Behind The Blog

How to allow the upload of newer file types not listed in WordPress

Dan York — Tue, 28 Oct 2008 14:32:29 +0000

In putting together his post on the basics of programming with SIP Servlets, my colleague Wei Chen had a simple need: he wanted to include a link to a file containing actual SIP servlet code. The challenge was that the WordPress MU user interface was not letting him upload a file ending in “.sar“, which is the suffix used for SAR files (essentially SIP servlet versions of Java JAR files).

No problem, I thought, I’ll just go to the WPMU Site Admin menu and add “sar” to the list of allowed file types on the “Options” page:

While I was there I added “java”, “jar”, “jsp” and “war”, all of which could be file types we’d like to upload as we do more with Java.

Nope!

Try as he could, Wei was still unable to upload the SAR file. I tried changing his permissions. Still no. He sent me the SAR file. I tried. Nope.

And thus commenced several hours of looking through potential plugins and reading WPMU Forum posts until I finally figured out the problem:

The “Upload File Types” field on the Site Admin Options page only allows you to enter in file types FROM A PREVIOUSLY ESTABLISHED LIST OF ALLOWABLE FILE TYPES.

And of course “sar” and friends were not included in that included list of allowable file types. So it didn’t matter that I included the file extensions in that field in the WPMU web GUI - the underlying software was ignoring extensions that weren’t in its list.

Searching through the various files in my WPMU installation for the text of the error string I found (”grep -R” is your friend!), I finally tracked the issue down to the file “wp-includes/functions.php” and the specific function wp_check_filetype within that file. There, as shown below, there is a full list of the various allowed file types. My modification was simply this (my change in red):

‘class|jar|sar|java|war|jsp‘ => ‘application/java’,

After that, the upload worked perfectly fine because “sar” was already in the list of “Upload File Types” in the WPMU Site Admin Options page. Wei was able to upload his SAR file and complete his tutorial blog post. I learned a bit more about how WordPress is put together.

Hopefully this post will help some of you who might run into similar issues. (It’s also, quite frankly, a reminder to myself because, of course, this change will not survive a WPMU upgrade that replaces functions.php so I will need to add this to my checklist of post-upgrade items to check.)

For the sake of completeness, here is the entire function that I modified:

function wp_check_filetype( $filename, $mimes = null ) {
        // Accepted MIME types are set here as PCRE unless provided.
        $mimes = ( is_array( $mimes ) ) ? $mimes : apply_filters( 'upload_mimes', array(
                'jpg|jpeg|jpe' => 'image/jpeg',
                'gif' => 'image/gif',
                'png' => 'image/png',
                'bmp' => 'image/bmp',
                'tif|tiff' => 'image/tiff',
                'ico' => 'image/x-icon',
                'asf|asx|wax|wmv|wmx' => 'video/asf',
                'avi' => 'video/avi',
                'mov|qt' => 'video/quicktime',
                'mpeg|mpg|mpe|mp4' => 'video/mpeg',
                'txt|c|cc|h' => 'text/plain',
                'rtx' => 'text/richtext',
                'css' => 'text/css',
                'htm|html' => 'text/html',
                'mp3|m4a' => 'audio/mpeg',
                'ra|ram' => 'audio/x-realaudio',
                'wav' => 'audio/wav',
                'ogg' => 'audio/ogg',
                'mid|midi' => 'audio/midi',
                'wma' => 'audio/wma',
                'rtf' => 'application/rtf',
                'js' => 'application/javascript',
                'pdf' => 'application/pdf',
                'doc' => 'application/msword',
                'pot|pps|ppt' => 'application/vnd.ms-powerpoint',
                'wri' => 'application/vnd.ms-write',
                'xla|xls|xlt|xlw' => 'application/vnd.ms-excel',
                'mdb' => 'application/vnd.ms-access',
                'mpp' => 'application/vnd.ms-project',
                'swf' => 'application/x-shockwave-flash',
                'class|jar|sar|java|war|jsp' => 'application/java',
                'tar' => 'application/x-tar',
                'zip' => 'application/zip',
                'gz|gzip' => 'application/x-gzip',
                'exe' => 'application/x-msdownload',
                // openoffice formats
                'odt' => 'application/vnd.oasis.opendocument.text',
                'odp' => 'application/vnd.oasis.opendocument.presentation',
                'ods' => 'application/vnd.oasis.opendocument.spreadsheet',
                'odg' => 'application/vnd.oasis.opendocument.graphics',
                'odc' => 'application/vnd.oasis.opendocument.chart',
                'odb' => 'application/vnd.oasis.opendocument.database',
                'odf' => 'application/vnd.oasis.opendocument.formula',
                )
        );

Technorati Tags:
wordpress, wordpressmu, wpmu

ShareThis

Upgrading to WordPress 2.6.2…

Dan York — Mon, 13 Oct 2008 13:36:18 +0000

On Friday, I made the jump to bring this site up to WordPress 2.6.2, the latest WPMU release. I pretty much just followed the upgrade steps I’d outlined back in June. For those curious, here was the database backup command I used:

mysqldump wordpress --add-drop-table -u username -ppassword | bzip2 -c > wpmudb-backup-20081010.bz2

Obviously I removed the username and password, and yes, there is a space between “-u” and the username and there is not a space between “-p” and the password. I didn’t research whether that was required… I admittedly followed the steps in one of the WPMU Forum posts I found.

With WordPress 2.6.2, I did need to add the following lines to my wp-config.php file:

define( 'LOGGED_IN_KEY', 'text removed' );
define( 'LOGGED_IN_SALT', 'text removed' );
define( 'AUTH_KEY', 'text removed' );
define( 'SECURE_AUTH_KEY', 'text removed' );
define( 'SECURE_AUTH_SALT', 'text removed' );

Obviously I’m again removing the values specific to our system. These lines were shown to me right at the top of the admin interface after I logged in after the upgrade. I just copied/pasted and then needed to login again.

Thankfully by this point, we’ve made most of our customizations either in the custom theme we use for the site or in specific plugins, so really the only post-upgrade manual tweak I had to do was to modify kses.php to allow “skype” and “sip” protocols in URLs as I had documented earlier. At some point I should probably figure out how to make this a plugin so that it survives upgrades… in the meantime it’s not a big deal provided I remember to do so. (Upgrade checklists are your friend!)

I did the upgrade primarily because I knew I needed to keep the site up-to-date on security issues and fixes, but also because I wanted to try out the WordPress app on the iPhone now that we have made the switch from Blackberries to iPhones. As you can see in this test post, the WordPress app on the iPhone does work. It does, though, seem to have one rather annoying limitation for working with WordPress MU that I mentioned there and will write about in more detail in another post.

Meanwhile, we’re up and running on WPMU 2.6.2…

Technorati Tags:
wordpress, wordpress mu, wpmu, voxeo

ShareThis

Testing from an iphone

Dan York — Fri, 10 Oct 2008 17:56:13 +0000

So with our new iPhones I naturally had to try the WordPress app for the iPhone. I don’t know that I will write many posts this way, but it is nice to have the option.

The only technical issue so far is that ALL of our blogs seem to show up in the iPhone app as “Speaking of Standards” instead of their correct names.

ShareThis

Adding space above the Seesmic plugin video comment link

Dan York — Wed, 13 Aug 2008 20:55:03 +0000

Earlier today while fixing another problem here on the site, it was pointed out to me that the “Submit Comment” button was almost on top of the Seesmic raccoon logo for video comments:

This fix was relatively straightforward. I just headed into /wp-content/plugins/seesmic-wp-plugin and then found my way down to lines 179 and 180:

                

where, yes, indeed, I simply inserted two
’s on line 180:

                

And yes, the irony of adding BR tags after today’s earlier exercise was not lost on me. In any event, the little racoon is now not practically on top of the Submit Comment button:

And yes, it’s a kludgy hack that will undoubtedly be blown away if I ever upgrade the Seesmic plugin… but hey, the beauty of it all was that I could tweak it to fit our site.

Technorati Tags:
wordpress, wordpressmu, wpmu, plugins, seesmic, video

ShareThis

Getting rid of extra BR lines in WordPress MU

Dan York — Wed, 13 Aug 2008 20:39:04 +0000

Today we had a wee bit of fun with HTML tables… Jeremy, a member of our support team, published a post on our Voxeo Developer’s Corner blog that had an HTML

in it. Now it turned out that this was the first time in the 10 months that we’ve had this blog site up that anyone has used a

tag… and WordPress MU wasn’t terribly happy about it! What happened is that WPMU inserted a tag at the end of every line of HTML in the table. Annoyingly, the BR tags were inserted outside of the

tags with the result being that a browser bizarrely interpreted the BRs to be a bunch of blank lines before the table.

Naturally I blamed Rick’s CSS file for lacking some table handling and he of course blamed all my plugins for messing up the formatting. A Google search helped us find out that the answer was neither but instead was actually WordPress itself.

This web page started out with the key heading “Disabling WordPress’ slap-happy approach to
tags” and provided the answer. That web page is for WordPress 2.0.2 and we’re now running the equivalent of WP 2.5, so the file is no longer functions-formatting.php but instead simply formatting.php. As before it lives in /wp-includes.

Inside the file starting at line 62 was this:

function wpautop($pee, $br = 1) {
        $pee = $pee . "\n"; // just to make things a little easier, pad the end
        $pee = preg_replace('|
\s*
|', "\n\n", $pee);

One simple change of “$br = 1″ to “$br = 0″:

function wpautop($pee, $br = 0) {
        $pee = $pee . "\n"; // just to make things a little easier, pad the end
        $pee = preg_replace('|
\s*
|', "\n\n", $pee);

and… ta da… the BR tags went away and the table no longer had this mass of white space before it.

Fun, fun, fun…. (well, not really)

Technorati Tags:
wordpress, wordpressmu, wpmu

ShareThis

Tip: How to modify WordPress MU to allow embed objects (specifically for SlideShare)

Dan York — Fri, 01 Aug 2008 18:56:17 +0000

Okay, so this was a serious way to waste a morning! At 8:00am this morning I put up the post about my OSCON 2008 presentation and immediately noticed that the embedded SlideShare slide show was not visible. The problem was fairly simple to figure out. Here’s the embed code from the SlideShare page for my presentation that I had diligently copy and pasted into MarsEdit before sending to WPMU via the API:

OSCON 2008: Mashing Up Voice and the Web Using Open Source and XMLview presentation (tags: oscon2008 oscon microblogging identi.ca)

However, when I did a “View -> Page Source” in Firefox, this was all that was visible:

OSCON 2008: Mashing Up Voice and the Web Using Open Source and XML view presentation (tags: oscon2008 oscon microblogging identi.ca)

Without even looking through the code I could just see visually that there was a chunk of code missing.

Oops.

I thought I knew what it was and, sure enough, closer examination of the code showed that the element was being stripped entirely out:

Based on past experience with WPMU (documented here and here), I knew immediately this was an issue with the /wp-includes/kses.php file which, for very valid security reasons, strips out unknown tags when a post is created on the site (either via the web editor or posted through the API).

What confused me, though, was that SlideShare embeds worked perfectly fine in previous posts. So I had no idea why they weren’t working now. However, since that earlier post, I’ve upgraded to WPMU 1.5.1 and for whatever reason something has changed. It’s strange, though. was NOT in the kses.php file before (I checked a backup) and it’s not in there now. Which makes me wonder how I posted those earlier entries with SlideShare embeds and others with YouTube videos.

In searching the WordPress MU forums, I found this post from a year ago that was seeking a solution to embed YouTube and Google videos. On the second page of responses, I found a great solution from a developer named Hendy Irawan.

WARNING: THIS CAN BE A SERIOUS SECURITY RISK IF YOU DO NOT TRUST YOUR AUTHORS!

In our case (for blogs.voxeo.com), we tightly control who can post to this site, so this security concern is not a major one for us. However, if you are operating a WPMU site where you let anyone sign up and create a new WPMU blog, I would very STRONGLY recommend you be extremely careful (as in “Don’t do it!”) with this as you can allow for the embedding of all sorts of content.

Basically, Hendy’s plugin simply adds and to the list of allowed tags in kses.php. The nice aspect, though, is that it is in a separate file in the plugins directory so that it will survive upgrades. This seems an obvious thing to do but was not something I had seen previously. Great idea.

So following the instructions, I created the file /wp-content/mu-plugins/embed_allower.php with Hendy’s code in it and tried another upload with the SlideShare embed in it. The result was almost there (new code in red):

OSCON 2008: Mashing Up Voice and the Web Using Open Source and XML view presentation (tags: oscon2008 oscon microblogging identi.ca)

If you compare to the snippet above, you’ll notice that the element is missing and there are some other attributes on the object that aren’t there, either.

To accomplish this, I need to modify Hendy’s code, which is now shown below:

 array(),
		'type' => array (),
		'id' => array (),
		'height' => array (),
		'width' => array (),
		'src' => array (),
		'object' => array(
			'height' => array (),
			'width' => array (),
			'param' => array (
				'name' => array (),
				'value' => array ()
			)
		)
	);
	$allowedposttags['object'] = array(
	        'style' => array (),
		'height' => array (),
		'width' => array (),
		'param' => array (
			'name' => array (),
			'value' => array ()
		),
		'embed' => array(
			'style' => array(),
			'type' => array (),
			'id' => array (),
			'height' => array (),
			'width' => array (),
			'src' => array (),
			'allowfullscreen' => array (),
			'allowscriptaccess' => array ()
		)
	);
	$allowedposttags['param'] = array (
	        'name' => array (),
		'value' => array ()
	);
}
?>

I’ve now created a specific page for this plugin. If you put it in your /wp-content/mu-plugins directory it should now let you upload objects like SlideShare slide shows and other embedded objects.

If you do have any comments about this, please feel free to leave them here.

And again, please understand the security risks of using this. I would again strongly recommend NOT using this if you do not trust your authors. (On the other hand, if you run a corporate blog portal like we do, this may be perfectly fine.)

Technorati Tags:
wordpress, wordpress mu, wpmu, plugins, wordpress plugins

ShareThis

Enabling skype: and sip: URLs in WordPress MU 1.5.1

Dan York — Thu, 12 Jun 2008 02:45:45 +0000

Last week when I put up my request for readers to dial into some sample voice applications, I received the feedback (ironically via Twitter) that my “skype:” and “sip:” URLs weren’t working. They appeared in the text correctly:

skype:+990009369996076704
sip:9996076704@sip.voxeo.net

but they weren’t “clickable”. Instead of launching your Skype or SIP client, they went instead to:

http://blogs.voxeo.com/voiplab/2008/06/03/got-a-minute-to-make-a-couple-of-phone-calls-to-generate-some-traffic-for-screencasts/+990009369996076704

http://blogs.voxeo.com/voiplab/2008/06/03/got-a-minute-to-make-a-couple-of-phone-calls-to-generate-some-traffic-for-screencasts/9996076704@sip.voxeo.ne

Neither of which worked, of course, so people got the good old 404 screen. (Some of you may know where this is going…) A quick look at the code showed the problem:

skype:+990009369996076704&t;/a> or 9996076704@sip.voxeo.net

The “skype:” and “sip:” URL prefixes were being helpfully stripped out when the post was being published! The links were then relative URLs which were of course bogus.

The solution turned out to be similar to what I could do to solve my embedding XML problem… modify the kses.php file. There at line 338 was this:

function wp_kses($string, $allowed_html, $allowed_protocols = array (’http’, ‘https’, ‘ftp’, ‘ftps’, ‘mailto’, ‘news’, ‘irc’, ‘gopher’, ‘nntp’, ‘feed’, ‘telnet’)) {

And so a simple change of adding ’skype’ and ’sip’ to the end of the list like this:

function wp_kses($string, $allowed_html, $allowed_protocols = array (’http’, ‘https’, ‘ftp’, ‘ftps’, ‘mailto’, ‘news’, ‘irc’, ‘gopher’, ‘nntp’, ‘feed’, ‘telnet’, ’skype’, ’sip’)) {

seems to have fixed the problem. I had to re-enter the URL prefixes on the original post, but now the “skype:” and “sip:” URLs do work in the edited post.

Fun, fun, fun…

Technorati Tags:
wordpress, wordpress mu, wpmu, skype, sip

ShareThis

Successful upgrade to WPMU 1.5.1 - with some lessons learned

Dan York — Thu, 12 Jun 2008 02:26:09 +0000

Tonight I successfully upgraded blogs.voxeo.com to WordPress MU 1.5.1, the latest version. I’ve been wanting to do this since the release a month ago but I’ve held off to monitor the WPMU Forums to see what upgrade issues there were. The other challenge is, of course, that doing a site-wide upgrade requires setting aside a block of time in case anything goes wrong (and it did… see below). However, in light of reports of mass hacking of WordPress sites (see also here), I decided to make the upgrade tonight.

Following some of the links off of this forum post, I did successfully complete the upgrade, but I thought I’d record several lessons I learned in case they help others:

1. BACKUPS ARE YOUR FRIEND - Before doing anything, I had done the good old

tar -cvzf wpmu-backup-20080612.tgz wpmu

command in the directory above my WPMU installation to have a nice little tar file sitting there. This turned out to be critical as I did in fact need to restore it all to how it originally was after messing it up with #2 below. I also performed a MySQL backup to be safe although that turned out not be needed.

2. DISABLE ALL PLUGINS - This was mentioned in a few posts but for whatever reason I didn’t do it. Bad move. There was something about the OpenID plugins I was using that did not like the upgrade. It was somewhat bizarre in that the plugin to accept OpenID logins actually seemed to start working, which it hadn’t done before! However, it was causing a host of errors - bizarrely even when I reverted to a backup… so I wound up going into mu-plugins and blowing away the OpenID plugins from the directory (thanks to having the backup in #1).

3. YOU DO HAVE TO ADD THE SECRET KEY AND SALT - Just as detailed on Donncha’s blog post, on my first login to the admin interface I was given the warning that I needed to add two lines to my wp-config.php file. This was a very simple copy/paste into a shell window I had open.

4. USE ‘UPGRADE’ FROM SITEADMIN - Once you’ve copied the WPMU 1.5.1 files into your WPMU directory, the upgrade process for the individual blogs is a simple matter of choosing ‘Upgrade’ from the Site Admin menu.

5. THE ‘DEFAULT’ THEME GETS OVERWRITTEN! - After the upgrade, our home page was perfectly fine, but each of the individual blogs looked horrible. After a forced browser refresh it became clear that they had reverted to the default Kubrick theme. The issue became clear - the ‘default’ WP theme gets overwritten by the upgrade. In retrospect, this makes sense, but here’s the problem - we replaced the ‘default’ theme with our own that is visible on any of our blogs. The reason is simple… on this site, the only blogs that will be created will be with this theme. It will be the default for all blogs. Rather than create a separate theme directory and require blogs to be changed to that separate theme, it seemed to make sense to just replace the ‘default’ theme.

Oops.

Thankfully because of the backup from #1, restoring our ‘default’ theme was a trivial matter.

In a nutshell, those were my lessons from tonight. We’ll see if there are any further issues as we use it, but so far everything seems fine (outside of the fact that I have to go back and add the OpenID plugins back in - which will be for another day).

Technorati Tags:
wordpress, wordpressmu, wordpress mu, wpmu

ShareThis

Email subscription now available for this blog - and the challenges therein

Dan York — Tue, 29 Apr 2008 20:32:04 +0000

As noted over on our Voxeo Talks blog, I’ve now set up an email subscription option to our “All Voxeo Blogs” feed through Feedburner. For a reason I’ll discuss below, I’ve only enabled it for our all blogs feed.

However, given that this “Behind the Blog” blog is different from all of our other blogs, and also, quite frankly, because a reader requested it, I’ve also enabled the email subscription option for this particular blog. You can subscribe to just this blog via email by either entering your email address in the box in the far right sidebar - or by clicking this link. Follow the link in the confirmation email and, ta da, you’re done.

So why haven’t I done this for all of our individual blogs?

Simple. I can’t easily automate it and have it appear in the same place as the other subscription options.

Let me explain a bit more. If you go to our main portal page of blogs.voxeo.com you will see in the first sidebar under the heading “Subscribe” a link that says “Subscribe via email“. Click on that and a confirmation email later you are subscribed to the “all blogs” feed. Nice and easy.

We use Feedburner for all of our feeds mostly to get the stats and also because it provides nice options like this email subscription option.

Here’s the thing. That “portal” page uses its own unique WPMU “theme” (very creatively called “voxeo-home”) to deal with how we present entries across all blogs and other ways in which we want to make the portal page different from our regular blog pages. Because it is using its own unique theme, it’s trivial for me to add the “Subscribe via email” link. I just go into “sidebar1.php“, find the right place and add the link. Piece of cake.

However, all the actual blogs on the site use the same WPMU theme (”default”) and so they have the same sidebars by default. The problem, though, is this:

Each blog has a unique Feedburner email subscription URL.

So I can’t just add some magic to template sidebar and have this automagically work. As I’ve thought about this, I see a couple of choices:

Add only the All Blogs email subscription option - This is what I have done now. I’ve gone into the sidebar1.php file for the template and added the link to subscribe to the all blogs feed via email. This is simple and consistent with the other formatting. The problem of course is that it doesn’t let readers subscribe to only the blog they care about. Readers of this blog about WPMU may not care about all the other stuff we’re doing at Voxeo. Readers to “Speaking of Standards” may only be interested in our positions on standards. I’d like to offer the option. This choice doesn’t provide that option.
Manually add widgets to the blog sidebars - That’s what I’ve done here on this blog where I’ve added the widget over in sidebar 2 using the standard way to do so in the WP “Presentation->Widgets” menu. The good news is that I can offer the option, but the bad news is that it is off in a different area from the “Subscribe” options over in sidebar 1. (And for whatever reason, I can’t get the darn widget to say “Subscribe via email” on top, but that’s a different issue that I’m sure I’ll eventually sort out.)
Write some WP code to modify the template - I suspect the real answer is to write a WP function that grabs a URL from the database and inserts it in the relevant spot. In that way I’d enter the URL for the Feedburner email subscription for each individual blog into the database and then modify sidebar1.php in the theme to call the new WP function, which would pull the blog-specific URL from the database and insert it. Sounds cool… but I also don’t see me having the cycles to do that anytime soon.
Search for a plugin that does #3 - I suppose the other thing I can do is to search for a plugin that does what I described in #3. This involves searching through the various directories of plugins, trying out the code to see if it works with WPMU, etc. Maybe there’s one out there. (Heard of one?)

That’s why I haven’t yet rolled out email subscriptions for each individual blog. Have any of you out there solved this issue? What have you done? Is there a plugin you use for WPMU?

Technorati Tags:
feeds, subscription, feedburner, wpmu, wordpress mu, wordpress, plugins

ShareThis

Adding video comments to WPMU using Seesmic’s new plugin

Dan York — Thu, 24 Apr 2008 14:55:41 +0000

If you look down in the comments area of this - or any other blog post - you’ll now see a link that says you can add a video comment:

What’s going on? Well, I’ve added a new video plugin for Wordpress from the folks at Seesmic. Here’s brief video intro from me:

Adding Seesmic’s WP plugin to our WPMU site

The plugin was announced yesterday on Techcrunch and also on (Seesmic founder) Loic LeMeur’s blog. The folks at Seesmic even nicely created a little YouTube tutorial about the plugin:

Adding the plugin to WordPress MU was very straightforward. I downloaded the code, unzipped it and copied the directory into the “plugins” directory (NOT mu-plugins). I then went into Site Administration -> Plugin Commander and clicked on the “Allow” link to allow individual blogs to have this capability. Next I went into the admin dashboard for this blog and enabled the plugin for this blog. Ta da… video comments and embeds into posts are now enabled.

Why didn’t I just enable it across all blogs? Well, I like the granularity of being able to enable or disable it on a per-blog basis. The reality is that I’ll probably enable it for all the blogs on this site that I primarily run. But we may have other blogs here that others run (as Chris does with the Voxeo Labs blog) where they don’t want to use video.

One note I should make. In the Seesmic plugin configuration (for each blog), I have opted to allow “anonymous” video comments, meaning that someone does not need to have a Seesmic account in order to leave a video comment. There’s a checkbox there that enables that kind of posting:

Now, the one down-side I’ve already discovered is that in order to use it to embed a video in a post like this, I have to use the WordPress web editor to write my post. However, I almost never use this web editor because I’ve gotten very addicted to doing all my blogging offline using MarsEdit. However, I think odds are that when I want to embed a video, I probably won’t want to write as much text, so I probably won’t need all the shortcuts that I’ve gotten used to in MarsEdit. (I may also be able to go into the web editor, record and embed the video, save it as a draft, and then pull it down into MarsEdit and do further editing there - I’ll have to try it.)

Outside of that, it seems like a cool way to add video into the blogging platform. Let me know what you think. Hey… if you have a webcam, you can leave me a video comment!

Technorati Tags:
video, seesmic, wordpress, wordpressmu, wpmu, blogging

ShareThis