You could try hooking into template_include and showing the user a completely different page containing the login form (without changing the URL) if the post is password protected. Combine that WordPress’ built in post password functionality and you have something really close to what you want (blocking an entire page). You could also use {{insert … Read more
At first, read something about WordPress Ajax API and about Roles and Capabilities – capability to “edit_posts” has even Contributor. I would suggest to check for ‘delete_others_posts’ to prove the user is at least Editor. Or use capability of ‘manage_options’ (has Administrator, not Editor). Further, there is a check ajax referer function for you to … Read more
If you install the following plugin and leave that one running for a while… you can see who logged in since using that plugin: http://wordpress.org/extend/plugins/wp-last-login/ That seems to do what you need. As far as I quickly can see it runs on $this->hook( ‘wp_login’ ) and does: $user = get_user_by( ‘login’, $user_login ); update_user_meta( $user->ID, … Read more
Search the Trac for these kinds of core changes: trac ticket #23291 and trac ticket #23291.2.diff
I agree with Wyck’s comment. If I can upload files, game over. If I couldn’t upload to mu-plugins chances are that I could upload, and overwrite, the theme’s functions.php or Core files instead. Any of those options work as well or better than a mu-plugin file would. The “also modify the database” part is irrelevant … Read more
That is most likely a false positive : https://en.wikipedia.org/wiki/Type_I_and_type_II_errors base64_decode is not bad in of itself : https://en.wikipedia.org/wiki/Base64 The plugin is not smart enough to know a legitimate reason to use base64_decode of which there are many.
It doesn’t matter what function you use to generate the form markup, if you write the code by hand, or if it’s in a modal or not. For it to be secure, you absolutely need an SSL certificate.
I would use the filter_var() function. It has some predefined filters that you can use depending on what kind of data you are expecting such as string, number, etc. So to sanitize for a number: $sanitizedNum = filter_var($yourVar, FILTER_SANITIZE_NUMBER_INT); For a string you would just change “_NUM_INT” to “_STRING”. Wrap those in a custom function … Read more
Duplicate the post.php in your theme folder. Rename that file as any_name.php Enter the following code at the top of that file. < ?php /* Template Name: Any Name */ ?> Add your php codes to that file. Go to admin panel — > Create a new page — > Select your template and publish … Read more
Yes, of course. If the PHP code in a file works when that file called separately, and if there is a vulnerability, it can be exploited. There are two basic rules. They apply not only to WordPress, but to every web site: Use only code that you understand completely. Do not put unused code onto … Read more