About this topic

  • Posted by uhhhh 1 year ago. There are 11 posts. The latest reply is from byron.

No tags yet.

  1. Uhhhh... don't get me wrong, I like the plug in. It does something nothing else can right now.

    But I have to tell you, even a brief inspection of your code left me with a lot of concern. There are so many things wrong security-wise that I quite frankly don't know where to begin.

    I suppose, if you're interested in diagnosing the issues with your software, the most logical place to start would be with coding the very fundamental Wordpress aspects of it properly.

    First of all, you have Javascript and callback references loading on <b>every page</b>. This is completely wrong. You have followed none of the procedures for proper plugin coding. Your plugin should be loading code only on pages where it exists; not on every page, bogging down rendering/load times for absolutely no reason.

    Once you've resolved this unbelievably large oversight, we can move onto the next of your oh-so-many issues. And I apologize in advance for my bluntness -- understand that I want nothing more than your program to be a success. But it simply can't be with these glaring issues.

  2. Hi uhhhh,

    If you're genuinely interested in helping, I can handle the bluntness. However, to say that I have followed "none of the procedures for proper plugin coding" is an unfortunate untruth (there are many procedures for proper coding that even a rank amateur like myself might bumble into getting right). I've read the Codex on WP coding style, and have knowingly chosen to ignore some of the syntactical edicts like using if/endif instead of curly braces. But I hope those venial sins will not prevent you from helping me suss out the important coding problems you've identified.

    That said, I could use a point on fixing what you've described. I've wanted to find a way to load the javascript only on pages that contain PhotoSmash galleries. But since they are injected via shortcode and in the sidebar, I didn't know of a way to load them with the enqueue scripts command, which I believe are processed before the shortcodes are processed.

    I have always assumed that the 'init' hook is called prior to the_content, which is where I believe the shortcodes are processed. I learned of the print_scripts hook recently, and haven't switched to using that hook for my enqueueing. So, given that it is unknown whether or not a gallery (or an upload form) will be displayed until
    after the shortcodes are processed, what would be an appropriate hook for issuing the wp_enqueue_script() commands? My understanding is that proper plugin coding would use wp_enqueue_script for enqueuing all javascript, even those that appear in the footer, but I wasn't aware that I could call it after the Loop.

    In an effort to reduce the javascript load, the latest version of PhotoSmash, still in development, splits the javascript into Admin scripts and scripts that get used on the front-end (and in some cases the admin as well...see changelog for details: http://smashly.net/photosmash-galleries/change-log/ ).

    I dearly hope that I haven't spent the past 15 valuable minutes feeding a troll, so with naive hopefulness, I look forward to your assistance.

    Cheers,
    Byron

    P.s. - As you were so kind to try to be helpful to me, I will attempt to return the favor. I understand that people come from all sorts of backgrounds and have had all sorts of experiences. One explanation for your bluntness might be that your experiences in life have led you to use it as a tool to get people to listen to you (as opposed to lacking the facilities to be cordial). With most people, it is quite unnecessary, though your immediate experiences might indicate otherwise. I work in the IT organization of a large company (no, I am not a coder by training or profession, merely by passion). We have a few technical people who are blunt, who get a pass for being so because they have extraordinarily high performance. They are not necessarily well liked, but their bluntness is tolerated because of the value they add to the organization. We also have a few people who are quick to describe why a proposed solution will not work, and they never seem to offer alternative solutions. These people are not well liked nor much valued. That is not a category one would wish to fall into. So, my wish for you is that you will find much success in life as well, and that as you do, you will enrich the lives of the people you interact with both technically and emotionally. If you're only capable of making them successful in their jobs, then they will very likely give you a pass on any collateral bluntness as long as it's within reason.

    Wishing you all the best, and hoping that you can help me improve the quality of PhotoSmash.
    Byron

  3. well said Byron :)

  4. Thanks Delia,
    It can take a lot of energy and time to be professional and cordial with people, to treat them as important beings created in the image of God. The anonymity of the internet makes it even easier to just roll over people. Here's one of my favorite passages from C.S. Lewis from his excellent essay The Weight of Glory:

    The load, or weight, or burden of my neighbour's glory should be laid on my back, a load so heavy that only humility can carry it, and the backs of the proud will be broken. It is a serious thing to live in a society of possible gods and goddesses, to remember that the dullest and most uninteresting person you can talk to may one day be a creature which, if you saw it now, you would be strongly tempted to worship, or else a horror and a corruption such as you now meet, if at all, only in a nightmare. All day long we are, in some degree, helping each other to one or other of these destinations. It is in the light of these overwhelming possibilities, it is with the awe and the circumspection proper to them, that we should conduct all our dealings with one another, all friendships, all loves, all play, all politics. There are no ordinary people. You have never talked to a mere mortal. Nations, cultures, arts, civilisations--these are mortal,... But it is immortals whom we joke with, work with, marry, snub, and exploit--immortal horrors or everlasting splendours.

    Cheers,
    Byron

  5. I had a rather enormous post typed up, but since you're okay with my frankness, I'll forego the courtesies and just synopsize:

    1. If they load it in a sidebar widget, obviously you will need it loading on every page since (presumably) that widget will be available throughout the site. That is a non-issue

    2. To have it only load on certain pages, you could ask the user for page IDs and then do a comparison so that it only loads on those pages (or, more simply, you could compare by way of how they implement your shortcodes, i.e. [photosmash=#]).

    3. Stop adding new features. Seriously, stop. You need to code-review the features you do have instead of just piling on new libraries and new tricks and kludging any problems you encounter with further band-aid fixes. From a brief code audit, it looks as though you may have started over once or twice, but mostly it just seems to be half-completed code and semi-finished (or abandoned?) features.

    4. I recently tested your (non-dev) version (0.7.03 I believe) on a fresh install of WP3.0, and it made the admin area almost completely unusable. I'm once again assuming that all the JS injection -- and perhaps an improper hooking to admin_head -- is the culprit, though I have not yet taken the time to verify, so I apologize in advance if that is incorrect. However, it's worth mentioning that you should be employing page-restrictions to your admin control panel so it does not load all over the place. If you need an example, go here: http://planetozh.com/blog/wp-content/uploads/2008/06/load-js-example.zip

    5. Validation. You need to validate every single iota of input from your users. Validation, validation, validation. This is the largest security concern with your plugin at the moment. You are vulnerable to SQL injection, though I am not going to disclose how publically, as that would be foolish, especially considering how a few clean-up passes on your code should resolve this relatively simple issue. If you wish for detailed information, leave your e-mail address.

    6. What's this 777 permissions nonsense? It is not the plugin's job to ensure proper permissions on a given host. Anyone running 777 permissions is vulnerable, period. I know you know this, given your warnings on the plugin info page. So why allow it at all? When you're designing software, security should trump convenience 100% of the time.

    7. Keep up the good work. Your plugin truly is amazing, and I hope it prospers like no other. If you have further questions, concerns, or comments, I have begun wading deeper into your code so as to familiarize myself more intimately with the issues you're facing. It may take me a week or two to get a solid grasp on some of the approaches you've taken, but I will be able to provide more concrete solutions in the upcoming days, if you're still inclined to listen. Though I encourage you to 'suss' them out yourself, as the experience will be invaluable and the accomplishment will not be diminished in that way.

  6. Hey Byron. I am always reading the posts here and the one sent by uhhhh got my attention.

    So I am here to just congratulate you for your answer that was really well articulated. I think you addressed the issue with no fear. I was really hoping that uhhhh would reply offering his help, but until now seems that he is on the category that one would not wish to fall into...

    Even though I am not religious, I agree with your words above. Would be good be living in a world where more people "follow" them, regardless their religious believes...

    Wish all the best and hope you keep doing your great work with PS and this Forun :)

    Cheers

  7. Thanks Jonh_mh,

    It looks like you and uhhhh were writing at the same time ;-) He/she left some good points which I'll address below. Life's short, we're all busy, and we gotta do the best we can and hopefully have some fun along the way! That part of the problem with writing plugins people stop having fun...well, life's too short to do something that isn't fun (or isn't necessary for your stage on good ole Maslow's Heirarchy).

    Cheers,
    Byron

  8. Hi uhhhh,

    Good points. I'll try to incorporate them where I can.

    1 & 2. (Loading the js on every page problem) You see the problem I've been stuck with. I don't want to have the user figure out which pages they're going to have the shortcode on, it's already complicated enough (as the support volume would indicate). Some users have PhotoSmash only on a couple of pages, some users have it on every page in their site, and that can be hundreds of pages (see the corn snake site for an example...there's a link buried somewhere in this forum).

    3) Agreed...The next big thing (after the one I'm currently working on) is just that. I even posted a blog post to that effect http://smashly.net/blog/facing-future/ back on April 22.

    The start over that you reference is related to a major switch from using a 3rd party library (Upload Class) for the image uploads to using the Standard WordPress upload libraries (you have to understand that this was my first real plugin so I am learning as I went). Unfortunately, I couldn't completely drop the legacy code because there were some people I helped build sites with it. I haven't figured out how to get them moved to the new code without redoing their stuff. There are indeed a few stubs for features that I backed off implementing, particularly around file/video uploads. I was concerned about the security implications of allowing the loading files that could not be verified. At least with images, WordPress handles that verification.

    4) If you figure out what going on with your test, please let me know. I have PhotoSmash installed on several WP 3.0 instances and none of them have problems. No one else has reported any issues around this either, and there are >1,000 active users from the best I can tell.

    5) Thanks for not post that publicly. Please email me through the Contacts page: http://smashly.net/contact/ as soon as possible. I have been very concerned about this topic and have tried to be diligent in using various WP/PHP methods for validating user input, but that doesn't mean that I haven't let something slip through. To guard against SQL injection, I use: (int), $wpdb->insert(), $wpdb->update(), and $wpdb->prepare. To guard against XSS, all user input is run through wp_kses. Please let me know of any holes you've found in this. I do feel it my duty to keep this code as safe for my users as possible.

    6) The 777 nonsense is a relic from the Upload Class that was used in the original versions. Some users systems would not allow the creation of folders with 755. Tons of problems. I leveraged code/ideas from NextGEN Gallery to deal with those issues. Finally, I figured out how to use the standard WordPress function for uploading images through the Media Library, and I gained integration with the Media Library as a result. Best move I've made with PhotoSmash. Again, I can't kill the old code without damaging certain people. I've been considering forking PhotoSmash, but haven't divined how to do it in such a way that the Legacy app gets forked and the good one continues on.

    7) Dude, if you've got some suggestions for making this thing tighter and more solid, I am 150% ready to listen. There have been a number of people who have stepped up and provided some suggestions, guidance, code, criticism, help on the forums, etc. I could not be any happier for their help.

    I do appreciate the kind words about the plugin. Hopefully most people will recognize that it's a pretty decent plugin. But for people who are more technically inclined and are thinking beyond just a photo gallery, I hope that they can see that it is a fair piece beyond just a gallery. You could use it to build data collection forms and display that data back in spreadsheet format (with or without images), or with PhotoSmash Extend to create a new post, categorized and tagged for each entry. You could make it do a Contact form, etc. But, the ugly code and my lack of styling skills don't do it any favors. The trouble has been that my vision for the plugin has outstripped my experience and available time to devote to it. So, any help I get is soooo appreciated.

    To have someone else looking at the code is a God-send. When they say 2 sets of eyes are better than 1, it is 1000 times more true when it comes to code.

    As I stated in that blog post, a major cleanup and reorganization is on the horizon. Maybe I'll make it to version 1.0 eventually!

    Thanks again for the comments. I look forward to what you find.

    Cheers,
    Byron

  9. Hey Byron.

    Thought this comment is best suited in this thread, instead of the one that I started, simply because the issue of code review is something best concentrated in one area. If I might make a suggestion, how about setting up a stickied thread for people such as uhhhh and myself, and any others who are looking through the code, to report issues and offer suggestions / fixes.

    Personally, I think a major thing for you to work out is the reliance on so many Switch blocks. There's absolutely nothing wrong with them inherently, but you're replicating so much code there, with only a few edge-cases where you change the values of variables. Simplifying code is always difficult (and I'll be the first to admit that I've come up with some terrible examples of code-soup before) - but the result of cleaning everything up really does bring a lot of benefits. It'll make the code more manageable, readable, extendable, and also bring the file-size right down.

    I wonder if maybe you've heard of MVC? It's a design pattern for coding. Google "Model View Controller". As far as I can tell, you're currently working with a very loose code structure. MVC can make that easier to handle by abstracting the code out into different classes. Essentially, the Model classes hold all the actual business logic that deals with Database control. In your case, you would have a Gallery class, Image class, possibly and AdminSetting class. The View classes hold all the presentation code. They don't deal with any real code, but instead are given data, show relevant data, and send data back to Controllers. Controllers are the classes that receive input and then send/retrieve data from Models.

    I've probably explained it very poorly, but it could be of great benefit for you. Part of the joy of programming is that it's a learning process - you've done brilliantly well so far, so I hope you see this not as a condemnation of a work, but an attempt to help you learn a bit more (if that sounds horribly condescending, I'm really sorry :P )

    Good luck, I look forward to working more with your plugin :)

  10. Hi WUH,

    Thanks for the comments and the suggestions!

    I have created a new forum section for PhotoSmash Development...will post a sticky at top directing folks there.

    I need to post out the latest Development version of PhotoSmash on WP so we can be on the same page. I've already begun unraveling some of what you're describing.

    I have used MVC briefly. Before I discovered WP, I used Code Igniter for a little bit, and really like the MVC pattern. You may be able to detect a little bit of MVC in PhotoSmash: shortcodeGallery() is the controller, bwbps-layout.php contains what amounts to the model and the viewer. They're not separated enough and I've actually been thinking about how I could make it more distinct. I want to make the objects so they are more self-contained and reusable. My ultimate goal is an Android and iPhone app that people can change a couple of parameters for and put them out on the app stores that will let people upload directly to their PhotoSmash sites. So, I want the API to be universal for that app as well as the uploading functions within PhotoSmash (minus maybe the signin piece).

    I hope you (and others) will continue to nudge me in the right directions...I've been the only PHP coder I know for far too long ;-)

    Cheers,
    Byron

  11. Hi uhhhh,

    If you've already sent the email on the problems you've uncovered, I didn't receive it. Obviously, I'm very interested in what you have to say since you're implicating security concerns. Please send to byron @ whypad . com if the Contacts page isn't working for you.

    Thanks,
    Byron

RSS feed for this topic