Looks like Matt has started giving out WordPress.com invites. Hmm.
Only one per person, who would you give your invite to?
Tag Archives: WordPress
Automated PHP code security checking
In my quest to find way of securing 3rd party PHP code I discovered the PHP Security Scanner. This could be a first stage check in the process of checking WordPress templates.
Afterwards we’d have to flag unwanted commands. Well, we don’t want people opening /etc/passwd now do we?
Blog These Tabs
I want a Firefox extension that lets me blog multiple tabs into my WordPress blog. Would it be possible to do something like that with Greasemonkey?
D’Arcy Norman Dot Net » Blog Archive » Multiuser weblog software is heating up again…
D’Arcy Norman looks at the multi-blog universe again. He’s examining a few systems and I like his simple litmus test:
If a user’s first reaction to the software is something like “GAH!” they are less likely to use it.
Customizable Dashboard Feeds
I’ve just checked in the first bits of code that will allow for customizable feeds in the WordPress MU Dashboard. It’s very much a work-in-progress and will change but here’s a few screenshots to whet your appetite! Think of this as pre-alpha code. The final version will look very different.

How you SHOULD use blogs in education
James follows up his previous blogs in education post with a new one on how you should use blogs in education. I bet we’ll see some interesting uses of WPMU in education with James involved!
WPMU for cpanel sites
There have been too many complaints on the forums about people having trouble installing WPMU. A number of these are on Cpanel administered sites.
Until this morning I had never used Cpanel, but thanks to James Farmer I had my chance.
Here’s how I debugged the problem with installing WPMU on Cpanel sites.
This problem probably extends to any web based installer that creates a .htaccess file in the root directory because Cpanel creates an empty file of the same name.
This is a problem because the file is owned by the user running Cpanel, not the web server. You have to change the permissions of the file through Cpanel, or ftp in and delete it.
Give me a shell any day.
How NOT to use blogs in education
How you should not use blogs in eduction, or in other environments too. James is doing some interesting things with WPMU and he has great ideas!
WordPress.com – what's happening?
Want to know what’s happening at WordPress.com? Sign up there, fill in your email address and reserve a username! You’ll soon hear about it! (via Matt)
Security Checking PHP Templates
WordPress uses PHP as it’s templating language. It’s well established and as I’ve said before, there’s an abundance of free themes out there for it.
Unfortunately in a multi-user environment, allowing untrusted users to edit PHP code on your server is a huge security risk. There has to be some way to limit the commands a user can use, and there is!
PHP already parses html pages, so why not take advantage of that engine? The PHP Tokenizer lets you do just that!
Feed your template through token_get_all() and it’ll spit out an array containing HTML, PHP, and other elements from your file.
Here’s an if statement that should be familiar:
T_OPEN_TAG: '<?php '
T_IF: 'if'
T_WHITESPACE: ' '
(
T_STRING: 'have_posts'
(
)
)
We then need to compile a list of allowed functions, which can be got from wp-includes/* and we’re well on the way to a safe environment for WP bloggers. Any more ideas?
