micasuh

I 2nd this idea! Sadly, however, I do think jQuery loading in the footer should be optional since so many plugins would break if this was by default. But the rest of the scripts should definitely load in the footer.

For those looking for a way to do this, just open up jtd-anything-slider.php. Look for all the wp_enqueue_script lines, and right before the end of the line, after the version number which looks similar to this: 'x.x' where x is a number, add a comma and true.

So, for example, here’s a line of code which places the anythingslider jQuery script in the head on line 34:

wp_enqueue_script( 'jquery.anythingslider', JTD_INSERTJS . '/jquery.anythingslider.min.js', array( 'jquery' ), '1.7.26' );

To force this script to go to the footer, add true to the end of the code like this:

wp_enqueue_script( 'jquery.anythingslider', JTD_INSERTJS . '/jquery.anythingslider.min.js', array( 'jquery' ), '1.7.26', true );

Hope this helps others!

This plugin needs to allow developer to set scripts to the footer instead of the header for faster loading! Maybe add a checkbox that enables footer loading if you prefer header loading by default.

I think after completely sweeping through all the WordPress installations and with some feedback from Dreamhost, I’ve hopefully crushed the trojan horse so that it stays out of my account. This particular attack was extensive with lots of various malicious files in so many different places. It’s been a few days since anything has happened but I’m monitoring it for the rest of the month on a daily basis to make sure nothing new happens.

@tvcnet – I hear what you’re saying but I think with automated servces like ManageWP, it’s not so bad to be on shared hosting. That said, I think it takes a dedicated person to maintain everything.

I inherited this account from a now deceased family member who was doing this for a side business so I have tried to maintain but of course there was outdated scripts or installs that I didn’t catch.

I do believe it’s possible to maintain a relatively secure account as long as the account holder is diligent about maintaining the code and keeping it up to date. I also keep up with other client accounts who also use Dreamhost and none of them were affected by this thankfully. Sadly, however, I also think Dreamhost was particularly targeted for this type of attack but I think other shared hosting and even VPS hosting can fall victim to similar attacks just as easily under similar circumstances as I had.

@prosperityone – If you were infected similarly to what I was, I can give you a few hints on how to crush the bugs and get some peace back.

One of the most used methods to monitor changed files is by logging into my account using SSH and running a few commands. The find command really helped me monitor what’s going on and what had changed in a certain period of time. For example:

find . -type f -mtime -1 | grep -v "/Maildir/" | grep -v "/logs"

The above line searches through your account for changed files within the last 1 day (change the 1 to 2 or 3 if you want to view multiple days) but it doesn’t search through the Mail directory or the access logs (for Dreamhost only, change for your shared hosting provider if different). I run this code once or twice a day right now just to see what’s going on.

Here’s another one I used:

find . -name xxx.php

In the above code, replace xxx with the name of an infected file (look at my original list of files). It will then look for all files in your account which have the name of xxx. I found many malicious files using this method.

Finally, if you know about grep, it’s a good way to find any files that contain injected base64 code. Look it up and you’ll see the different options on how to look for these files.

Before I wrap up, I’ll add a few more file names which I found that had been infected.

class-wp-theme-edit.php
class-ziplibs.php
wp-raze.php
wp-ajax-gadget.php
/wp-includes/https.php

They look real but are completely fake.

I hope my experience and examples help someone else in a similar situation.

I was able to solve the above problems with a little info from a Dreamhost tech support but it was frustrating for nearly a week trying to solve this problem. These files were literally all over the account sometimes buried deep into the plugins or even themes. It was well scripted to be hard to kill.

@richardwpg – It’s just as likely that one of the outdated WP installs I had in my account on one of my domains was a way for these robots to get in. There was also an outdated timthumb.php script that I had to fix. I read recently that Websense was reporting a huge increase in attacks over the last few weeks. Dreamhost appears to be a common victim, possibly because of similar accounts like mine which have outdated files with possible holes.

@tvcnet – Excellent info! Thanks!

@mickeyroush – right, I do know about this and should look into adding it to all the .htaccess files. I have about 15 or so WP installs on various domains in my account so that’ll take a bit of work to do but it’s worth it.

Had to ask the WordPress IRC for help on this one, but there’s the answer. Add the following code to your functions.php file.

/**
 * Extend the default page walker class to append class names for pages that
 * are parents.
 * @uses Walker_Page
 *
 * https://wordpress.stackexchange.com/questions/11821/class-parent-for-wp-list-pages
 *
 */
class My_Page_Walker extends Walker_Page
{
/**
 * Filter in the classes for parents.
 */
 function _filterClass( $class )
 {
     $class[] = 'parent'; // change this to whatever classe(s) you require
     return $class;
 }

 /**
  * This is effectively a wrapper for the default method, dynamically adding
  * and removing the class filter when the current item has children.
  */
 function start_el( &$output, $page, $depth, $args, $current_page )
 {
     if ( !empty($args['has_children']) )
         add_filter( 'page_css_class', array( &$this, '_filterClass') );

    if ( $depth )
        $indent = str_repeat("\t", $depth);
    else
        $indent = '';

    extract($args, EXTR_SKIP);
    $css_class = array('page_item', 'page-item-'.$page->ID);
    if ( !empty($current_page) ) {
        $_current_page = get_page( $current_page );
        _get_post_ancestors($_current_page);
        if ( isset($_current_page->ancestors) && in_array($page->ID, (array) $_current_page->ancestors) )
            $css_class[] = 'current_page_ancestor';
        if ( $page->ID == $current_page )
            $css_class[] = 'current_page_item';
        elseif ( $_current_page && $page->ID == $_current_page->post_parent )
            $css_class[] = 'current_page_parent';
    } elseif ( $page->ID == get_option('page_for_posts') ) {
        $css_class[] = 'current_page_parent';
    }

    $css_class = implode(' ', apply_filters('page_css_class', $css_class, $page));

    $output .= $indent . '<li class="' . $css_class . '"><a href="' . get_permalink($page->ID) . '">' . $link_before;
    $image = get_post_meta($page->ID, 'title_image', true);
    if ( isset($image) && !empty($image) ) {
        $output .= '<img src="'. $image .'" alt="'. apply_filters( 'the_title', $page->post_title, $page->ID ) .'" />';
    }
    else {
        $output .= apply_filters( 'the_title', $page->post_title, $page->ID );
    }
    $output .=  $link_after . '</a>';

    if ( !empty($show_date) ) {
        if ( 'modified' == $show_date )
            $time = $page->post_modified;
        else
            $time = $page->post_date;

        $output .= " " . mysql2date($date_format, $time);
    }

     if ( !empty($args['has_children']) )
         remove_filter( 'page_css_class', array( &$this, '_filterClass') );
 }
}

Change title_image to the custom fields value of your choice.

Hey Dan, the author submitted an update and it finally went through this week. I have taken the same project and updated it on Github to expand upon what he has done, with his permission. Hope this helps.

I missed a close bracket in the initial shortcode so don’t pay attention to that. The code works great when activated, I just want to make sure that when NOT activated nothing shows up instead of the [footer_credit] text (meaning it’s not rendering when there’s nothing to render).

I did not find a real solution so I’m resorting to a plugin to force the redirection.

https://www.ads-software.com/extend/plugins/redirection/

As of WordPress 3.1, this is still an issue.

To perform this action, create a new post, mark it as private, and publish it. Once the post is created, go to the list of posts page where you see all posts you have created in a list. Hover over the post you want to mark as draft, slick on the “Quick Edit” link, and try to change Status from Published to Draft. If you try saving it, it will still be Published.

I hope someone sees this who knows the answer b/c I’d love to implement this in my projects.

Is this a problem with the way WordPress maps its urls or domains? Maybe a bug with the permalink structure or architecture?

I figured out my solution! Here’s the final code:

<ul id="firemen">
    <?php query_posts('post_type=firemen'); while ($firemen->have_posts()): $firemen->the_post(); ?>
        <li>
            <a href="#<?php the_ID(); ?>" class="fancybox"><?php the_title(); ?><?php if ( has_post_thumbnail() ) { the_post_thumbnail(); } ?></a>
	     <div id="<?php the_ID(); ?>" class="profile"><h3><?php the_title(); ?></h3><?php if ( has_post_thumbnail() ) { the_post_thumbnail('large', array('class' => 'baseball')); } ?><?php echo(the_meta()); ?></div>
        </li>
    <?php endwhile; ?>
</ul>

I ended up activating the Fancybox plugin and added a div with the meta for custom fields info. In the CSS, I set #firemen to display:none; and Fancybox knew to grab that content into the overlay exactly as I intended.

This was a neat experiment and now I gotta do any final IE/FF/Safari hacking in case something doesn’t work right. Problem solved!

I do realize I could include the_meta() and link to it using a hash tag, but I don’t want this content to show up until someone clicks on the hyperlink. I was hoping there’s a PHP/WordPress trick I could use instead of relying on Javascript.

When the link is clicked, I only want custom fields of each custom post type to populate the browser, nothing else.

I have filled out several names and values within the custom fields for the custom posts, but I realize that they won’t display without meta function. These custom posts don’t have traditional content and thus going to the permalink returns a 404.

Yes, thanks fonglh but my application of this is a little more advanced than the page lets me know. I found this link myself earlier but it didn’t help me with what I need.