Select Page

Securing a WordPress blog

by | Oct 3, 2007 | evilzenscientist, Technology, Uncategorized, wordpress

 I’ve been hosting a family blog and photo site for a good friend for over a year.

They decided recently to ‘lock down’ the site and restrict access to both the blog and the photos to family and friends only.

I spent some of yesterday doing this.

I’ve extensively use WPG2 to integrate WordPress and Gallery2 – and I use the permissions and roles within Gallery2 to successfully limit access to pictures. The most striking example of this is with my sisters Cub Scout web site; non members can read blog posts; but not view pictures.

Securing the WordPress side was a little more tricky. Drupal has a very strong permissions module -especially useful for the anonymous user. Nothing like that for WordPress.

In the end I used the post-levels plugin from Filipe Fortes – it needed some SQL mungling to work with WordPress 2.3 – but the end results were pretty good.

gtr.com

post-levels update for WordPress 2.3

by | Oct 2, 2007 | evilzenscientist, Uncategorized

I made an update for the post-levels plugin so it works with WordPress 2.3

The plugin was throwing sql errors.

WordPress database error: [Column ‘post_id’ in field list is ambiguous]
SELECT post_id, meta_value FROM wp_postmeta, (wp_posts LEFT JOIN wp_postmeta as pl_wp_postmeta ON (wp_posts.ID = pl_wp_postmeta.post_id)) WHERE post_id = ID AND meta_key = ‘links_to’ AND (post_status = ‘static’ OR (wp_posts.post_status = ‘publish’ OR (wp_posts.post_status = ‘private’ AND (pl_wp_postmeta.meta_key = ‘post_level’ AND pl_wp_postmeta.meta_value <= 1 ))))

WordPress database error: [Column ‘post_id’ in field list is ambiguous]
SELECT post_id, meta_value FROM wp_postmeta, (wp_posts LEFT JOIN wp_postmeta as pl_wp_postmeta ON (wp_posts.ID = pl_wp_postmeta.post_id)) WHERE post_id = ID AND meta_key = ‘links_to_target’ AND (post_status = ‘static’ OR (wp_posts.post_status = ‘publish’ OR (wp_posts.post_status = ‘private’ AND (pl_wp_postmeta.meta_key = ‘post_level’ AND pl_wp_postmeta.meta_value <= 1 ))))

Here’s the fix:

 

function postlevels_query_cleanup($sql)
{
    global $wpdb;

// fix for WordPress 2.3
// evilzenscientist – 2 Oct 07

    $sql = preg_replace(“/post_id/”, “wp_postmeta.post_id”, $sql);
    $sql = preg_replace(“/, meta_value/”, “, wp_postmeta.meta_value”, $sql);
    $sql = preg_replace(“/meta_key/”, “wp_postmeta.meta_key”, $sql);

// end

 

Here’s the new plugin. It’s not really tested – except it works for me.