noel alanguilan

i just read that there’s this new and ‘clever’ worm moving about attacking sites using older versions of wordpress. if you’re running the latest versions–2.8.4 and 2.8.3–then you’re safe. if you’re running an older version then better upgrade now. i also read that sites hosted under wordpress.com need not worry about the worm.

what the worm does is to register itself as a user and then tries to make itself an admin via a security bug (which has been fixed early this year) then basically tries to hide itself. later on it inserts spam and malware in old posts. think of it. if google’s crawlers find spam and malware on your posts then your site will be removed from google’s indices. and that would not be good.

the wordpress devs have made it easy to upgrade to the latest version with just one (or two) clicks. i’ve never had problems with it. please upgrade.

wordpress 2.7 introduced me to post revisions — these are draft copies of your posts. these copies are saved in your wordpress database along with your posts, comments, etc. sometimes my revisions it gets to be ridiculously too many. apparently, the revisions are retained even after you have published the post thereby occupying unnecessary space in the database. so far, there is no built-in point-and-click method of getting rid of these revisions from the database.

i’ve found two ways to delete these revisions.

first, the hard way. fire up your phpadmin; choose your wordpress database; click on the sql icon and a window will pop up where you can enter and sql command:

DELETE FROM wp_posts WHERE post_type = "revision";

then click on ‘go’.

phpadmin will tell just just how many revisions were deleted. you’re done.

of course, there’s always the easy way. download and install a plugin called wp-optimize. this plugin can remove all post revisions plus optimize the database tables–the two functions that i usually use phpadmin for the maintenance of the sql tables (aka wordpress databases). other plugins have more database features but more is not necessarily better. its just more. this one’s right for my purpose.

i woke up with an update notice on the wordpress dashboard. i usually dread this event because it meant two days of updating nine wordpress installations that i keep. it takes two days because i have to backup my wordpress databases and files then manually delete almost all the wordpress files then upload the fresh. i have to do this nine times and my internet connection is relatively slow. tedious.

the good new is that with version 2.7 i can easily update my wordpress installations — they included a update script. heed the advice and backup your wordpress database and files before doing the upgrade.

once you got everything backed up and you’re sure that the backups are good take the jump and press that upgrade button. all of my upgrades were successful so far. there are two more upgrades i have to do.

i upgraded seven wordpress installations in less than an hour. that is a huge savings in time.

just a quick note before immersing myself in work again. its good to know that yahoo webhosting is somehow keeping up. they’ve made wordpress 2.6.2 as the default wordpress install.

version 2.6.3 of wordpress came out of nowhere. it has a security update for snoopy which gets the feeds being shown in the dashbard. they say the vulnerability is low risk but its still a risk hence the sudden upgrade. the good thing is that you only need two files to make the upgrade:

1. wp-includes/class-snoopy.php
2. wp-includes/version.php

just download them (they’re from trac.wordpress.org) and upload to your blog’s wp-includes/ subdirectory overwriting the two files there and you’re set.

this is the easiest upgrade i’ve done so far.

i was looking over the plugins page of one of the blogs i manage and the plugins program is telling me that it had disabled a plugin — reporting a file with an unfamiliar name and a series of ‘../’ before it. hmmm… alarm bells rang in my head.

a little looking and i find the file under the tmp subdirectory in my server. i tried deleting the file and the server kept giving me that ‘permission denied’ message. more alarm bells. i downloaded the file and changed the permissions to none executable and the only by owner and group — no public access and no one has write access.

taking a look at the file, i found that its a php file and the rest are hexadecimal values which leads me to conclude that its a malicious file and that its hiding it’s digital purpose — nothing good by the looks of it. i, myself, do not have the time right now to decode it so if someone out there is willing, i can send you the file. just leave a comment and i’ll send the file to you.

after preparing for it for more than a month, i wasn’t able to attend the first philippine wordcamp. bummer. i actually was dressed and ready to go already but fate and my mom had other ideas. you see, a few days before wordcamp was my mother’s birthday. she lives about 90 kilometers south of manila. she, along with my dad, boarded a very early bus to manila and was on my doorstep by 7:30 in the morning.

my mom wanted a late birthday celebration with her daughter-n-law, son and grandson.

how can i refuse?

so apologies to matt and migs for not attending wordcamp philippines 2008.

but my mom wins hands down.

i just got word that the wordcamp programme is up as well as the schedule for the talks which you can sign up for online. they have more sponsors up (thank you) so i updated my list — i might win something. i’d like a free black wordcamp shirt (hint hint). i already signed up for a couple of sessions and i hope to get my pass within the week.

it would be good to be on the lasallian grounds again.

blue will do if there isn’t any black (hint hint).

its been A terribly frustrating day. i’ve seen enough of “error establishing a database connection” to last me until the next version.

i was just trying to post something on one blog and experimenting on another and i keep getting this message. i have several wordpress blogs in different subdomains under alanguilan.com. one setup shouldn’t affect another but in this case its site wide — i get the same message on all the blogs at the same time. once for a few minutes things go well and i can access the sites but it goes south again soon after.

when i get an opportunity to check the sql databases with phpmyadmin the databases for each blog checks out fine. so my guess is its the main mysql database that’s getting messed up. there are utilities to repair the database and several backups of the thing via yahoo’s control panel so i’m not terribly worried. its just inconvenient for the moment.

so far the database seems stable and i haven’t seen the error message for an hour now. i hope it stays that way.

i created a test blog earlier and noticed that yahoo now installs version 2.3.3 of wordpress. previously they used version 2.0.2 as their default wordpress install. or was it 2.0.3? i don’t remember.

well, wordpress is currently in version 2.6. yahoo is still a little late but its better than nothing, yes? its certainly better than staying stuck at 2.0.2.

update: 2008.08.09: i don’t think that wp-cache works with wordpress 2.3.3 — i got database connection errors all over the place. heck, i couldn’t get it to run on 2.5.1. wp super cache might work but the folks at yahoo doesn’t let the users have access to .htaccess so that plug-in wouldn’t work with wordpress sites on yahoo webhosting. disabling the test blog and wp-cache solved the database connection problems. i’m going to try again later.

update: 2008.08.09 part 2: i took out the test blog but the database connection problems remain. so maybe the cause was not wp-cache after all but i do maintain that version 2 of wp-cache doesn’t work with wordpress 2.5.1 and newer under yahoo webhosting. i tested that fact, at least. maybe something’s up with yahoo.