thedeadone.net » Wordpress Plugin

Where has TDO Mini Forms plugin gone?

Mark Cunningham — Thu, 10 Nov 2011 17:00:00 +0000

I haven’t been updating or working on this WordPress plugin of mine for a while now. And it seems it has been removed from the WordPress.org plugin directory.

I’ve put up a temporary mirror link on the page here for it for those desperate enough to want it now. However an exploit was reported against it. Details below.

tl/dr An exploit was reported to WordPress support. The plugin was pulled. Will be fixed.

I think the term “exploit” is a not completely true. I’m not able to replicate the exploit on my web servers.

You have to have a public visible form, with an upload form and allow anonymous users to upload. The reported exploit uses only the first form, but in theory any form could be used. You temporary upload folder must also be publically available, but if you the post is automatically published, then the uploaded file will be publically available.

But you must also have your webserver configured to execute files as .php even if their extensions are .jpg. On my host and even on my default test setups, this is not the default. I’m not a big enough web server admin expert to properly understand all the ins and outs of this part, but generally it’s outside the scope of wordpress or tdo-mini-forms.

Example, the exploit user would upload script_to_run.php.jpg to your upload form. They’d then run it using a URL (if it’s public from the temp folder (uploads are kept for one hour). My setup would always treat that file as Image file and so it wouldn’t run.

See this thread from wp-hackers mailing list for more info on it.

If you think you’re currently affected, remove the upload widget from your forms or only allow trusted users to upload files.

WordPress does have some code now to remove the double extension. So I plan to update tdo-mini-forms to do this. I’m afraid I don’t currently have a test bed or a huge amount of time to fix this, but I will do it in the next month or so.

Pet Projects, TDO-Mini-Forms and Forums

Mark Cunningham — Wed, 02 Mar 2011 13:03:26 +0000

Following on from my previous post (“for fun or for success”), I keep thinking about a blog post I read from Jeff Vogel called The Bottom Feeder: Three Reasons Creators Should Never Read Their Forums.

If I have learned anything from writing Indie games for a living for fifteen years and there are plenty who would say that I haven’t, it is that it is usually a bad idea for creators to visit online forums discussing them and their work. It doesn’t lead to happy ends.

He offers three salient points:

It’s Not Productive To Read How Much People Hate You
It’s Not Going To Be Helpful
You Might Get Suckered Into Getting Angry

I think there is certainly some truth in what he says. I’m only thinking of TDO-Mini-Forms, a project that was done for fun but became something else.

When I started it, I had a small group of users from the WordPress forums, I listened to them, made releases to address there issues and enjoyed the feedback. I setup this forum (I thought I was being clever using TDO-Mini-Forms to power a WordPress blog as a forum!) as a place to informally handle discussion, feedback, feature suggestions, bugs, etc. It was very open creative time and it was with pride that I saw people creating interesting sites using my plugin. This one-on-one feeling with users is great. It really motivates you to help them. Some bought me books or gave me donations as thanks.

For the profit-oriented readers, working with users directly like this, I got bigger and more donations than any other method. It seems people are quite happy to use your plugin for free but if they spend end up interacting with the author in a positive (not necessarily successful) way, they often give something back where they might not have done so before.

But user numbers grew and grew. And it hit a certain critical mass of users where I wasn’t meaningfully engaging with any of them. I think I hit what Jeff Vogel is talking about, though I didn’t have fans, I had users.

Every new feature or change I made would both be liked or derided by users including those same features previously demanded. Coupled with WordPress upgrades/changes that occasionally broke TDOMF outright, introduced new subtle bugs, or highlighted ones that no-one noticed before, users demanded fixes and patches. The stuff I wanted to do, I couldn’t.

Forums contain a cacophony of people telling you to do diametrically opposite things, very loudly, often for bad reasons. There will be plenty of good ideas, but picking them out from the bad ones is unreliable and a lot of work. If you try to make too many people happy at once, you will drive yourself mad. You have to be very, very careful who you let into your head.

I fell into this trap big time. My reaction? Dragging my heels until I stopped working on TDO-Mini-Forms completely. It was a slow long process, though. I still tried for a long time, replying to emails, offering advice over twitter, trying desperately to keep up with the forums, etc. But it poisoned my enjoyment.

I was creating/maintaining TDO-Mini-Forms for fun, a pet project. I was learning PHP, WordPress, web programming, DB management, etc. as I went a long. Many of my early mistakes are buried in TDO-Mini-Forms (and occasionally loud users remind me of these failures). I felt I couldn’t evolve or play with TDO-Mini-Forms, in case I broke people’s existing set-ups, so it became stale. Work on it was maintenance, backwards compatibility testing, etc. and I wasn’t getting much out of it. Even the few donations I got, which I heartily appreciated, were not enough incentive. I was trying to please everyone and ended up not just frustrating people, but frustrating myself.

If I were to do things different, I’d treat TDO-Mini-Forms more as a product (as I suggested in my previous post). Create a layer between myself and the users and even try to make some money off it (in fact many users have suggested I do this). Of course hindsight is great and by now there are a few alternatives out there, and where do I find the time?

I still get the occasionally email about TDO-Mini-Forms, sometimes I reply, sometimes I just leave there unread, which is unfair to the sender and myself. I see the occasionally tweet or blog entry, sometimes positive, sometimes negative (those make me sad). But I rarely respond. I’ve so far managed to avoid, number 3: You Might Get Suckered Into Getting Angry.

I never read the forums that I setup and I think I may end up deleting it outright. I no longer link to them directly from my home page. I’m not sure about the best approach to this as there are new posts every day on it but WordPress.org has it’s own forums for TDO-Mini-Forms (like it does for every plugin). I may just redirect there one day and leave it at that. I’d be inclined to keep the forums if they readership spilled out into other topics that I do have an interest in, like roleplaying or writing, but that’s not going to happen. I barely blog about WordPress as it is. There isn’t much overlap. Even when TDO-Mini-Form users comment on my blog, they are looking for advice or help.

I often evaluate WordPress plugins that I use for my own blog(s) through the lens of my experience of TDO-Mini-Forms. If it’s a simple, one-job, type of plugin then that’s normally okay, if it works. If it’s a big popular plugin and the author seems to be serious about making something off it (such as they work with WordPress professionally, or they have big donate panels on the plugin), that’s a good thing. Means they are going to support it across versions of WordPress etc. (I wish I had done this with TDO-Mini-Forms).

Also, if they themselves are using the plugin on their own blog, that’s a very hot indicator. It’s core functionality will be maintained across WordPress upgrades. (I no longer use TDO-Mini-Forms actively anywhere).

Anything in-between, I get a little suspicious, fearful it won’t get updated with the next major WordPress overhaul or that minor bugs will never get fixed. I wouldn’t depend on such plugins. (That’s where TDO-Mini-Forms now lies, big plugin but not actively in use by author and not “productized” in any way).

Now hopefully I’ve gotten all that TDO-Mini-Forms angst out of me! Next rules for Lost Heroes RPG and a blog post about dream worlds in roleplaying settings.

An alternative to TDO Mini Forms?

Mark Cunningham — Wed, 08 Sep 2010 20:24:32 +0000

I always thought if there was a decent alternative to my wordpress plugin TDO Mini Forms, that I would properly retire the plugin. Well it seems there may be: Gravity Forms. As it says on the website: “the WordPress form management plugin you’ve been waiting for”. The catch? You have to pay for it.

And for that reason I haven’t tried it so I can’t comment on in comparison to TDO Mini Forms, but certainly it looks more polished and contains all sorts of features I never added to TDO Mini Forms. Yet because you have to pay, you get access to proper support, something I’ve struggle to provide (as it’s simply not fun).

A number of commenters on my post about TDO Mini Forms hiatus suggested I should turn it into a paid plugin and that they’d be willing to pay for it. Well I think Gravity Forms have beaten me to the punch there, though I never had the drive to try and make money from TDO Mini Forms at all.

I did say:

…if you’re building a professional website using WordPress and require some special user interface that hides the backend UI, it’s great to mock something up with TDO Mini Forms. But I can’t help but think, it would be better to build your own custom version. TDO Mini Forms is incredibly flexible, but it can’t do everything. And the more complex it gets, the more bug prone it becomes and harder to support and… well it also suffers the fickleness of an author that isn’t under contract to support it long term either. Just saying, it’s not as I’m being paid.

Maybe Gravity Forms is your answer if that paragraph hits home.

Of course, the existence of Gravity Forms does allow me to think, perhaps, I could strip back a lot of the “advanced” features, such as image upload, and just make a simple decent post submit/edit form with moderation. Which is what it should have been all along, rather than the sprawling, monstrous, hacky mess of code and features it is now.

And another release of TDO Mini Forms is out the door!

Mark Cunningham — Mon, 29 Jun 2009 18:51:21 +0000

Yep. 0.13.2 is out today. See the (new and improved wordpress 2.8) changelog for details of whats in this release.

I have to apologise for my lack of responses on the numerous support requests. I’m about a month behind but I will get through them, so hang on! Life, work and my other hobby projects are all overloaded these days.

Ahhhh! v0.13 escapes with editing functionality!

Mark Cunningham — Fri, 22 May 2009 08:56:40 +0000

You can grab the latest version of tdo-mini-forms from WordPress.org right now!

I’m sure within minutes the internet will collapse but I’ve finally got it done. v0.13 adds the ability to edit posts and has improved moderation screen. I say that with a big sigh because there is still a lot to do to finish off the backend, improve the post editing and finally tackle the long list of bugs that has accumulated, but with this version at least you can start to play with editing.

Enjoy! And any issues report them to the support forums or even try out twitter (hashtag #tdomf).

Please keep in mind that this plugin is free and any support I provide is also free. If you found it useful you can show your appreciation via a small donation or buying me a book!

Grab a beta release of TDO Mini Forms, if you dare!

Mark Cunningham — Tue, 19 May 2009 16:11:35 +0000

I’ve been testing TDO Mini Forms (a WordPress plugin) on a live server for a few days now. Spam protection seems to work, which is great. I only have two things left to do before I do an official release: update the readme.txt and update the ReCapatcha widget to work with the editing form.

But to get people going, you can download a beta now from the development branch.

I’ve also been sucked into twitter! @thedeadone – I will be “tweeting” (is that the right verb?) using the hashtag #tdomf anything relevant to TDO Mini Forms. (‘tdomf’ is the tag I’ve always used to tag stuff relevant to TDO Mini Forms online).

Any comments and feedback welcome, but don’t expect major changes before the next release (which should be very soon!). Thank you.

Please keep in mind that this plugin is free and any support I provide is also free. If you found it useful you can show your appreciation via a small donation or buying me a book!

A sneak peak at post editing in TDO Mini Forms

Mark Cunningham — Thu, 09 Apr 2009 15:06:59 +0000

I’ve been toiling away on TDO Mini Forms for a while, but I’m finding it hard to get a big stretch of time to work on it. So work is done in bits and pieces and I’ve had to priorities what work is done. Right now I have a long list of bugs and other features to be implemented because of being concentrating on getting Post (and Page) editing implemented.

It’s still a long way to go, however the core work is done. I can create forms that allow you edit posts and to moderate edits. It should work with Akismet, much like submissions do, but I haven’t yet tested that part of the code. The Form Options screen has been updated and the Moderation screen is much more WordPress 2.7 now. Still there is a lot of work to do and even when I have it basically finished (and release it), I’ll still have tons more to do. The admin UI is still in a transitionally design between WordPress 2.5 and 2.7 look and feel and most of the other widgets will incrementally get added to the editing feature.

However, to wet your appetite, here are some screen shots of the moderation screen and edit form:

v0.12.7 of TDO Mini Forms just released

Mark Cunningham — Mon, 16 Feb 2009 09:58:45 +0000

I’ve just committed v0.12.7 of TDO Mini Forms into WordPress Extend SVN, so it should be available for download shortly from WordPress.org/Extend.

I know I said the next version will be v0.13 with Editing Support, but that’s not to be. This release includes a fix for a pretty critical bug. If you are using a Windows host please upgrade immediately!

A combination of WordPress legacy implementation, Windows file name and TDOMF could end up attempting to delete you’re hosts harddrive. This sadly lead to a number of users, who were using their personal Windows PCs as development hosts to lose many personal files.

This would happen if you used the Upload Files widget and uploaded files and then attempted to delete the file using the WordPress admin. The file path would be stored by TDOMF in a Custom Field. However, the WordPress internal API (add_post_meta specifically), currently strips back-slashes from all data put in. This was because originally add_post_meta was only used by the admin backend, but is now a wildly used function by plugins and other parts of WordPress. (IMHO it doesn’t make sense that add_post_meta modifies your input data and also this “feature” is not currently documented anywhere). Windows paths uses back slashes as directory separators, however Unix and Linux systems use forward slashes. Therefore file paths in Unix were stored successfully but Windows file paths were corrupted. So when the post was deleted, TDOMF would try to delete the associated files with that post but end up attempting to delete the hard drive because of the corrupted file path. This problem is not specific to any single version of TDOMF, but any version of TDOMF with the Upload Files widget.

Additionally in this release is a fix for the Queuing of Submissions which was broken on the move to WordPress 2.7, a “double-opt-in” feature to Auto Respond Email widget, a necessary update to the core widget class (which may break your existing configuration, so make sure to double check) and a fix to the default Form code for the Form Hacker.

Please keep in mind that this plugin is free and any support I provide is also free. If you found it useful you can show your appreciation via a small donation or buying me a book!

A christmass gift to all TDO-Mini-Form users!

Mark Cunningham — Wed, 17 Dec 2008 10:40:28 +0000

Yep. A new version for you all. A new permalink widget, integration with Geo Mashup plugin (for all your geo-positioning needs), enhanced user permissions and some 2.7 testing. You should be able to get it shortly from wordpress.org or via the new plugin update system in 2.7.

I won’t be around for Christmass/New Year so they’ll be no support really for bugs and fixes.

My original intention was that the next release of TDO Mini Forms would include post editing. I’m afraid this isn’t going to manifest till the new year. I wanted to do some intial ground work by adding the enhanced user permissions and creating a widget class (which was used to create the two new widgets in this release) first but when I had done that I started to procrastinate just a tiny bit and when I procrastinated, I ended up bug fixed or add the new widgets so I don’t think it was time wasted!

Lots of bugs got fixed: slashes in posts, breaking comments, errors during upload, ’0′ not being accepted in text fields as valid values, slow loading of admin menus when you have too many users, recaptcha not working in AJAX mode and a few more other little things.

The new widget Permalink allows you to let users set a different permalink for the post. This allows you to let users submit links that when a user clicks on the post, they’ll be redirected to the URL. The Geo Mashup integration widget is based on the original hack of hitekhomeless and its something people have been asking for a while now. It seems to work fine on my test setup (but there are some minor display issues if using a heavily customised theme).

Also, I’ve created a Widget class. If you’re not into code don’t worry – if you are, I hope in the new year to write up a very simple tutorial on how to create your own widgets to add some fields to the form and process them after submission. The new widget class really simplifies it.

And yes. TDO-Mini-Forms is compatible with 2.7 and I’ve now updated the info on wordpress.org to reflect this.

So enjoy and have a Merry Christmass.

Don’t forget, this plugin is free, however if you found it useful you can show your appreciation via a small donation, buying me a book or giving this plugin a high rating on wordpress.org!

Update on TDO Mini Forms

Mark Cunningham — Wed, 03 Dec 2008 21:18:23 +0000

I’ve been working on the next version of TDO Mini Forms and the first thing I’ve done is make sure that it works with WordPress 2.7. And it does, the only change is some formatting on the admin menus.

Along with the usual bunch of bug fixes, I’ve implemented new form access options. In the next version you’ll be able to control who can access a form by role, specific users and specific capabilities, which should give you more power. I’m next going to be working on trying to enable forms to be used for editing, not just for submitting.

thedeadone.net » Wordpress Plugin

Where has TDO Mini Forms plugin gone?

Related Posts:

Pet Projects, TDO-Mini-Forms and Forums

Related Posts:

An alternative to TDO Mini Forms?

Related Posts:

And another release of TDO Mini Forms is out the door!

Related Posts:

Ahhhh! v0.13 escapes with editing functionality!

Related Posts:

Grab a beta release of TDO Mini Forms, if you dare!

Related Posts:

A sneak peak at post editing in TDO Mini Forms

Related Posts:

v0.12.7 of TDO Mini Forms just released

Related Posts:

A christmass gift to all TDO-Mini-Form users!

Related Posts:

Update on TDO Mini Forms

Related Posts: