wordcrunch
Forum Replies Created
-
Forum: Fixing WordPress
In reply to: 5.6 update critical errorI’m not getting the error, but is nobody concerned that the authenticity cannot be verified? Why is the authenticity not verifiable. Super sus.
Forum: Fixing WordPress
In reply to: How to disable the admin email confirmation page at login?Just a note in case others run into issues with placing this filter in the wp-config.php file – you have to put it at the end (after the line below) for it to work (filters need WordPress loaded first).
require_once( ABSPATH . 'wp-settings.php' );Thanks again @carike
Forum: Fixing WordPress
In reply to: How to disable the admin email confirmation page at login?@carike Spectacular. Thank you!!
I sent this email as soon as I saw your reply… Not sure why you didn’t get it, I didn’t get a bounce notice.
In any case (and for others who encounter this issue) I’ve added a script to replace $_SERVER[“REMOTE_ADDR”] with Cloudflare’s $_SERVER[“HTTP_CF_CONNECTING_IP”] and auto-prepended via .htaccess.
There are other bugs in Wordfence that this issue has revealed:
1. Wordfence should be using the stored home or site_url string rather than the email domain to generate the reset link. This seems like a pretty obvious bug that shouldn’t require any further diagnostic information.
2. Regarding https in the link, maybe checking the request uri protocol and matching that if it is https is the better way. Many sites force upgrade via HSTS or other dns-based techniques and the stored site_url & home options won’t be authoritative in these cases.
Furthermore, the reset email links are all messed up – the link is for a domain that is based on the send domain (different from the actual site domain – we use email.mg.mydomain.com since all email is routed through Mailgun – this is not uncommon, email should never be hosted on the same domain as a website! So the reset link is http://email.mg.mydomain.com/blablabla which is not a location that exists. Also why not https? http is not a protocol that is allowed due to HSTS.
Then, after correcting the link manually it does not work. Instead, I get a Not Found error:
Not Found
The requested URL /c/eJxVTktuwyAQPQ1eIhgYsBcsUrmWuqjUG1QwQLESmyg4inL7kk2lSm_1_tFpb62yw-pAgBAgUSBOCFxyO8_GIL5NYBfzbgTTYvvh7bpSaiVFTnUbihuNJUSfYAxGBk05SwUx54hektbjcHHlOK6NqRODpeNfwYtSy_cjt8zUfN8vlc4n6npjYM7p2UmjbQgBvTCGpLcRRxREMoGKhJOAbsz3nf7in8-Pr-HmHvUWc9opcR-3de_nS62ltuM1-wsKekrZ was not found on this server.I am currently unable to access the site except by logging in via ssh. Not that this provides a practical path to a solution…
Plz halp! So broken…
- This reply was modified 6 years, 3 months ago by wordcrunch.
Lol OMG of course! Thank you thank you thank you thank you thank you!
# BEGIN WordPress
# The directives (lines) betweenBEGIN WordPressandEND WordPressare
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
# END WordPress
# Wordfence WAF
<IfModule mod_php5.c>
php_value auto_prepend_file ‘/path_to_public_html/wordfence-waf.php’
</IfModule>
<IfModule mod_php7.c>
php_value auto_prepend_file ‘/path_to_public_html/wordfence-waf.php’
</IfModule>
<Files “.user.ini”>
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
Order deny,allow
Deny from all
</IfModule>
</Files>
# END Wordfence WAFThanks again for the support! I did try disabling the SSL verification but it’s still not getting past the page with the notice “The changes have not yet taken effect. If you are using LiteSpeed or IIS as your web server or CGI/FastCGI interface, you may need to wait a few minutes for the changes to take effect since the configuration files are sometimes cached. You also may need to select a different server configuration in order to complete this step, but wait for a few minutes before trying. You can try refreshing this page.”
Sent, thanks!
Apache 2.4.6-90
The directory already exists, by the way…
Forum: Plugins
In reply to: [Admin Category Tree] Update/Still Supported?Never mind. As of WordPress 5.0, tree view for post categories is built in to the WordPress core – therefore this plugin is no longer needed.