RMJ
Forum Replies Created
-
Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugThe page break if I add
<?php function any_function() { } ?>
So the include propably works but it dies when (something is) trying to parse the function.
Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugMmm, actually it’s the first @include that breaks it.
I’m including some functions for the page like this and it seems to break it.
<?php @include('/path/to/php.file'); ?>
The file has few functions but the page breaks no matter if I try to call them or not. No extra lines before or after php brackets (inside the include file), and it doesn’t output anything (inside nor outside the functions).
I will have to check logs for more information.
I used Exec-PHP plugin.
Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugsimple script like
<?php echo "test" ?>
works just fine but if I have more complex it breaks the page.Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugMmm…
All the other pages containing PHP (in the page content) are now dead. No content is generated for them. (including main page)
It happens with both development versions, so it must be related to your first try to fix it.
I changed back to the official 2.1.2 release and it works (with wrong image of course).
Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugWell, I got now the new version up and running and looks like it fixes the problem. ??
Debug Array: image_source = preg_match_all / img src / https://www.alizeeart.com/resources/images/agenda/agenda-20130105-hedbomusiquemag.png -->
Thanks a lot. I will fool around to see if everything works.
edit:
It passes through FB debugger just fine too.Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugOkey great, I’ll be waiting for the next version.
I found the offending line in the code but as I don’t know the sytem well enough, don’t even know where to start fixing it. So better wait for your fix. ??
Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugThanks for the comment. ??
Anyways, I tried the development version and it’s not a change to good direction. It picks up the “thumblr” image this time.
From the source code:
Debug Array: image_source = preg_match_all / img src / https://platform.tumblr.com/v1/share_2.png
Why it doesn’t see the same image as before ? (nothing has changed on my page) Also a bit strange that it picks up a image generated by the script itself.
Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugIt’s in debug mode now:
https://www.alizeeart.com/agenda/
The debug information seems to confirm the problem.
Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugI updated the plugin and tried the same code as I had before.
The problem now is that it completely igonores the PHP code (or it’s output), resulting in partial url (just the relative path). Because the image path is now incomplete, Facebook won’t fetch the image and throws error:
The meta tag now says:
<meta property="og:image" content="/resources/images/agenda/agenda-20130105-hedbomusiquemag.png">
Whilst the source code (of the first image) later says:
<img src="https://www.MYSITE.com/resources/images/agenda/agenda-20130105-hedbomusiquemag.png" alt="" />
That happens when using my earlier code:
<img src="<?php echo site_url(); ?>/resources/images/agenda/agenda-20130105-hedbomusiquemag.png" alt="" />
Due to relative path inside the meta tag, Facebook is not able to process it. (interestingly enough they won’t try to fetch it from the base domain if relative path is given)
Here is quote from the Facebook (home > tools > debugger) :
Errors That Must Be Fixed
Object Invalid Value: Object at URL ‘https://www.MYSITE.com/agenda/’ of type ‘article’ is invalid because the given value ‘/resources/images/agenda/agenda-20130105-hedbomusiquemag.png’ for property ‘og:image:url’ could not be parsed as type ‘url’.It actually might work if I weren’t using permalinks. I don’t know if FB is trying to fetch the image from MYSITE.com/agenda/resources/ instead of the real path MYSITE.com/resources/
Either way, the meta tag should include the full path to avoid such a problem.
BTW,
I changed from the plugin source the filter setting from 20 back to 10 and it does not show anymore the PHP code (or anything at all) in the source when running the site. That’s a good thing. Even going all the way to 1 won’t get the PHP code outputted so that surely fixes the security problem. Now the problem is just how to get the PHP parsed and to output the proper url there.Forum: Plugins
In reply to: [NextGEN Facebook] serious security bugOkey, good to know. I thought it might have been something to do in the order the plugins work but didn’t even had time to find out if I could change it.
But I guess by default it might be good then to run this plugin a bit later in the order to avoid such situation.
I will try out the new version today and let you know how it goes in my site.