Upgrade to WordPress 2.2 or have your Admin PW stolen

OK It’s been a couple days now and this news is only spreading. If you haven’t heard already, there is an attack out there that allows the Admin PW to be compromised for any WordPress 2.1 and 2.0 blog. Only 2.2 and the yet unreleased version of 2.0 are safe and it will stay that way. The 2.1 is not a maintained version. So far, I’ve heard nothing about the plans to release a new 2.1. So at this point, for most people running 2.1, your only choice is to upgrade to 2.2.

I’ve stolen the admin PW of several 2.1 sites under my control and tested the sites of some of my friends to make sure they were safe even though they hadn’t upgraded.

There are two things that may make your 2.1 DB safe:

1. Your user named Admin is NOT user number 1.

2. Your database prefix is NOT wp_

If you want to upgrade safely and quickly, try my script.  The latest post about it is always at: http://www.thecodecave.com/EasyWPUpdate
If you want to see how we handled this at b5media, read here:
Guide to Disaster: How The Tech Team Handled WordPress Security Flaw

digg my story?

Feeling good on a Monday

Starting week number three at b5media and things are really starting to click.

I feel like I’ve settled in just a bit and I’m ready to get some real traction.  b5 is really growing and it’s great.  Over the last two weeks I’vehelped add a bunch of new sites to the network and we’ve got a number more coming in.

There’s a new theme that is being rolled out to a bunch of the blogs and I’ve helped with that, but due to the way it was implemented, we had some load problems as large common sections of html were being generated over and over again.  It was causing WAY more CPU usage than it needed to.

So, our excellent Linux guy Sean pointed me to a PECL module I’d not used before: memcached.

To quote http://en.wikipedia.org/wiki/Memcached:

memcached

 

From Wikipedia, the free encyclopedia

memcached is a general-purpose distributed memory caching system that was originally developed by Danga Interactive for LiveJournal, but is now used by many other sites. It is often used to speed up dynamic database-driven websites by caching data and objects in memory to reduce the amount the database needs to be read. Memcached is open source and released under a BSD license. It uses libevent.

Memcached lacks authentication and security features, meaning it should only be used on servers with a firewall set up appropriately. By default, memcached uses the port 11211.

Memcached’s APIs provide a giant hash table distributed across multiple machines. When the table is full, subsequent inserts cause older data to be purged in LRU order. Applications using memcached typically layer memcached requests and additions into code before falling back on a slower backing store, such as a database.

The system is used by several very large sites. Some well-known websites that use memcached are:[1]

It’s worked really well so far.  A few apache recompiles later and bam!  CPU load goes bye-bye.  With the initial partial rollout on a single channel we’ve tremendously reduced the load on the servers making 80 cache pulls per second instead of doing all of the db lookups and xml code generation.

I’m convinced!

I’m going to do some further implementation this morning we should be sitting sweet by EOD.

I’m also feeling good because I got the whole family up and did a morning workout in the new execise room I’ve setup in the garage.  I’ve also got Akaza hits nice and loud…

I’ve also got to send an email out to my Google Summer of Code student and we’ll get rolling on that this morning.  I’m looking forward to a good week.

Oh! and my pictures will be transfered by the end of the day so I can tell you all all about my toronto trip as I said I would two weeks ago…

Cheers all!

Delphi for PHP Update 1 Hits the streets

OK folks, the long awaited update has been released from beta testing.

You can get it yourself right here: http://dn.codegear.com/article/36406

There are some good fixes in this.  The big one for most folks will be the input filter fix.  For many the UTF-8 cleanup will be a god send.  Deployment tweaks are included too.

In fact here’s the complete list:

  • Fix to the IDE to ensure correct storage of UTF-8 strings in the .xml.php
  • Fix to VCL for PHP to parse .xml.php in UTF-8 mode
  • Save Project As… fixed (QC 43580)
  • Updated sourcecode documentation for the VCL
  • Fixed problem with PHP 5.2.1. The Input Filter extension is out of beta and function for filter data was changed to a new name, so Input object now takes that into account (QC 43607)
  • Fixed problem with vcl-bin folder. The alias is set to be a root alias, making it easier to configure on deployment
  • Added global var to specify if properties are html_decoded when read from the .xml.php
  • Corrected support phone list .txt file

Enjoy!

Another good day

Well, things went well today.   I added blogs to the  b5network, came to the rescue of some sites that were having trouble and got further into the infrastructure of b5.

I also got added to the b5 team blog listing.  That instantly takes me up to over 135 blogs linking into me.  So that’s a nice side bonus I hadn’t thought about.

Aaron has written a very nice welcome note on his blog today in The Tech Team Adds a Fourth Member :

Yesterday, I posted the announcement about Brian Layman joining the b5media tech team. We’re really excited about hiring him because we have some big plans. Brian is classified as “big guns” in my book. He’s got a lot of development experience and is one of the more active people in the WordPress developer community.

It was important that we found someone who understood the way WordPress worked and operated and how to make it dance. Unlike some competitors, we shout from the roof that we’ve drunk the WordPress kool-aid and aren’t going back. While we’ve toyed with Drupal and other software packages, we know who our daddy is and that’s WordPress.

Brian’s joining of b5media marks a redeclaration of our WordPress allegiance. It’s really great to have him on board!

I also got some details of the exciting stuff I’m going to be working on in the upcoming weeks.  Let me tell you, we’re gonna…

well actually I can’t tell ya… So you’ll just have to wait to see what kind of goodness will be coming out of the b5 in the near future.

(removed blog list as I have a better way to access this now)

Sweet Linus Benedict Turvalds, I’m working from home!

Long time readers of mine my might have had a suspicion.  You see when I have something big that I can’t talk about, I get severe writers block.  I can’t talk about what I want to talk about so I go from a one to two quality post a day period down to NOTHIN’ for three weeks!

Well this time it was VERY big!  After a 17+ year career as a Delphi programmer, I’ve started a new carreer.  Today was my first day working for b5media.  I am now one of an ever increasing number of professional making my living off WordPress, PHP and other Open Source programming. So, at the end of the day, I’m breaking the day of silence in the blogosphere with a post about joy and success.  That seems a more fitting remembrence.  Progress and fullfilment rather than silence.

You can read the official announcement here: “Brian Layman Joins Tech Team“.  It all started just over four weeks ago when I got a call from Aaron Brazell.  It was a fast whirlwind since then.  I’ll tell you all about my trip to Canada, dozen or so trashed cars, the flaming car of doom, all about b5media and other exciting goodies over the next few days.  There have been loads of firsts and progress being made on the Delphi for PHP front over the last two weeks that I’ll post about too.

For now, though, I just wanted to share the good news!

And Oh yes, I let my wife scoop the story.  She was soo excited about the chance to get a scoop!  No, Aaron, that pic wasn’t from today, but a month or so ago.  But I’m not making any promises I won’t be out there sometime…

See also: My interview with b5media

Capture an image to a fully paletted bitmap

This code does not look like it was mine originally, but I found it in a stray file on my hard drive.  I decided I didn’t want to lose it. 

 It takes a picture of any component you pass in and populates a TBitmap with an image using a custom palette built from device context of the component you are capturing.

[Delphi] 

{******************************************************************************
  ComponentToImg
 ******************************************************************************}
procedure TForm1.ComponentToImg(CHandle: HWND; x: Integer; y: Integer; Width: Integer; Height: Integer; bm: TBitMap);
var
  dc: HDC;
  lpPal : PLOGPALETTE;
begin // ComponentToImg
  // Test width and height
  if ((Width = 0) OR (Height = 0)) then exit;
  bm.Width := Width;
  bm.Height := Height;

  // Get the screen dc
  dc := GetDc(CHandle);
try
// If the device doesn’t have a handle, we can’t do anything with it.
  if (dc = 0) then exit;
  // Do we have a palette device?
  if (GetDeviceCaps(dc, RASTERCAPS) AND RC_PALETTE = RC_PALETTE)
  then begin
    // If so, allocate memory for a logical palette
    GetMem(lpPal, sizeof(TLOGPALETTE) + (255 * sizeof(TPALETTEENTRY)));
     try
        // Zero it out to be neat
        FillChar(lpPal^, sizeof(TLOGPALETTE) + (255 * sizeof(TPALETTEENTRY)), #0);
        // Fill in the palette version
        lpPal^.palVersion := $300;
        // Grab the system palette entries
        lpPal^.palNumEntries :=GetSystemPaletteEntries(dc,0,256,lpPal^.palPalEntry);
        // Create the palette
        if (lpPal^.PalNumEntries <> 0) then bm.Palette := CreatePalette(lpPal^);
      finally
        FreeMem(lpPal, sizeof(TLOGPALETTE) + (255 * sizeof(TPALETTEENTRY)));
      end;
  end;
  // Copy from the screen to the bitmap}
  BitBlt(bm.Canvas.Handle, 0, 0, Width, Height, Dc, x, y, SRCCOPY);

  // Release the screen dc no matter what happened above.
finally
  ReleaseDc(0, dc);
end
end;  // ComponentToImg

procedure TForm1.Button1Click(Sender: TObject);
begin
  ComponentToImg(self.Handle, 0, 0, 800, 600, Image1.Picture.Bitmap);
end;
[/Delphi]

Techno-sailing through WordPress FAQs

Aaron Brazell is in the middle of a GREAT series on how to enhance WordPress.  He’s been going through several of the questions that have been presented to b5media‘s support forum.  I’ve found his solution for Category Based Themes very interesting because I expect the Google Summer of Code 2007 WordPress Project I am mentoring may build upon this and similar solutions.

 Here’s his guide to this series as it exists today:

Series Guide

  1. WordPress FAQ: How Do I combine Blogs?
  2. WordPress FAQ: What’s up with the Amazon Plugin with WP 2.1.x?
  3. WordPress FAQ: How Do I Use Category Themes?
  4. WordPress FAQ: Where did my Preview Link Go?
  5. WordPress FAQ: How Do I Use Child Pages More Effectively?
  6. WordPress FAQ: How Do I Fix the Blogroll Category Issue in WordPress 2.1

I’m looking forward to seeing what else Aaron presents to us!

A non-CodeGear patent application on “compiling” Object Pascal code?

I read in the Newsgroups today that there is a new patent that’s been filed that affects what Borland can do with Object Pascal.  According to this patent application, Mirkazemi; Aram; (Lindisfame, AU) ; Besharati; Shahram; (Kingston Beach, AU) would have a US patent upon producing JavaScript code from Delphi’s Object Pascal and several other languages

Who knows if this will fly, but the idea of restricting what a company can do with the product they’ve made is just….  irratating!

A key quote from the patent application:

9. A method for producing a web application that runs natively in a browser, comprising: writing in a high-level language to develop a source file; parsing the source file to produce a semantic map; and processing the semantic map by emitting browser-side JavaScript comprising at least one dispatcher having a set of parameters to invoke a code segment utilizing the same set of parameters.

10. The method of claim 9 wherein the high-level language comprises a high-level language from among the programming languages consisting of Ada, C, C++, C#, COBOL, ColdFusion, Common Lisp, Delphi, Fortran, Java, Object Pascal, SmallTalk, Visual Basic, and Visual Basic.NET.  

So, this program will take all Delphi source code and forms and convert them to a web app in javascript.

 First, I think it is hilarious to hear javascript described as a low level language, but that’s beside the point.

If Borland wanted to provide javascript as a target, as they do .NET and W32, they SHOULD be allowed to.  It is THEIR product.  They of course would have to do the work themselves, but it is a programming language they’ve made.  Why should they be restricted?  Especially when they’ve been nice folks and allowed programs like Free Pascal the benifit of the Delphi’s innovation.

 BAH!  It’ll probably pass with a rubber stamp of approval.

CodeGear Names New CEO

Marco caught an interesting story in InfoWorld, today.

As EWeek says:

Borland Software’s CodeGear development tools unit has changed leadership, naming Jim Douglas, a veteran of the high-tech industry, to the position of chief executive officer.

Jim Douglas will be replacing former CEO Ben Smith who guided CodeGear into existence.  EWeek continues:

Smith, who was brought on for his ability to foster startups through their initial phases and broker deals, has decided to step aside to return to the private equity, acquisition and venture arena, CodeGear officials said. Smith had been onboard with the CodeGear team, then known as “DevCo” internally, in a consulting capacity since February 2006.

About Douglas they say: 

Douglas most recently was president and CEO of ReShape, an electronic design automation startup backed by the venture capital firm New Enterprise Associates. Douglas led the company’s transition from an engineering-services firm to a software-business model. These efforts resulted in the sale of the company to Magma Design Automation.  

So, Smith was there to start CodeGear up, and Douglas is now there to guide CodeGear into the future.  I wonder what other changes are in the wind.  Obviously, with this new quarter, there’s going to be a new set of challenges that Douglas is believed to be the right man to face.  Obviously this sort of thing doesn’t happen overnight.  So, my question is what’s the next thing we will see as CodeGear marches forward?

How to have a central VCL for PHP location for all your websites

I have a number of sites that on which I want to use the VCL for PHP library components with Delphi for PHP creations.  I don’t want to waste uneeded space for a bazillion copies of the VCL.  As far as that goes, I don’t want to have to sit through the deployment wizard every time either.

You could edit PHP.ini and add the location to your include path, but the VCL for PHP is MORE than just a textual code libary.  It includes image files as well, for things like the dropdown arrow in the combo boxes.

 So what’s a person to do?  Well, it’s simple.  Create some symbolic links!

Just put the VCL in your root directory or at least one that can be accessed with a common path from the your website directories.  I use the root since I can use ~ to get at it easily on Linux.  It could just as easily be /usr/local/lib/vcl or d:\VCL.  Then in your directories you just put two symbolic links, one named vcl and the other named vcl-bin. Both pointing to the vcl directory you made.

Here’s the step by step for *nix systems:

  1. Upload the whole VCL folder to the root web directory
  2. Telnet/ssh into the account
  3. Change to the directory for your website
  4. Run these two commands
    1. ln ~/vcl
    2. ln ~/vcl vcl-bin
  5. Repeat steps 3 and 4 for all of your sites.
  6. When you deploy, just grab the files in your project directory and upload them.  No worrying about the VCL any more.  You should be able to make a batch file that does that step!

That’s it (oh and just in case your font makes “ln” hard to readand that is a lower case “LN” as in link.)

 On Windows, you should be able to do the same thing.  If you have Vista you have native support for symbolic links.  And in XP, you can use NTFS links.  But I’ll leave it up to you to look up those technologies.  With that sort of thing, if you aren’t able to find and digest how to do it, you’re probably better off just using the deploy tool.

 Hope this helps someone!  It’s made my life a little easier.

Windows Implementation

Kevin Berry came up with this windows implementation:

For my Windows 2000 webserver, which I have total acces to, below is how I followed Brian Layman’s advice to made this work.

1. Downloaded linkmagic.exe from
http://users.pandora.be/jbranders/linkmagic.exe

2. Ran linkmagic.exe (setup program) on my webserver.

3. Launched Junction Link Magic program.

4. Created empty “vcl” folder in my clock project folder in my webserver root (c:\web\htdocs\clock\vcl) and selected this vcl folder as my junction folder.

5. Selected my true vcl folder loaded with vcl files as my destination folder (c:\web\vcl)

6. Clicked “create” button

Now my D4PHP clock sample program runs just fine in c:\web\htdocs\clock with only one main vcl installation on my webserver.

I suppose I could use the Junction Link Magic program to create new vcl junction folders in other vcl project subfolders on my webserver, but I discovered that once the first vcl junction folder is created, I can create more of these just by copying an existing vcl junction folder into a new project folder and choosing cancel when the file overwrite prompt appears. If I delete a vcl junction point folder, the real folder and its files don’t get deleted.

I for one don’t want different versions of my vcl all over my webserver in different folders (assuming I’ll have lots of web projects someday). For me it’s just simplest knowing the latest and greatest vcl library is always in one spot on my web server.

I don’t know if one could duplicate the directory structure of a windows hosted web from a remote server on one’s own computer to create the junction folder and then ftp that junction folder out to the remote server and preserve the redirection. If so, that would be great.

For my webserver, this is pretty nifty, Thanks again to Brian for the workaround until Codegear/Qadram figure out what I hope to be a better vcl deployment method.

Alternative Solution

David Plock also suggested another methot that uses a VCL-BIN alias. Jose Leon Serna provided the final fix to get this working. Kevin has done a great job of writing up these steps as well:

Options Indexes MultiViews
AllowOverride None
Order allow,deny
Allow from all

3. In my php.ini file I added the following so that php will know in which folder to find the vcl folder.

include_path = “.;c:\web”

If I had dropped my vcl folder into my root directory on my webserver, the entry would have been:

include_path = “.;c:\web\htdocs”

4. Jose added the final piece to make this work. In my vcl.inc.php file I modified a line so that the alias name gets passed properly to my webserver. The line that mentions vcl-bin needs a forward slash in front of vcl-bin so the final line appears like this:

if (!array_key_exists(‘FOR_PREVIEW’,$_SERVER)) $http_path=’/vcl-bin’;

5. Make sure all configuration file changes above are saved and then restart the webserver.

Now you can drop D4PHP projects in any subfolders or even subfolders of subfolders of your root directory on your webserver and they work.

The nice thing about this solution in addition to it being a single vcl deployment is that it seems to me any web hoster can implement it once for
the entire web server and any subscribers can simply ftp D4PHP web files to their own folders on the server and they’ll work.

Thanks Brian, David, and Jose for two ways to make a single vcl deployment work!!!

If you want to see this solution in action, you can visit these links (on my slow webserver) for as long as my internet service provider leaves my ip address alone. The vcl folder is outside the web root and only clock.php, clock.xml.php, and background.gif are in each of these folders.

http://24.2.90.16/clock.php
http://24.2.90.16/clock/clock.php
http://24.2.90.16/clock/clock/clock.php
http://24.2.90.16/clock/clock/clock/clock.php

There you are. Two different methods proven successful in the field! Enjoy!