thedeadone.net » TDOMF

Where has TDO Mini Forms plugin gone?

Mark Cunningham — Thu, 10 Nov 2011 17:00:00 +0000

I haven’t been updating or working on this WordPress plugin of mine for a while now. And it seems it has been removed from the WordPress.org plugin directory.

I’ve put up a temporary mirror link on the page here for it for those desperate enough to want it now. However an exploit was reported against it. Details below.

tl/dr An exploit was reported to WordPress support. The plugin was pulled. Will be fixed.

I think the term “exploit” is a not completely true. I’m not able to replicate the exploit on my web servers.

You have to have a public visible form, with an upload form and allow anonymous users to upload. The reported exploit uses only the first form, but in theory any form could be used. You temporary upload folder must also be publically available, but if you the post is automatically published, then the uploaded file will be publically available.

But you must also have your webserver configured to execute files as .php even if their extensions are .jpg. On my host and even on my default test setups, this is not the default. I’m not a big enough web server admin expert to properly understand all the ins and outs of this part, but generally it’s outside the scope of wordpress or tdo-mini-forms.

Example, the exploit user would upload script_to_run.php.jpg to your upload form. They’d then run it using a URL (if it’s public from the temp folder (uploads are kept for one hour). My setup would always treat that file as Image file and so it wouldn’t run.

See this thread from wp-hackers mailing list for more info on it.

If you think you’re currently affected, remove the upload widget from your forms or only allow trusted users to upload files.

WordPress does have some code now to remove the double extension. So I plan to update tdo-mini-forms to do this. I’m afraid I don’t currently have a test bed or a huge amount of time to fix this, but I will do it in the next month or so.

Pet Projects, TDO-Mini-Forms and Forums

Mark Cunningham — Wed, 02 Mar 2011 13:03:26 +0000

Following on from my previous post (“for fun or for success”), I keep thinking about a blog post I read from Jeff Vogel called The Bottom Feeder: Three Reasons Creators Should Never Read Their Forums.

If I have learned anything from writing Indie games for a living for fifteen years and there are plenty who would say that I haven’t, it is that it is usually a bad idea for creators to visit online forums discussing them and their work. It doesn’t lead to happy ends.

He offers three salient points:

It’s Not Productive To Read How Much People Hate You
It’s Not Going To Be Helpful
You Might Get Suckered Into Getting Angry

I think there is certainly some truth in what he says. I’m only thinking of TDO-Mini-Forms, a project that was done for fun but became something else.

When I started it, I had a small group of users from the WordPress forums, I listened to them, made releases to address there issues and enjoyed the feedback. I setup this forum (I thought I was being clever using TDO-Mini-Forms to power a WordPress blog as a forum!) as a place to informally handle discussion, feedback, feature suggestions, bugs, etc. It was very open creative time and it was with pride that I saw people creating interesting sites using my plugin. This one-on-one feeling with users is great. It really motivates you to help them. Some bought me books or gave me donations as thanks.

For the profit-oriented readers, working with users directly like this, I got bigger and more donations than any other method. It seems people are quite happy to use your plugin for free but if they spend end up interacting with the author in a positive (not necessarily successful) way, they often give something back where they might not have done so before.

But user numbers grew and grew. And it hit a certain critical mass of users where I wasn’t meaningfully engaging with any of them. I think I hit what Jeff Vogel is talking about, though I didn’t have fans, I had users.

Every new feature or change I made would both be liked or derided by users including those same features previously demanded. Coupled with WordPress upgrades/changes that occasionally broke TDOMF outright, introduced new subtle bugs, or highlighted ones that no-one noticed before, users demanded fixes and patches. The stuff I wanted to do, I couldn’t.

Forums contain a cacophony of people telling you to do diametrically opposite things, very loudly, often for bad reasons. There will be plenty of good ideas, but picking them out from the bad ones is unreliable and a lot of work. If you try to make too many people happy at once, you will drive yourself mad. You have to be very, very careful who you let into your head.

I fell into this trap big time. My reaction? Dragging my heels until I stopped working on TDO-Mini-Forms completely. It was a slow long process, though. I still tried for a long time, replying to emails, offering advice over twitter, trying desperately to keep up with the forums, etc. But it poisoned my enjoyment.

I was creating/maintaining TDO-Mini-Forms for fun, a pet project. I was learning PHP, WordPress, web programming, DB management, etc. as I went a long. Many of my early mistakes are buried in TDO-Mini-Forms (and occasionally loud users remind me of these failures). I felt I couldn’t evolve or play with TDO-Mini-Forms, in case I broke people’s existing set-ups, so it became stale. Work on it was maintenance, backwards compatibility testing, etc. and I wasn’t getting much out of it. Even the few donations I got, which I heartily appreciated, were not enough incentive. I was trying to please everyone and ended up not just frustrating people, but frustrating myself.

If I were to do things different, I’d treat TDO-Mini-Forms more as a product (as I suggested in my previous post). Create a layer between myself and the users and even try to make some money off it (in fact many users have suggested I do this). Of course hindsight is great and by now there are a few alternatives out there, and where do I find the time?

I still get the occasionally email about TDO-Mini-Forms, sometimes I reply, sometimes I just leave there unread, which is unfair to the sender and myself. I see the occasionally tweet or blog entry, sometimes positive, sometimes negative (those make me sad). But I rarely respond. I’ve so far managed to avoid, number 3: You Might Get Suckered Into Getting Angry.

I never read the forums that I setup and I think I may end up deleting it outright. I no longer link to them directly from my home page. I’m not sure about the best approach to this as there are new posts every day on it but WordPress.org has it’s own forums for TDO-Mini-Forms (like it does for every plugin). I may just redirect there one day and leave it at that. I’d be inclined to keep the forums if they readership spilled out into other topics that I do have an interest in, like roleplaying or writing, but that’s not going to happen. I barely blog about WordPress as it is. There isn’t much overlap. Even when TDO-Mini-Form users comment on my blog, they are looking for advice or help.

I often evaluate WordPress plugins that I use for my own blog(s) through the lens of my experience of TDO-Mini-Forms. If it’s a simple, one-job, type of plugin then that’s normally okay, if it works. If it’s a big popular plugin and the author seems to be serious about making something off it (such as they work with WordPress professionally, or they have big donate panels on the plugin), that’s a good thing. Means they are going to support it across versions of WordPress etc. (I wish I had done this with TDO-Mini-Forms).

Also, if they themselves are using the plugin on their own blog, that’s a very hot indicator. It’s core functionality will be maintained across WordPress upgrades. (I no longer use TDO-Mini-Forms actively anywhere).

Anything in-between, I get a little suspicious, fearful it won’t get updated with the next major WordPress overhaul or that minor bugs will never get fixed. I wouldn’t depend on such plugins. (That’s where TDO-Mini-Forms now lies, big plugin but not actively in use by author and not “productized” in any way).

Now hopefully I’ve gotten all that TDO-Mini-Forms angst out of me! Next rules for Lost Heroes RPG and a blog post about dream worlds in roleplaying settings.

For fun or for success?

Mark Cunningham — Mon, 28 Feb 2011 12:30:47 +0000

I’ve been thinking about this in the back of mind for a few days, but I find myself looking at my projects in two ways. Pet Projects or Products.

I hear a lot about how to make creative works successful, you know mantras like “fail early, fail often”, etc. On one hand I have a ton of unfinished short stories, ideas and notes filling up my notebook and unfinished scraps of software on my laptop’s harddisk. Yet I still preserve with my Lost Heroes RPG, a project perhaps I should have quit on an age ago when it has become apparent it’s not going to be some sort of whirlwind success or if a minor success (for the record, I’m not going to quit on it and I’m currently working on a rules system for it).

Makes me think, there are two types of projects, defined more by your attitude towards them than anything else. A product is something you’re trying to “sell” (in some abstract sense) and if it doesn’t sell or find an audience, it’s a failure. But a pet project is something you do because you want to do it. It’d be great if you find an audience, but if you don’t, so what?

For me products are the stuff I do in work. I get paid to do them and they are done at a professional level. You have to be ruthless about it, avoid adding new features, doing everything as right as you can straight up.

Pet projects are stuff I do for fun, in my spare time. I make mistakes, I learn. I explore options and tangents and cut away stuff at my own impulse. Lost Heroes RPG is my on-going pet project. I’ve learned about writing, mythology, game design, etc. and it’s brought me in contact with other gamers and writers. Even if, no-one else reads it, I’m still enjoying working on it.

It’s a little bit about sanity too, if I’m working on something because I’m enjoying the work, then “failure” is only what I chose it to be. If it’s a product, I can prepare myself for failure by simply distancing myself. I’m not talking about what failure is, only how I treat and react to my spare time projects.

TDO-Mini-Forms was also a pet project, one that perhaps should have been a product in hindsight. I was working on it because I was enjoying it. I was learning about PHP, coding for the web, working with WordPress and so on. But people were and are using it, expecting a supported product. That’s a bit of a disconnect, working on something as a pet project but random people consuming it as a product. I would have been happy with a small number of users and supporting them, while extending it and learning how to do things right.

But the number of users is quite high. Still not getting used to google occasionally telling me about some random dude on Twitter who stating that it’s utter crap because of X, Y or Z. It stomps all over why I was enjoying working on it. Turning a pet project, not into a product, but into a chore was/is a death knell working for the appreciation of faceless strangers. Will I start up work on TDO Mini Forms? Maybe, but I’ll need an attitude adjustment towards it first. I’d be tempted to start over, doing something from scratch, taking what I learned from TDO-Mini-Forms. I’d also need a machine that gives me reams of extra spare time to work on it as well.

I think if I were to start trying to write a novel (I have a few ideas) for example, I would be treating it as a Product, taking on board everything I’ve learned from writing Lost Heroes RPG and the various little flash fictions or short stories I’ve hacked together and being a bit more ruthless about it. The same would go for any software project I might start that’s bigger than a very simple tool.

Working on a Taxonomy Widget for TDO Mini Forms

Mark Cunningham — Tue, 19 Oct 2010 13:02:01 +0000

I started looking at Elio’s patch for supporting custom Taxonomies with a view of rolling them into the core of TDO Mini Forms. But looking at a little further, I figured it would be better to create a new widget rather than modify the Categories widget.

A new clean widget that properly supported taxonomies would be better and I’ve started work on it, basing it on Elio’s changes. Unfortunately it’s slow going here. I have the basic widget options figured out:

But now I have to implement all the logic underneath, mix together both tag behaviour and category behaviour, build a way to hack it in the form hacker and then test it as much as possible.

That while not having a decent development environment at home and limited bandwidth to work on it during lunchtime at work (if at all). But I’ll post on twitter when I make progress. Don’t ask when it’ll be done, it’ll be done when it’ll be done.

But, when finished, you’ll be able to use any taxonomy, including tags and categories and including your own custom taxonomies, display them in a list, drop-down, tag cloud, sorted by name or number of posts, set defaults, filter, etc.

I haven’t looked at Custom Page types yet though I have read up on them. But that will be another for another day I think.

An alternative to TDO Mini Forms?

Mark Cunningham — Wed, 08 Sep 2010 20:24:32 +0000

I always thought if there was a decent alternative to my wordpress plugin TDO Mini Forms, that I would properly retire the plugin. Well it seems there may be: Gravity Forms. As it says on the website: “the WordPress form management plugin you’ve been waiting for”. The catch? You have to pay for it.

And for that reason I haven’t tried it so I can’t comment on in comparison to TDO Mini Forms, but certainly it looks more polished and contains all sorts of features I never added to TDO Mini Forms. Yet because you have to pay, you get access to proper support, something I’ve struggle to provide (as it’s simply not fun).

A number of commenters on my post about TDO Mini Forms hiatus suggested I should turn it into a paid plugin and that they’d be willing to pay for it. Well I think Gravity Forms have beaten me to the punch there, though I never had the drive to try and make money from TDO Mini Forms at all.

I did say:

…if you’re building a professional website using WordPress and require some special user interface that hides the backend UI, it’s great to mock something up with TDO Mini Forms. But I can’t help but think, it would be better to build your own custom version. TDO Mini Forms is incredibly flexible, but it can’t do everything. And the more complex it gets, the more bug prone it becomes and harder to support and… well it also suffers the fickleness of an author that isn’t under contract to support it long term either. Just saying, it’s not as I’m being paid.

Maybe Gravity Forms is your answer if that paragraph hits home.

Of course, the existence of Gravity Forms does allow me to think, perhaps, I could strip back a lot of the “advanced” features, such as image upload, and just make a simple decent post submit/edit form with moderation. Which is what it should have been all along, rather than the sprawling, monstrous, hacky mess of code and features it is now.

You want Custom Taxonomies in TDO Mini Forms?

Mark Cunningham — Mon, 30 Aug 2010 21:53:44 +0000

While I’ve been on holiday and not doing anything on TDO Mini Forms, others have been quite busy:

How to use custom taxonomies in TDO Mini Forms (from ilovecolors).

TDO Mini Forms is one of the best plugins for WordPress to allow visitors or users to publish posts and upload files without having to access the admin area. You can select categories for the post, add tags, title, content, etc. However, even after WordPress introduced UIs for custom taxonomies in version 2.8, TDO Mini Forms (or tdomf for short) won’t allow you to select custom taxonomies. In this post you will find how to modify the categories widget for TDOMF to enable custom taxonomies.

Fix for TDO Mini Form’s drag’n’drop issue in WordPress 3.0 coming

Mark Cunningham — Tue, 22 Jun 2010 13:57:46 +0000

Got to the bottom of not being able to drag and drop in my TDO Mini Forms plugin after WordPress 3.0 upgrade. The fix will take a bit of time to do as it requires a little re-engineering of the Create Forms screen.

The problem occurred because with WordPress 3.0, they also updated their jQuery libraries and re-engineered how you load them. To be honest, I didn’t expect a jQuery update would break existing jQuery-based code, but sadly it’s nothing more than I would expect.

I’ll get a proper fix out for it something this week.

Run for cover WordPress 3.0 has arrived and TDO Mini Forms mostly works!

Mark Cunningham — Mon, 21 Jun 2010 11:33:17 +0000

I’ve just spent a good hour updating all my sites to the latest drop of WordPress 3.0 (I’m amazing I’m running so many, anyway…). As far as I can tell TDO Mini Forms is still mostly working okay. Certainly you can upgrade right now if you’re security conscious. Submitting post and previewing seems to be okay. But the drag/drop in the form editor is broken, so you can’t edit or create new forms. I’ll see over the next week if I can fix it. Please feel free to log any issues about upgrading here and I’ll see what I can get through.

If you notice anything else that doesn’t work after upgrade, feel free to drop a comment here. I don’t have the bandwidth to test every feature, so I’m sure some minor feature or corner issue may also break.

Forgive me Internet, for I have been lax. It has been over six months since I did any work on TDO Mini Forms…

Mark Cunningham — Mon, 31 May 2010 12:08:39 +0000

Even finding time to write this blog post is problematic, having to push it into the few spare minutes during my lunch break. I simply have not found the time to work on TDO Mini Forms. Well that’s not entirely true, I haven’t found time and motivation this last six months.

Part of the problem is that I implemented TDO Mini Forms for fun, a neat little plugin for WordPress I could use on some web projects (all dead now by the way). Then it was driven by my love of coding and the small crowd of users. But I changed projects in work several months back and could no longer slip the time in to bash away at some code for myself, at least during the daylight hours and now there is a mountain of support requests on the forums that I can’t even comprehend getting through and a slow disconnect between what I enjoyed about it and what I wanted to enjoy about it.

Essentially, it’s not fun any more. It’s bug fixes, RTFM and maintaince upgrades (with WordPress 3.0 is coming and that’s like a big stomping unstoppable giant, which I fully expect to splat my plugins…) it becomes daunting. I’ve added too many features (that can do wonderful things), and people either complain about them (“it’s too complex”) or demand more (“editable image uploads ftw!”). The whole code base of TDO Mini Forms evolved chaotically and the idea of re-writing (and having to maintain some degree of backwards compatibility) it’s quite off-putting.

And then I’m working on another creative project that I’m genuinely motivated about, but isn’t software. And when I have free time, I dive into this project, because I want to, not because I have to.

It might be more interesting if I was getting more out of it, say I was a web-developer (I’m not, I’m embedded engineer) and it was promoting my career or getting my clients, I was a big wordpress-advocate and people were coming to my blog to hear the cool things I say (I don’t have much cool things to say, unless you like tabletop roleplaying…), I was making enough money from donations I could afford to get a new gadget every once in a while or it was powering a big project I loved, but it’s not.

So I’m not sure where that leaves TDO Mini Forms. I think probably it’s been on an unofficial hiatus for the last while already. I don’t want to dump it, but I’m not sure of when I’ll get back to it. I have been thinking about it a lot, but not working on it. (I may write up those thoughts in a future blog post).

One thing I will say, if you’re building a professional website using WordPress and require some special user interface that hides the backend UI, it’s great to mock something up with TDO Mini Forms. But I can’t help but think, it would be better to build your own custom version. TDO Mini Forms is incredibly flexible, but it can’t do everything. And the more complex it gets, the more bug prone it becomes and hard to support and… well it also suffers the fickleness of an author that isn’t under contract to support it long term either. Just saying, it’s not as I’m being paid.

I have to send out a big thanks to all the people who have donated to the plugin. I really do appreciate it and it’s why I went so far with it. Thanks for listening.

Tutorial Video for TDO Mini Forms!

Mark Cunningham — Fri, 20 Nov 2009 08:58:15 +0000

A guy called Court has put together a video tutorial and article on using TDO Mini Forms, my free WordPress plugin.

The video is pretty good too as it shows you how to create a submission form and an edit form. I think I may be adding a link to this on the FAQ!

As a footnote to the video, the latest version 0.13.7 does include Custom Field editing and the compare view for edit posts is now working.

Also check out his site for indie musicians called indilean that uses TDO Mini Forms too.

thedeadone.net » TDOMF

Where has TDO Mini Forms plugin gone?

Related Posts:

Pet Projects, TDO-Mini-Forms and Forums

Related Posts:

For fun or for success?

Related Posts:

Working on a Taxonomy Widget for TDO Mini Forms

Related Posts:

An alternative to TDO Mini Forms?

Related Posts:

You want Custom Taxonomies in TDO Mini Forms?

Related Posts:

Fix for TDO Mini Form’s drag’n’drop issue in WordPress 3.0 coming

Related Posts:

Run for cover WordPress 3.0 has arrived and TDO Mini Forms mostly works!

Related Posts:

Forgive me Internet, for I have been lax. It has been over six months since I did any work on TDO Mini Forms…

Related Posts:

Tutorial Video for TDO Mini Forms!

Related Posts: