Tag: Wordpress

Visitor Information Disclosure in wp-statistics

Just noticed this and when Googling it has been picked up already, so this isn’t new, but the wp-statistics module (v13.0.8 for sure but likely other versions too) seems to be logging information into the “wp-statistics.log” file in the root directory of the site it is installed on. You can therefore access it and in some cases read the IP addresses of visitors to a site if they have the addon enabled by visiting domain.tld/wp-statistics.log.

You can block external access to it in the .htaccess file via:

<Files "wp-statistics.log">  
  Require all denied

I’ve logged an issue on their github page, hopefully they fix this soon 2021-07-22: a fix will be pushed out this weekend according to the latest update on the issue.

A quick google dork will show up a fair number of affected sites, including some… potentially embarrassing ones.

Themes – Light and Dark

I’ve added a theme switcher that allows you to change between a light and dark theme.

Before adding this functionality, the default theme was dark. As you may now be able to tell the default is a light theme! I much prefer a darker theme myself but I know most people prefer a lighter one.

The toggle can be found in the very top left of the site, next to the menu across the top of the banner. This will eventually be updated with some CSS so it looks better but for now it appears to work, however it does need some more testing which I will do over the next few days.

If you configure dark mode, a cookie will be set to remember your choice. I don’t yet have the Privacy page finished (don’t tell the GDPR police!) but more details on this cookie will be found there once it’s done.

I can’t promise this feature works on every browser yet but I’ll iron out the kinks as I find them and make it more efficient to boot. If I do anything interesting I’ll document it in a future post.

Davis update

I use the “Davis” theme on this site. It’s minimal and plain and has a built in dark-mode, which I’ve set as the default – my preference to be honest, eventually I’ll add a theme changer like on the old site. It does everything I need it to so far! I will eventually extend it but for now everything I need is there.

An update recently came out for it (1.13 >1.14) which changed a few things. The header in the banner across the top changed, as well as the headers used in posts. They’re now more standardised and “correct” according to the HTML spec, which is great. Unfortunately I decided to update the theme before realising these changes were implemented and it messed up a couple of my custom CSS rules.

I think I’ve fixed the issues now, but it goes to show that even on something as simple and minor as this blog, you should test your changes in dev before pushing them to production!

WordPress 5: Test post

This is a test post using WordPress 5. I wonder what it will look like?

I’ve updated already (as soon as I heard it had come out!) and so far it looks pretty good. The use of blocks in the editor is a bit strange compared to the old simple giant text box, but I can see myself preferring it once I get used to it. It allows me to more easily do things like this:

A Cover image. With text!

The built in fancy things are pretty cool. I can now really easily create a gallery which is something I’ve wanted to implement on here since I imported the First Bloom article over to this site.

Looking at editing previous posts, it looks different. I’m a bit nervous that editing old articles will cause some issues. I’m sure there won’t be any issues but the difference puts me off slightly, so let’s give it a go.

Here you can see what the new editor looks like:

The new editor when viewing a newly created post
The new editor when typing into a field. The cursor is at the end ofthe 2nd paragraph and you can see the text formatting tools above it, partially covering the previous paragraph.

Now take a look at the previously created posts when editing. It uses a Classic view which looks and behaves a bit differently:

The view when editing a previously existing post. Note the “Classic” heading letting you know it’s an older “classic” article
The view when typing in an already existing post. Notice the largertext formating box

I’ve now messed around with editing older articles and it all looks fine once they’ev been updated. I wonder why the WP developers couldn’t utilise the same editor everywhere. Having two experiences for the same task is always a bit jarring, but I’m sure there’s a reasonable explanation for it. Not an issue for me, anyway.

Aside from the editor, I’ve not really messed around too much with WP5. The theme I’m using still works with it, most of the admin side still looks the same. I’ve trialled the Twenty-Nineteen theme too. That looks very nice indeed. Definitely built for use with the new editor. Other than that, as I said, it mostly looks the same on the surface. I’m sure as I keep using it I’ll spot other changes. As a new WP user (well, sort of. I used it years ago!) it’s mostly the same. Which is great!

The only change I’ve had to make is the edition of a CSS rule to account for the captions on the images (the figcaption element) – This is of course a result of me using the dark theme and changing some of the colours and fonts around. Totally not a technical issue in the slightest and entirely my fault.

If I spot anything interesting I’ll be sure to write about it. Until then, I’m happy. Good job to the WordPress community. A solid release, upgraded without any issues on this fairly simple blog.

EDIT: When I attempted to publish this article, it came up with an error across the top. The fix for this was to de-select one of the images in the above post, then publish again. Not sure if this was a coincidence/one-off or a recurring issue. Next article, I’ll give it some more tries.