WP101

Clicking on it will reveal a series of great video tutorials from WP101 to take your through everything you need to know about WordPress! From making posts, to editing pages everything is there! It’s all taken care of by me on my side all you need to do is watch them!

Now the link that Gravity Forms generates is fairly long (mywebsite.com/wp-content/uploads/gravity_forms/reallylongstringofnumbers10239812039802193/year/month/filename) however that just isn’t secure enough for me. The worst part os they don’t seem to care.

After a week or two of searching I have found a way of securing it! The following method secures the folder in question so that only Logged in users can access them. It is also probably possible to modify this method to account for different user roles etc, but for now a little security is better than none!

Ok so we need to do 2 things.

1. Tell our website that all files in a certain directory need to be passed to a special file for processing before downloading.
2. Use our special file to check if the user is logged in!

</pre>
require_once( 'wp-load.php' );

is_user_logged_in() || auth_redirect();

$upload_dir = wp_upload_dir();
//Set your path below I am using /gravity_forms/
$basedir = $upload_dir[ 'basedir' ] . '/gravity_forms/';

$file = rtrim( $basedir, '/' ) . '/' . str_replace( '..', '', isset( $_GET[ 'file' ] ) ? $_GET[ 'file' ] : '' );
if ( ! $basedir || ! is_file( $file ) ) {
 status_header( 404 );
 die( '404 &#8212; File not found.' );
}

$mime = wp_check_filetype( $file );
if( false === $mime[ 'type' ] && function_exists( 'mime_content_type' ) )
 $mime[ 'type' ] = mime_content_type( $file );

if( $mime[ 'type' ] )
 $mimetype = $mime[ 'type' ];
else
 $mimetype = 'image/' . substr( $file, strrpos( $file, '.' ) + 1 );

header( 'Content-Type: ' . $mimetype ); // always send this
if ( false === strpos( $_SERVER['SERVER_SOFTWARE'], 'Microsoft-IIS' ) )
 header( 'Content-Length: ' . filesize( $file ) );

$last_modified = gmdate( 'D, d M Y H:i:s', filemtime( $file ) );
$etag = '"' . md5( $last_modified ) . '"';
header( "Last-Modified: $last_modified GMT" );
header( 'ETag: ' . $etag );
header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', time() + 100000000 ) . ' GMT' );

// Support for Conditional GET
$client_etag = isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) ? stripslashes( $_SERVER['HTTP_IF_NONE_MATCH'] ) : false;

if( ! isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) )
 $_SERVER['HTTP_IF_MODIFIED_SINCE'] = false;

$client_last_modified = trim( $_SERVER['HTTP_IF_MODIFIED_SINCE'] );
// If string is empty, return 0. If not, attempt to parse into a timestamp
$client_modified_timestamp = $client_last_modified ? strtotime( $client_last_modified ) : 0;

// Make a timestamp for our most recent modification...
$modified_timestamp = strtotime($last_modified);

if ( ( $client_last_modified && $client_etag )
 ? ( ( $client_modified_timestamp >= $modified_timestamp) && ( $client_etag == $etag ) )
 : ( ( $client_modified_timestamp >= $modified_timestamp) || ( $client_etag == $etag ) )
 ) {
 status_header( 304 );
 exit;
}

// If we made it this far, just serve the file
readfile( $file );

#Gravity Forms Upload Protection
RewriteCond %{REQUEST_FILENAME} -s
RewriteRule ^wp-content/uploads/gravity_forms/(.*)$ dl-file.php?file=$1 [QSA,L]

Version 1.2.1 firstly includes a fix for the login page logo. This wasn’t working due to me using an incorrect hook. Silly mistake but has been identified and fixed!

Also I have added image upload abilities for the options page. This means that now instead of having to paste in a URL for your images you want to use you can simply hook directly into the WordPress media uploader and do it all from the same page!

You can check it out on the WordPress Plugin Repo or grab the latest development version on my Github Page.

This update simply adds one new feature.

The ability to change your WordPress from name and email address for emails sent by the website! Pretty sweet I think!

http://wordpress.org/extend/plugins/the-mojo-admin-toolbox/

Features

• Remove/Hide the WordPress Comments system, never confuse your client again!
• Easily customise the Login Page Logo.
• Easily customise the Dashboard Logo.
• Set a New custom default avatar for your site.
• Remove dashboard widgets for ALL users.
• Hide the theme editor page and stop clients messing up the theme!
• Easily change the Dashboard footer text for your own.
• Change the Descriptions and link destination for your custom login logo.
• Hide the WordPress meta generator tag, make it a little more difficult for those script kiddies!
• And more to come………..

Currently I have basic templates for single.php and archive.php, users can create their own templates by creating a /mojo-gallery/ folder in their theme and copying the templates folder contents into it, that way they can modify their own templates without them being wiped out during upgrades.

There are still plenty of bugs especially around templates and I am looking at better ways of doing this. If you feel like helping then please do!

You can check it out over on the WordPress Plugin Site or GitHub.

Finally managed to get it working, stupid SVN!

The most recent updates will always be on the Github page but if you so desire you can check out the WordPress Plugin page here.

Also need to figure out how to use SVN I normally use git/github for everything!

When trying to add the shiny Github RSS feed on the right of the page I came up with CS errors that WordPress could not validate the SSL CA. This happens because CentOS had an old certificate authority bundle: /etc/pki/tls/certs/ca-bundle.crt

I found a blog post from last year here and made sense for my position!

Backup your existing file just so you don’t kill any kittens:

cp /etc/pki/tls/certs/ca-bundle.crt /root/kitten-basket

Then use magic to get the new one, I used the one found in the other blog post referenced above.

curl http://curl.haxx.se/ca/cacert.pem -o /etc/pki/tls/certs/ca-bundle.crt

I restarted apache (not sure if I needed to but made sense!) and yippee it works!