This time, I traced the problem back to wp-lytebox, and I’m ashamed to say I’ve had to fix the same problem before.  It all started when I couldn’t load the post page in the backend of firsttube.com.  Digging in, I eventually found a file called sys.php in the root of the site, and it listed the contents of my site and had a form that allowed someone to add a page, chmod a page, or delete a page.  Killer!

I found that it was defaulting to /path/to/WP/wp-includes/plugins/wp-lytebox, and sure enough, digging into that directory revealed several other fun scripts, all of which gave someone the ability to access all the files on my site.  Fun!

I found that I already had replaced this plugin before, so I decided to get rid of it altogether, this now proving it wasn’t a misconfiguration, but rather, a problem with the wp-lytebox itself.

In this process, however, I was unable to fix my issue.  Visiting /wp-admin/post-new.php still rendered only a page footer, and nothing more.

So I starting fooling around in my directories looking for files that had been modified more recently than when I did my 2.9.2 upgrade.  One of the files? My .htaccess file.

“This be odd,” I thought to myself, “I’ve changed this not, methinks.”

Sure enough, there was a rogue line within: RewriteCond ^/default/$ /wp-admin/includes Huh?

I dug into that folder, and the .htaccess file there was recent too? It’s contents? DefaultIndex users.php

Of course, I immediately opened users.php and found, as you might have guessed, a bunch of Russian crap. Savvy WP hackers will know, it’s not a real file, there is no users.php in the real wp-admin/includes directory.

I also found a folder that had two large files, both named core.XXXX where XXXX was a 4 digit number, and a massive 40 MB error_log.  Yikes.

I thought I had everything cleaned out, and I truly believed that the way in was wp-lytebox.  Then I found this.  And sure enough, all of the listed files were compromised.  So I nuked all the files, and replaced them all.  D’oh!

So, if you’re arriving via Google or Bing or Yahoo!, do NOT use wp-lytebox.

I got the first few steps knocked out, I selected WordPress,  gave it my MySQL username and password, and let it go.  It installed PHP for Windows, the MySQL connector, and WordPress.  Then I launched my browser and pointed to http://localhost:81 and… no.  Error 402.  I monkeyed with the site in IIS and was able to generate an error that simply says:  Parameter not found.

PHP is installed.  IIS assicates .php files with PHP.exe.  But WordPress no worky.

Fail.

Directions are this easy: set the path of $tw_File with a static, writable file.  Set $tw_userid to your Twitter user id.  Done. 

Download firsttube.com “get latest tweet” php snippet.

• Akismet is a comment filter that uses a “karma” type algorithm to analyze comments and separate ham from spam. According to my internal stats, Akismet reports 37,512 spams caught, 284 legitimate comments, and an overall accuracy rate of 99.934%. Not too shabby. As a result, this site no longer has a captcha.
• Blip.It iPhone Handler is a neat little tool that creates a method to display embedded flash as Quicktime on-the-fly, ideal for iPhone compatibility.
• Cache Images, another Mullenweg gem, let me fetch remote images and store them locally. I prefer to host all images locally if possible, so this is fantastic.
• “ftBlogrollerWP (ft)” is my own modified plugin that creates a page with all of my links, as seen here.
• Google XML Sitemaps is a tool for creating a sitemap that Google and other search engines can use to spider your site. This would take forever by hand and would be very hard to keep up manually, but this plugin makes it effortless.
• Limit Login Attempts. No sense in letting someone hammer your WordPress admin login eternally. Basic security that ought to be part of WordPress core.
• Similar Posts is a snazzy little plugin that tries to find similar posts to any given post. I use this on each post’s page. In pre-Wordpress firsttube, I did this by searching for other articles with the same tags. In WordPress-era ft, I do this via a plugin. Similar Posts requires the Post-Plugin Library.
• Tangofy is a simple plugin to modify icons in the stock WordPress admin pages.
• TTFTitles is a sweet little plugin that creates images from text. I do this on entry titles and sidebar titles. It allows you to add a dimension of professional typography and to use fonts that aren’t in the eight “web safe.”
• WordPress Database Backup: you’ll never guess what this one does!
• WordPress Hashcash does the spam filtering in conjunction with Akismet. Whatever Akismet misses, Hashcash catches. Essentially, it catches *everything* Akismet misses and only really reports problems when users have javascript turned off.
• WordPress Popular Posts provide me view counts, plain and simple. I used to keep track pre-Wordpress, but sadly, I lost my hit count (many of which were in the thens of thousands of views) and only started again this month. Nonetheless, it’s in the sidebar.
• wp-cache is a caching program, but I’m not currently using the cache.
• WP-Lytebox automatically adds a lytebox effect to inline images, which is spectacular.
• WP-Optimize is a database optimizer that does optimization not only of MySQL overhead, but also removes autosaves and other space wasters from your database.
• WP-Syntax makes my code pretty, and that’s all.
• WP iPaper is a plugin for embedding scribd stuff.
• Lastly, WPtouch iPhone Theme is a stylesheet that makes this site look native on the iPhone. It’s truly a beautiful skin.

That is all. Thank you to all the above developers. As a reward, please accept this pingback!

“Press This” hasn’t worked for me for ages.  I am so happy to have it back!

Onto my gripes. I can’t get inline replying/threading to work.  There is very little documentation on it so far. The functions are called comment_reply_link() and get_comment_reply_link(), and there’s nothing anywhere in the codex that helps, there’s little on the internet, the only place to get any real detail is the code itself, which explains:

from wp-includes/comment-template.php starting at line 949 on WP 2.7.0

 * Retrieve HTML content for reply to comment link.
 *
 * The default arguments that can be override are 'add_below', 'respond_id',
 * 'reply_text', 'login_text', and 'depth'. The 'login_text' argument will be
 * used, if the user must log in or register first before posting a comment. The
 * 'reply_text' will be used, if they can post a reply. The 'add_below' and
 * 'respond_id' arguments are for the JavaScript moveAddCommentForm() function
 * parameters.
 *
 * @since 2.7.0
 *
 * @param array $args Optional. Override default options.
 * @param int $comment Optional. Comment being replied to.
 * @param int $post Optional. Post that the comment is going to be displayed on.
 * @return string|bool|null Link to show comment form, if successful. False, if comments are closed.

It doesn’t matter much, because it doesn’t work, period, even though I’ve followed the instruction here to a t. So I’ll have to fix that in time.

My last gripe is with the new wp_list_comments() routine. I understand this is all new, but the idea that templating comments requires a callback function as a wrapper to all comments, pings, and trackbacks is clumsy at best. The codex on wp_list_comments() have nothing to explain it to people, so while I’ve dug in and gotten things working, it’s not for the feint of heart just yet, since you need to build a PHP function in your theme in your functions.php file (or create one if it doesn’t exist, which cannot be done via the Dashboard). I’m a little sad, since the theme system is so flexible and the new plugin system is just incredible, to see the new comment loop be so manual compared to the single file approach used so successfully in the past.

I know that Scoble says WordPress 2.7 rocks, and it does. Scoble doesn’t realize the shortcomings because he hasn’t tried to play with the new features, and fortunately, it very gracefully degrades. But it’s got some work to do to be perfect, for me at least.

Themes were entirely unbroken. Upgrading firsttube.com may be a bit more of a challenge since I’ve manually changed a few fore WordPress files, which may prevent in place automatic upgrades.  However, all in all, I think the 2.7 release is looking really great.  

When 2.7 final is released, I expect to be updating my live site pretty quickly.

BePress: A WordPress theme

Chasing a random whim, I decided to check if there was an existing WordPress theme to mimic the BeOS 5 desktop. If there is one, I can’t find it. As I’ve detailed before, I’ve been learning to hack WordPress. So I thought, perhaps this is a chance for me to write my first WordPress theme.

Enter BePress. At first, I began this project as a 100% table-free CSS/XHTML project. After a few hours of tinkering, however, and after looking into some old code Eugenia wrote, it became clear to me that going table-less will not render the result I’d like to see. Perhaps for a 2.0 version I’ll pursue that goal. In the meantime, for my 0.2 roll I replaced my divs and spans with tables and got a nice, smooth BeOS table-like interface. Behold, BePress.

Although far from complete – complete to me means all pages of the theme are present and rendering properly – I’m feeling that it’s a nice start. I’m also getting more comfortable digging into WordPress. It turns out that writing a theme is exceptionally easy once you understand how The Loop works.

I expect to continue to mess with this for another week or two before I look into WordPress hosting it for download. I don’t see any reason why not to share it with the world, if there’s actually still anyone out there with a nostalgia for the BeOS who wants to theme their WordPress blog.

Today I took my first stab at writing a WordPress plugin. Turns out, it’s really easy. I’m mean really easy. The plugin is pretty simple: it just searches through every post and turns the unlinked words firsttube.com into a hyperlink. However, it seems like it might be a useful plugin for some, even just as a text-replacement plugin. So we’ll see if I publish it. In the meantime, though, it took me about 15 minutes to write and then it was recognized by WordPress, which was very cool.

I have a few ideas for more involved plugins too that I may write, one day. But in the meantime, this one is pretty cool.

The interesting thing here is that I’ve browsed the source of Slash, Scoop, phpNuke, and now WordPress, and all of them are definitively more complex and much heavier than the entire OSNews codebase. Now, before you jump all over me – firstly, Slash and Scoop are Perl, and I don’t really read Perl, so I can’t speak as an expert there.  Secondly, WordPress and Nuke both are very portable and dynamic, whereas OSNews has a narrow focus and, location-wise, is very static.  But that aside, OSNews has withstood simultaneous link bombs from Slashdot and Digg.  As amazing as WordPress is, it’s mostly amazing that it functions at all and loads in less than 2 minutes per page with as much going on as I can see behind the scenes.   That’s not a cut on WordPress, by the way.

In fact, if anything , what is really impressed upon me is how smooth and simple OSNews code is, if I may be so bold.  OSNews runs superfast due, in part, to lots of creative caching, some on-demand, some via cron.  But it also does so because of highly efficient queries that are measured for speed on their JOINs, meaning in some cases, it’s faster to do 20 simple queries than one complex one, or build a long and scary chain of “OR x=a OR x=b OR x=c OR x=d…”  Watching WordPress code in action is really fun for me, but watching OSNews work knowing what I now know about how much work PHP can cram into its threads is even more fun.

It should be fixed now, so that likely means another 20 dupes or so, I can’t control that. But I can tell you that I think we’re all caught up. Thanks for hanging with me.

First off, I was very excited about the features of WordPress.  I was really excited, most specifically, about the API, and about the rich text WYSIWYG of the backend.  I’ve done a lot of work on Small Axe’s backend, but it’s still nothing compared to WordPress.

When I imported my stuff, it worked well, but the “slugs” — or URL-friendly post titles — did not convert properly.  They converted as WordPress friendly, properly escaped slugs.  The problem was, my slugs needed to stay intact, because I didn’t want all old links to break.

Understanding the way WordPress functions is really tough for a WP newbie, because the code is so spread out, yet compact, voluminous, yet digestible. Start with index.php, onto wp-blog-header.php, into wp-settings.php, and then you find the massive list of files in the wp-includes directory.  You’ll dig all over trying to find files to find includes in includes in includes. I finally found a great article that tries to explain the WordPress slug architecture. It’s fairly complex. Much of it lives in/wp-includes/query.php. However, my problem was very specific.

Many of my post slugs had periods in them. The period does not interfere with the URL, but WordPress doesn’t like them, and somewhere in the massive beast. So I had to find the page that “gets” posts. Lo and behold, there is a function called “get_posts” that lives in /wp-includes/query.php. I kept poking around. Like anyone who keeps digging, eventually, you’ll find yourself in wp-includes/formatting.php. And there it is.

Slug posts get sanitized – like everything, virtually all input is strictly sanitized – by a function called sanitize_title_with_dashes(). This function generates the slug. In order to include dots in your slug titles, just replace lines 366 and 267 (on WordPress 2.6.0) with this:

$title = preg_replace('/&+?;/', '', $title); // kill entities
$title = preg_replace('/[^%a-z0-9 _.-]/', '', $title);

Then your slug titles will not strip periods. Of course, I don’t recommend you actually use periods, I just wanted them to work when fetching old posts created before I knew any better.

After that adventure, I have to tell you, I’m really loving WordPress. There are some incredible plugins that have done some amazing functionality extension for me. So far, so good.

If you want to make a mirror of your blogsome blog, you can use a single very powerful command to generate a snapshot of it from any Linux machine or Windows with Cygwin installed:

wget -k -m -r http://url

But this will only create a static HTML mirror of your website. It won’t allow you manipulate content or put it into another database. That leaves only one way to do it – request the entire site page by page, and parse each page individually. RSS is not reliable here, as most people have it set to only 15 or so items and parsing an enormous page make make PHP or your server run out of memory or alloted script execution time.

It’s a multi-step process, to be certain. It was actually painful to go through the process. Requesting over and over, debugging the script line by line. It takes several steps to get things right. But, eventually, I did it. I was able to export a Blogsome blog in its entirety – every entry, all the categories, all the comments with emails and websites …everything.

Slashdot was the same. It took some tinkering, but eventually, I was able to backup a very lengthy Slashdot journal. Again, in its entirety. I got every post, the date, etc. It was not simple, but it worked well. And I not only got them backed up, I merged them into a single database serving up… Small Axe 0.6 (which was a whole adventure of its own, taking current firsttube.com code and “neutralizing” it). Suffice it to say, when I saw all entries working and served in Small Axe, I had a huge smile. Turns out that the person I was doing this for decided against Small Axe (only because it doesn’t yet offer all the bells and whistles WordPress does, even if it is a beast). But it was irrelevant – the hard part was getting the data properly, and that’s done. Migrating to *any* blog database is possible if you have the time, inclination, and skill to write a SQL export/import script.

Here’s how it works:

* Cycle through each page of the blogsome blog. On each page, we get the entries, the URL, the postid, and other relevant info. We set a flag on each item to 0.
* As we retreive the items, we correct the path to images, spacing, smilies, etc.
* Then we cycle through each page individually. We have all the URLs already, so we go through each one and parse comments. It’s important to know that comment owner comments are marked up differently. As we get the comments, we upodate the flag and let the script run on its own. Our 900+ items took about an hour by meta-refreshing the fully rendered page every 3 seconds.
* As we go through the comments, we strip tags we don’t want, we fix emoticons, we fix internal links, spacing, etc. We must expose emails temporarily if we want them to transfer over.
* Finally, we import them all into a central database with an agreed schema.

If you have a Blogsome blog and/or a Slashdot journal you need backed up, I can help you do it. It’s not a simple process, but it is very accurate and preserves whatever data is exposed via HTML. So for the right barter, I would be very motivated to help. If I can simplify the process, I may create an open script to do this. But for now, I’ve got the code.

On a related note, I’ll probably release an updated version of Small Axe sometime in the not too distant future, because the amount of changing I’ve done and all the features I’ve just implemented are killer. Small Axe is FAR from WordPress caliber tested, but it’s SUPER simple and can do all the basics of a normal blog, including templating, smart per-domain caching, blocking by ip, username, email, or keyword, gravatar support, tons of configuration options, RSS and Atom support, threaded commenting, post locking, post expiring, browser identification, slug-based permalinking, and much more.