 changelog.

Bonus tip: You might like to seperate items in the list – there’s a handy method documented at Finder Sidebar Separators.

Wordpress Training Melbourne

Finally!  I’ve managed to get a satisfying development environment for WordPress on my local machine! I’ve had a semi-operational setup for a few years, but have just managed to meet all my needs!

I’m using XAMPP on Mac OSX to design my WordPress themes, and now my setup features:

• a sensible, unique hostname for my local site (eg. memelab.dev)
• prettylinks using url rewrite
• functioning WordPress and plugin updates
• a wp-config.php edit which eliminates the need to edit the database when uploading the site to the production server

Installation

Install XAMPP and WordPress.

This is pretty straight forward, but for the sake of completeness, I’ll mention this comprehensive guide from Six Revisions (which I haven’t examined too closely, but looks solid).

Configure prettylinks

I found that my prettylinks failed when I initially installed… I think this is fixed in later versions of XAMPP.  I’m running XAMPP 1.7.3, and I don’t recall needing to do anything on since upgrading, but if you’re having trouble, you may need to edit some config files.  You can open them in TextEdit.app if you don’t have a favourite editor (I love TextMate) by adapting the following:

sudo open -e “/Applications/XAMPP/etc/httpd.conf”

You may need to:

Enable URL rewrite) by opening xampp/xamppfiles/etc/httpd.conf and deleting the hash/pound sign at the front of the line to uncomment:
LoadModule rewrite_module modules/mod_rewrite.so
Fixing Permalink problems

When I intially had trouble (several years ago I think) the post which helped me out was:

“…Clean URLs do not work out of the box on XAMPP 1.5.x with PHP4 due to a problem in Apache’s module load order…
“Clean URL support in XAMPP

Bottom line – its working a charm now!

Configure local servers

To access your local site at an address like http://memelab.dev/, you’ll need to configure XAMPP.  XAMPP stores its virtual hosts configuration in a separate file called httpd-vhosts.conf, which is not actually used by default, so:

1. In /xampp/xamppfiles/etc/httpd.conf uncomment the line: Include /Applications/XAMPP/etc/extra/httpd-vhosts.conf
2. You can now make entries into httpd-vhosts.conf.  There is an example in there – adapt it to your needs!
3. Enter your hostname into /etc/hosts like so:
   127.0.0.1 yoursite.dev
   (Your hosts file is not visible in finder, and needs to be edited with admin privileges, so open the terminal and paste:
   sudo Open /Applications/TextEdit.app /etc/hosts
4. Reload apache, and you’re done! (XAMPP control > Modules > Restart Apache).

I adapted my solution from a post in the WordPress Codex.

Enable WordPress updates whilst using XAMPP

This is the breakthrough which has prompted this post, thanks to Ian at messaliberty.com.  If you’ve come this far, you’ll have no trouble returning to /xampp/xamppfiles/etc/httpd.conf and replacing

User nobody
Group admin

with:

User yourusername
Group staff

You can find more detailed instructions at the source:

edit the XAMPP apache config file to run it as your local user.
How to fix WordPress automatic upgrades and plugin installs on XAMPP

(And make sure that LittleSnitch, if you use it, is allowing httpd to access wordpress.org)

Tweak wp-config.php

Ordinarily, migrating your database to your local installation, and vice-versa requires that you the WordPress database – in particular the WP_HOME and WP_SITEURL.  Ian at messaliberty.com again has a solution!  This is working well for me:

“set-up the wp-config.php to check to see if it is a local server, if it is then set the configuration one way, otherwise set it using the production values”
create a single wp-config file for local and remote WordPress development

A bonus tip on whilst we’re here – Joost has offered this addition:

“a quick hack I do in almost all WordPress installs I manage, that allows me to quickly switch on debug mode when needed”
Joost – Simple WordPress debuggin

Next recommendation from me: use some versioning software – I use Versions.app, which is a simple SVN client for the mac.

Wordpress Training Melbourne

If there’s one thing that annoys me, its trawling through a Save As dialog box in order to save the file to an appropriate location.

Save time with three simple but rarely mentioned strategies which can take the pain out of filing your documents.

Save it to a temporary location

Of course the desktop is the obvious choice here, particularly because you can hit Cmd-D to use the system-wide shortcut for selecting the Desktop as the save location.

Then you can do a cleanup at the end of the session, or use the tips below to tidy-up as you go.

This make saving a two step process, but doesn’t require you to navigate throught the awkward Save As dialog.  The Save As dialog will remember the last place you saved a document, so if you always save to an accessible temporary location, the whole caper is a lot simpler.

I prefer to keep the Desktop really clean, so I keep my unprocessed files in my Temp folder, which I’ve created in Documents, and lodged in Finder’s sidebar (see below!).

Create a Sidebar Alias in Finder

This is a great method to implement anytime you’re going to be working on a project for more than half an hour!   Because the chances are you’ve already got a Finder window open showing your project’s files. You can drag any folder into the Finder sidebar and it will show up in all dialog boxes system-wide.

• Simply navigate to the desired folder, and drag its icon over the sidebar
• Watch for the Insertion bar to show, then drop the folder.  Presto!
• To remove the icon from the sidebar, simply drag it out; it will disappear with a ‘puff’.

This process creates an alias, or shortcut of the folder, meaning that the actual location of the folder remains unchanged, and removing the alias from the sidebar won’t delete any files!

Just make sure that you drop the folder when you see the insertion bar; if you drop it when you’re hovering over another folder in the sidebar, you’ll end up moving the folder.  If this happens, don’t worry, Edit > Undo (Cmd-Z) is your friend.

Update: Finder Sidebar behaviour changed in 10.6.7: now you need to hold COmmand whilst dragging an item out: read more.

Drag the document directly from the application

Here are some nice ninja tricks which don’t require you to do any setup..

Little known fact for you: applications’ title bars are often clickable!  You can Cmd Click on a filename to see where it is located in the folder hierachy on your drive.  You can also drag the icon next to the filename in order to move (or copy, or create an alias/shortcut) the file.  This is true of Finder, Word and Office apps, Preview and many others, but may not be relevant for apps like Photoshop, which may change the default mac interface, and Thunderbird which are not dealing with actual files.

To make use of this gem, simply

• click and drag the icon, but don’t release the mouse button, or
• switch to a Finder window and drop the file directly into place.

There are a raft of options here: you could:

• Open a Finder window to the correct location in advance, ready to receive the file using
  • Exposé hit F9 (you may need to hold the Fn key depending on your keyboard) and drag the file onto the Finder window
  • Hit Cmd-Tab to switch to Finder.
    This is my usual tactic (my greatest peeve is that Finder does not permit you to switch between its various windows using Cmd~)
• Use the ‘spring-loaded’ functionality of Finder to navigate through your file system.)
  • Hover over the each waypoint briefly and wait for that location to open, then hover over the next step.
  • Whilst dragging you can hit the spacebar to immediately open a folder.
    Sounds complicated, but in practice it can be really quick!

Mix and Match!

Well, that just touches on some component skills which you can combine to shape your own workflow.  I find that file management becomes like driving: it’s second nature in your own car, but driving someone elses system can feel like navigating a tractor!

If you’ve got a tip to add to the lost, drop me a line in the comments!  If there’s enough interest, I’ll have an excuse to do a screen cast of these techniques

Wordpress Training Melbourne

This is the next installment in the Photoshop Precision series: how to cut the guesswork out of scaling and positioning your images.

You can postion and scale objects precisely using the transform toolbar, which runs along the top of the screen if it is set to visible.

To show it, you must be in transform mode (Command-T [Mac] or Control-T [PC] or Edit > Free Transform), and the options must visible (Window > Options).

Positioning an object exactly

In the first of the following screenshot,

• I’ve shifted the Ruler Origin to 20,20, then
• I’ve gone into transform mode and set the anchor point to top left (by clicking the top left box in the grid of nine boxes at the top left of the screenshot).
• You can then type the offset from the Ruler Origin into the X and Y boxes.  If you knew that you needed to shift the object 23 pixels down and 17 across, you could enter ‘relative’ mode by clicking the triangle between X and Y.

Scaling with precision

Here, I’m transforming the circle using the Width and Height controls to resize my circle.  Note that the units displayed can be changed by typing them in.  You can even have a mix on units!  Here I’m using percentage and Pixels, which is just a gimmick .  Clicking the chain icon here is useful to ensure that aspect ratio is locked, and your object doesn’t get squashed.

You can also finetune the rotation and skew of the object using the transform toolbar, but I’m sure you’ve fugured that out already!  That’s it for today; let me know if you’ve got something to add by leaving a comment!

Wordpress Training Melbourne