D’Arcy Norman Dot Net » Blog Archive » Multiuser weblog software is heating up again…

D’Arcy Norman looks at the multi-blog universe again. He’s examining a few systems and I like his simple litmus test:

If a user’s first reaction to the software is something like “GAH!” they are less likely to use it.

WPMU for cpanel sites

There have been too many complaints on the forums about people having trouble installing WPMU. A number of these are on Cpanel administered sites.
Until this morning I had never used Cpanel, but thanks to James Farmer I had my chance.
Here’s how I debugged the problem with installing WPMU on Cpanel sites.
This problem probably extends to any web based installer that creates a .htaccess file in the root directory because Cpanel creates an empty file of the same name.
This is a problem because the file is owned by the user running Cpanel, not the web server. You have to change the permissions of the file through Cpanel, or ftp in and delete it.

Give me a shell any day.

Security Checking PHP Templates

WordPress uses PHP as it’s templating language. It’s well established and as I’ve said before, there’s an abundance of free themes out there for it.
Unfortunately in a multi-user environment, allowing untrusted users to edit PHP code on your server is a huge security risk. There has to be some way to limit the commands a user can use, and there is!
PHP already parses html pages, so why not take advantage of that engine? The PHP Tokenizer lets you do just that!
Feed your template through token_get_all() and it’ll spit out an array containing HTML, PHP, and other elements from your file.
Here’s an if statement that should be familiar:

T_OPEN_TAG: '<?php '
T_IF: 'if'
T_WHITESPACE: ' '
(
T_STRING: 'have_posts'
(
)
)

We then need to compile a list of allowed functions, which can be got from wp-includes/* and we’re well on the way to a safe environment for WP bloggers. Any more ideas?