alfreddatakillen
Forum Replies Created
-
Forum: Plugins
In reply to: [Stop XML-RPC Attack] What are those bash .sh files in the package?I’ll document that better! Thanks for your input!
Forum: Plugins
In reply to: [Stop XML-RPC Attack] What are those bash .sh files in the package?Well, they will not run if you don’t run them.
In my opinion, tools for running unit tests (or simplify the running of unit tests), and any build scripts, should be included with all source code. That’s just the intention of GPL and inclusive open source design, to me.
Or would you say that it is a bad idea?
Lately, I’ve hade a lot of troubles with xmlrpc attacks.
add_filter( 'xmlrpc_enabled', '__return_false' );
was not enough, because the massive numbers of requests brought the servers down (loading WordPres at each request). So, I wrote a plugin which denys xmlrpc.php requests already in .htaccess, except for requests from Automattic’s/JetPack’s IP address subnets. The plugin polls ARIN on a reqular basis, to get all IP addresses that belong to Automattic, and updates .htaccess accordingly.The plugin is published here: https://www.ads-software.com/plugins/stop-xmlrpc-attack/
Hi!
I have wordpress in its own directory, as described here: https://codex.www.ads-software.com/Giving_WordPress_Its_Own_Directory
So, my sites are at the domain root, but wordpress is installed in /wordpress.
In this situation, this plugin creates a redirect loop for the main blog (blog #0), since the URL from get_option() will be https://example.org/wordpress but the if-statement in redirect_to_mapped_domain() expects only https://example.orgSo, what I did was making sure get_original_url() always returns the protocol + domain name ONLY, by adding this piece of code in get_original_url() directly after $orig_url is set from get_option/get_blog_option:
$orig_url_arr = explode('/', $orig_url); if (count($orig_url_arr) > 3) { $orig_url = $orig_url_arr[0] . '//' . $orig_url_arr[2]; }
This is not the most beautiful solution (since the compared URLs will actually not be the correct ones), but it seems to work fine so far.
I’m not sure if this solution will also work if you want your wordpress root to be accessed from https://example.org/blog, but I thought this was a related problem/solution, so att decided to share this here. ??
Thanks for a nice plugin! ??
Forum: Networking WordPress
In reply to: [WP Read-Only] 2 multisite bugsThanks for your report! I will have a look at this and release a bug-fixed version within shortly.