Archive for the ‘Web Apps’ Category

I’ve noticed WordPress’s blog by email feature has the possibility of allowing anyone to see other email addresses. This feature can be turned on in the Admin in Settings->Writings and then Post via e-mail. Let’s say you set that email address as wordpressposts@example.com, that address will stay hidden. However anyone that emails that address will can have their address exposed on your blog by going to http://example.com/wp-mail.php (assuming that’s where you have WordPress installed at http://example.com). Chances are most people will have this set to a cron job and have it check it every so often, but it might be possible for others to request the page beforehand. And when you do go to that page, it shows something like this:

Author is myworkaddress@example.net

Author: 1

Posted title: Some Blog Post Title

Mission complete. Message 1 deleted.

Thus, if you are using your a email address you’d like to keep private and you are emailing wordpressposts@example.com, that email address has the possibility of showing up to people. Which is not good if you email from the same email address that checks the posts. And even worse if you email from a email address for a user in WordPress and has the rights to post contents because the email will get “publish” status rather than “pending” and will go live on the site. And if someone has the email address that is a user and has posting rights, they can easily send fake emails from that address, because all WordPress checks is the From or Reply-To line (whichever it finds first).

It’s easy to prevent it from showing email addresses by opening up wp-mail.php and looking for this line of code

echo '<p>' . sprintf(__('Author is %s'), $author) . '</p>';


And this line of code

echo "\n<p>" . sprintf(__('<strong>Author:</strong> %s'), esc_html($post_author)) . '</p>';


And then you could comment those lines out by putting // in front of both of them.

I understand WordPress outputs this information so you can see logged from any cron jobs you have setup or if you visit the page manually, as a way of just knowing whats going on. However, it could be done better to prevent the addresses from being shown to everyone. A simple solution is to setup a query string and have a secretkey (don’t make this your blog’s password however). For example, lets say your blog is installed at http://example.com/, we are going to know require the following URL to check Posts via e-mail http://example.com/wp-mail.php?secretkey=abc123. And if someone doesn’t send the right secretkey, it won’t check the email address or echo anything out.

So before this line of code

/** Make sure that the WordPress bootstrap has run before continuing. */


Let’s add

if ($_GET['secretkey'] != 'abc123')
exit();


Feel free to change the secretkey to whatever you wish. You can also change it to be called something other than secretkey. If you have a cron job, you’ll have to point to that new URL as well http://example.com/wp-mail.php?secretkey=abc123. If you use the secretkey method you can leave the lines where it echoes out the email address if you like (the 2 lines I showed you could comment out).

I wanted to get the most recent comments in WordPress without having to use the widgets or any plugins. When you use any of the widgets it will override the sidebar.php (although you could put what you needed in a else bracket inside sidebar.php, but I figured I’d put this hack together anyway).

This hack would go in your sidebar.php

$comment_array = $wpdb->get_results("SELECT comment_date_gmt, comment_author, comment_ID, comment_post_ID FROM $wpdb->comments WHERE comment_approved = '1' ORDER BY comment_date_gmt DESC LIMIT 10");
$comment_total = count($comment_array);
echo '<ul>';
for ($x = 0; $x < $comment_total; $x++)
{
echo '<li>';
echo $comment_array[$x]->comment_author . ' on ';
echo '<a href="'. get_permalink($comment_array[$x]->comment_post_ID) . '#comment-' . $comment_array[$x]->comment_ID . '">';
echo get_the_title($comment_array[$x]->comment_post_ID);
echo '</a>';
echo '</li>';
}
echo '</ul>'


If you’ve tried using wp_tag_cloud() as an array, you’ve noticed that all it really does is give you a string, which isn’t useful. The only way I could figure out how to get the tags to where I can format them how I want was to call get_tags() in wp-includes/category.php. You can also pass arguments to it to sort it differently. Take a look at get_terms() in wp-includes/taxonomy.php to get an idea of what you can do.

Here is a hack I put together that will output your tags as a unordered list (UL) with the total number of times the tag is used in parenthesis. You can place this code in sidebar.php

$tag_array = get_tags('orderby=count&order=DESC&number=15');
$tag_total = count($tag_array);
echo '<ul>';
for ($x = 0; $x < $tag_total; $x++)
{
echo '<li>';
echo '<a href="' . get_option('home') . '/tag/' . $tag_array[$x]->slug . '/" rel="tag">';
echo $tag_array[$x]->name;
echo '</a>';
echo ' (' . $tag_array[$x]->count . ') ';
echo '</li>';
}
echo '</ul>';