WordPress landmines
Aug 8th, 2008 by Lynne
You’d think a person with more than twenty years’ experience in the computer biz wouldn’t be foolish enough to download and install applications from untrusted sources, but sometimes even those who ought to know better get distracted by shiny, pretty graphics. Oh, the humiliation. :-)
I’ve been working on my pseudonyms’ web sites lately to get them ready before any submissions go out, and I followed a bunch of links to various WordPress template sites. Some of the themes were absolutely gorgeous and captured just exactly the kind of mood I was hoping to create, so I happily downloaded them and applied them to my sites.
Stupid.
Very stupid.
The prettiest templates I downloaded had seriously nasty hostile code embedded in the footer.php file. And how did I find this out? Hitting the sites from somewhere other than home. I usually don’t set up my personal security software to filter that kind of thing, but that’s not the case for everyone, certainly not corporations.
Now what do you suppose would’ve happened if I’d left that code in there and an editor who was reviewing one of my manuscripts tried to hit the site from her office? Her corporate web filtering software would’ve blocked my site, and the same thing may have happened when she tried to hit it from home, the library, or Starbucks.
Zoinks.
Lesson learned? Only download WordPress templates from trusted sites, like the WordPress Theme Directory. They automatically reject any themes that contain weird code like I found in footer.php. Still, it doesn’t hurt to take a quick browse through your theme files, even if you don’t know PHP. Any long strings of characters inside parentheses (basically a huge encrypted string passed to a function call or nested function calls) is probably a sign that the template designer is trying to do something sneaky, and you’d be well advised to steer clear. Pay particular attention to anything like base64_encode.
So what exactly was the sneaky designer attempting with the template you downloaded? Haxxoring? Rerouting links?
Hi, Jody! In some cases, they were embedding links to pr0n or hacker sites, and that alone is enough to cause problems for some web filters. It also looks unprofessional as all hell. The links weren’t always the same, either, so the code had an algorithm for dynamically determining what sites would be linked to.
And then there was some very unfriendly JavaScript, too. All this was obscured in encrypted code that would only be unscrambled at runtime — in other words, anytime someone loaded the page. It took me a while to figure out just what it was doing.
I’ve gone back through all my template files now, and there’s nothing in there that is obfuscated in any way. I’m just glad I caught this before any editors tried to hit my pseudonyms’ pages. That would have sucked, big time!