http://www.example.com/ar/shop-listing/health-beauty~@/#$&&&%%$%3Cscript%3E/ In this particular URL, everything after the # (hash) is the fragment identifier and is not sent to the server by the browser, so cannot be blocked server-side in .htaccess. The server only sees: /ar/shop-listing/health-beauty~@/ If the # was to be removed from this URL then this would be a wholly invalid URL (because … Read more
After thinking about this a little bit, I guess that the proper way to ensure that your comments are properly escaped, is by doing something like this: $the_comment = get_comment_text(); echo ‘<p>’ . esc_html($the_comment) . ‘</p>’; Instead of simply using the function like this: comment_text(); Why even have these handy functions in the first place, … Read more
The easiest way is to use if ( current_user_can( ‘capability’ ) ) // do stuff. You’ll find more about capabilities in the codex. You can also inspect the data some user has attached with normal var_dump() and else. I also got a pretty old plugin for that. But I’m not sure if it still works … Read more
I’ve used this to add webm support to the wordpress 3.3.1 uploader. add_filter(‘upload_mimes’, array(&$this, ‘addUploadMimes’), 1, 1); public function addUploadMimes($mimes){ $mimes = array_merge($mimes, array( ‘webm’ => ‘video/webm’ )); return $mimes; } I had to make it run with a high priority to stick.
The security of plugin updates via .org really falls on the shoulders of WordPress to provide a secure repository and method for plugin authors to safeguard assets. Since 2011 they have improved the system for notification on plugin changes, so plugin authors are notified when their code is altered, this is a good change though … Read more
Why would you want to protect them all? Not all of them need protecting, in my humble opinion. In any event, these are good to have in your .htaccess file: 1: restrict access to wp-config.php <Files wp-config.php> order allow, deny deny from all </Files> 2: restrict access to .htaccess itself <Files .htaccess> order allow,deny deny … Read more
Due to WP admin architecture this would be really inconvenient list to compile and maintain reliably. My best educated guess is that many (but possibly not all and not just) of these files would need to require admin bootstrap (wp-admin/admin.php) to function. I ran a quick search on respective directive with following results: C:\server\www\dev\wordpress\src>ack –files-with-matches … Read more
You can add this to .htaccess file, it will redirect all author requests looking for a number ( Author ID ) to the homepage: #Disable Author Pages <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteCond %{REQUEST_URI} ^/$ RewriteCond %{QUERY_STRING} ^/?author=([0-9]*) [NC] RewriteRule ^(.*)$ http://%{HTTP_HOST}/? [L,R=301,NC] </IfModule> The PHP / WordPress way, you could use Template Redirect: … Read more
There’s a slight disconnect between your question title and the actual question. It sounds like you’re using a plugin (or developing a plugin?) that allows for some front-end sorting. If it’s a plugin you’re using and the query string parameter is not sanitized, you need to notify that plugin’s developer, because that’s a security issue. … Read more
WordPress URL/Folder ReWrite using Htaccess