Alexey
Forum Replies Created
-
Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpHello, Julka,
Unfortunately I do not know programming languages used for web. I just know other use js for social buttons.
Regards,
Alexey.Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpYes, may be, but it will be hard to find which one and even if I do, brobably I will not switch off another plugin to let AddThis work properly.
In my oppinion, you loaded it with too many functions. It’s just social buttons, nothing more and they should stay only social buttons.
Your plugins were hard to configure, they had conflicts from the very beginning as I started to use them. It’s also hard to configure the certain set of buttons I want to be shown on the site.
I remember that the last time I spent much time to write the code. I even saved it not to write it again, but when I installed ver. 2 of the plugin, I found out that this piece of code doesn’t work! Plugin told me it’s not a valid Json, but I had no idea what is a valid json, I just had a code that worked in ver.1 but not in ver.2.
Later I found that I had to change single quotes to double and also cover few other words with quotes. And all your plugin consists of such little bugs, disconnects and misunerstandings.
The only reason why I use it — it is backoffice with statistics. It’s really a good idea. But even there I have problems. For more than a year I wrote to your support because I see (and receive emails) not only for my site but also for two another which are not mine. Nobody could help me so I just cocnfigured filter in email box not to see emails with statistics for other sites.
Please try to understand me. I do not want just to blame your creature. Social buttons is not very complicated thing. And plugin for it should be lightweight and simple. It shoud create no problems and be inconspicuous. But yours isn’t! Instead of installing and forgetting I spend time to show you how can make it better. And you telling me that there is smth not right with my site. No! My site is ok. May be your plugin conflicts with another one. May be it is seo or security plugin. How do you think, will I change security plugin to let social buttons work? No! And no one will!
Regards,
Alexey.Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpYes, but I use Twenty Eleven. It’s hard to imagine smth more native for WP.
Thank you for your feedback and given workaround. But still looking forward for plugin version without Ajax and calling service files intended for admin area.
Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpHi, Julka,
Sorry, found out that even being disabled caching plugin continues to generate cache!
Nevertheless I can’t use plugin, because with Asynchronous Loading switched on I see no buttons at all, and when switched off have security issue.
So to stay with AddThis I think I shoud either enable everyone access to admin-ajax.php (which is not good for me) or install AddThis panel as a script manually without plugin (probably will try), or stay with plugin ver. 1 (I do now).
But it will be nice if you release plugin version without Ajax on the front. It’s not good to use files located in wp-admin for the front. Admin area with all its files should be only for admin purposes. Using Ajax in admin panel is no problem, when I enter admin area, I enter additional login and password.
Plugin worked without Ajax on the front in ver 1 and hope it could do so further.
Regards,
Alexey.Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpI remember this feature (Asynchronous Loading), it was ver. 1 of plugin. It doesn’t work for me. I.e. when I turned it on, I didn’t see neither panel, nor buttons in posts and pages.
Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpHi, Julka,
Not, I don’t. Used one but uninstalled a year ago.
Alexey.
Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpRecovered site from backup. Have not time and desire to debug this plugin. Will look for some alternates.
Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpAfter few installs and uninstalls I have this string of code in the header and can’t cut it off! Even after total plugin uninstall!
Blame Smart layers by Addthis!
Perhaps need to clean files and database manually… =/
Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpNow I can’t see share pannel at all. Even with default settings.
Forum: Plugins
In reply to: [Smart Layers by AddThis] Security issue: plugin acess to admin-ajax.phpHello, Julka!
Thanks!
No, it doesn’t help. Installed plugin again and checked Asynchronous Loading. Code is still in pages causing login dialog. And also I remember that when I set it later, neither layers not buttons were displayed with this checkbox.
Regards,
Alexey.Hi, @dwinden
I’ve caught it!
182.50.130.188 - - [30/Jun/2016:23:18:47 +0300] "POST /xmlrpc.php HTTP/1.0" 403 5 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:23.0) Gecko/20100101 Firefox/23.0"
So attackers are not accessing wp-login, it is xmlrpc! Xmlrpc was enabled in plugin and I disabled it now. So waiting again to find out if this was the only reason.
Thanks again!
@dwinden, hello again! You were right! Two more attempts today. Found and turned on loggin, now waiting for next robot. And two more questions to you please:
1) Do you mean that plugin’s protection doesn’t cover wp-login.php when it is called with POST request? Only GET request? Why? Then it seems to bet not a real protection!
2) What to do after I look in logs and know how they really attack?
Thanks in advance!
dwinden, of course only like temporary solution only to get in. Sory, didn’t mention it in the post.
I use virtual hosting and need to find logging there.
Thank! Mark topic as resolved.
Hm… I thought I tried it with your site…
And I’ve just invented another workaround. You should duplicate wp-login.php to smth, for example wp-login2.php and just open yoursite.com/wp-login2.php.
Worked for my site.