thedeadone.net » Wordpress

Where has TDO Mini Forms plugin gone?

Mark Cunningham — Thu, 10 Nov 2011 17:00:00 +0000

I haven’t been updating or working on this WordPress plugin of mine for a while now. And it seems it has been removed from the WordPress.org plugin directory.

I’ve put up a temporary mirror link on the page here for it for those desperate enough to want it now. However an exploit was reported against it. Details below.

tl/dr An exploit was reported to WordPress support. The plugin was pulled. Will be fixed.

I think the term “exploit” is a not completely true. I’m not able to replicate the exploit on my web servers.

You have to have a public visible form, with an upload form and allow anonymous users to upload. The reported exploit uses only the first form, but in theory any form could be used. You temporary upload folder must also be publically available, but if you the post is automatically published, then the uploaded file will be publically available.

But you must also have your webserver configured to execute files as .php even if their extensions are .jpg. On my host and even on my default test setups, this is not the default. I’m not a big enough web server admin expert to properly understand all the ins and outs of this part, but generally it’s outside the scope of wordpress or tdo-mini-forms.

Example, the exploit user would upload script_to_run.php.jpg to your upload form. They’d then run it using a URL (if it’s public from the temp folder (uploads are kept for one hour). My setup would always treat that file as Image file and so it wouldn’t run.

See this thread from wp-hackers mailing list for more info on it.

If you think you’re currently affected, remove the upload widget from your forms or only allow trusted users to upload files.

WordPress does have some code now to remove the double extension. So I plan to update tdo-mini-forms to do this. I’m afraid I don’t currently have a test bed or a huge amount of time to fix this, but I will do it in the next month or so.

Pet Projects, TDO-Mini-Forms and Forums

Mark Cunningham — Wed, 02 Mar 2011 13:03:26 +0000

Following on from my previous post (“for fun or for success”), I keep thinking about a blog post I read from Jeff Vogel called The Bottom Feeder: Three Reasons Creators Should Never Read Their Forums.

If I have learned anything from writing Indie games for a living for fifteen years and there are plenty who would say that I haven’t, it is that it is usually a bad idea for creators to visit online forums discussing them and their work. It doesn’t lead to happy ends.

He offers three salient points:

It’s Not Productive To Read How Much People Hate You
It’s Not Going To Be Helpful
You Might Get Suckered Into Getting Angry

I think there is certainly some truth in what he says. I’m only thinking of TDO-Mini-Forms, a project that was done for fun but became something else.

When I started it, I had a small group of users from the WordPress forums, I listened to them, made releases to address there issues and enjoyed the feedback. I setup this forum (I thought I was being clever using TDO-Mini-Forms to power a WordPress blog as a forum!) as a place to informally handle discussion, feedback, feature suggestions, bugs, etc. It was very open creative time and it was with pride that I saw people creating interesting sites using my plugin. This one-on-one feeling with users is great. It really motivates you to help them. Some bought me books or gave me donations as thanks.

For the profit-oriented readers, working with users directly like this, I got bigger and more donations than any other method. It seems people are quite happy to use your plugin for free but if they spend end up interacting with the author in a positive (not necessarily successful) way, they often give something back where they might not have done so before.

But user numbers grew and grew. And it hit a certain critical mass of users where I wasn’t meaningfully engaging with any of them. I think I hit what Jeff Vogel is talking about, though I didn’t have fans, I had users.

Every new feature or change I made would both be liked or derided by users including those same features previously demanded. Coupled with WordPress upgrades/changes that occasionally broke TDOMF outright, introduced new subtle bugs, or highlighted ones that no-one noticed before, users demanded fixes and patches. The stuff I wanted to do, I couldn’t.

Forums contain a cacophony of people telling you to do diametrically opposite things, very loudly, often for bad reasons. There will be plenty of good ideas, but picking them out from the bad ones is unreliable and a lot of work. If you try to make too many people happy at once, you will drive yourself mad. You have to be very, very careful who you let into your head.

I fell into this trap big time. My reaction? Dragging my heels until I stopped working on TDO-Mini-Forms completely. It was a slow long process, though. I still tried for a long time, replying to emails, offering advice over twitter, trying desperately to keep up with the forums, etc. But it poisoned my enjoyment.

I was creating/maintaining TDO-Mini-Forms for fun, a pet project. I was learning PHP, WordPress, web programming, DB management, etc. as I went a long. Many of my early mistakes are buried in TDO-Mini-Forms (and occasionally loud users remind me of these failures). I felt I couldn’t evolve or play with TDO-Mini-Forms, in case I broke people’s existing set-ups, so it became stale. Work on it was maintenance, backwards compatibility testing, etc. and I wasn’t getting much out of it. Even the few donations I got, which I heartily appreciated, were not enough incentive. I was trying to please everyone and ended up not just frustrating people, but frustrating myself.

If I were to do things different, I’d treat TDO-Mini-Forms more as a product (as I suggested in my previous post). Create a layer between myself and the users and even try to make some money off it (in fact many users have suggested I do this). Of course hindsight is great and by now there are a few alternatives out there, and where do I find the time?

I still get the occasionally email about TDO-Mini-Forms, sometimes I reply, sometimes I just leave there unread, which is unfair to the sender and myself. I see the occasionally tweet or blog entry, sometimes positive, sometimes negative (those make me sad). But I rarely respond. I’ve so far managed to avoid, number 3: You Might Get Suckered Into Getting Angry.

I never read the forums that I setup and I think I may end up deleting it outright. I no longer link to them directly from my home page. I’m not sure about the best approach to this as there are new posts every day on it but WordPress.org has it’s own forums for TDO-Mini-Forms (like it does for every plugin). I may just redirect there one day and leave it at that. I’d be inclined to keep the forums if they readership spilled out into other topics that I do have an interest in, like roleplaying or writing, but that’s not going to happen. I barely blog about WordPress as it is. There isn’t much overlap. Even when TDO-Mini-Form users comment on my blog, they are looking for advice or help.

I often evaluate WordPress plugins that I use for my own blog(s) through the lens of my experience of TDO-Mini-Forms. If it’s a simple, one-job, type of plugin then that’s normally okay, if it works. If it’s a big popular plugin and the author seems to be serious about making something off it (such as they work with WordPress professionally, or they have big donate panels on the plugin), that’s a good thing. Means they are going to support it across versions of WordPress etc. (I wish I had done this with TDO-Mini-Forms).

Also, if they themselves are using the plugin on their own blog, that’s a very hot indicator. It’s core functionality will be maintained across WordPress upgrades. (I no longer use TDO-Mini-Forms actively anywhere).

Anything in-between, I get a little suspicious, fearful it won’t get updated with the next major WordPress overhaul or that minor bugs will never get fixed. I wouldn’t depend on such plugins. (That’s where TDO-Mini-Forms now lies, big plugin but not actively in use by author and not “productized” in any way).

Now hopefully I’ve gotten all that TDO-Mini-Forms angst out of me! Next rules for Lost Heroes RPG and a blog post about dream worlds in roleplaying settings.

Working on a Taxonomy Widget for TDO Mini Forms

Mark Cunningham — Tue, 19 Oct 2010 13:02:01 +0000

I started looking at Elio’s patch for supporting custom Taxonomies with a view of rolling them into the core of TDO Mini Forms. But looking at a little further, I figured it would be better to create a new widget rather than modify the Categories widget.

A new clean widget that properly supported taxonomies would be better and I’ve started work on it, basing it on Elio’s changes. Unfortunately it’s slow going here. I have the basic widget options figured out:

But now I have to implement all the logic underneath, mix together both tag behaviour and category behaviour, build a way to hack it in the form hacker and then test it as much as possible.

That while not having a decent development environment at home and limited bandwidth to work on it during lunchtime at work (if at all). But I’ll post on twitter when I make progress. Don’t ask when it’ll be done, it’ll be done when it’ll be done.

But, when finished, you’ll be able to use any taxonomy, including tags and categories and including your own custom taxonomies, display them in a list, drop-down, tag cloud, sorted by name or number of posts, set defaults, filter, etc.

I haven’t looked at Custom Page types yet though I have read up on them. But that will be another for another day I think.

An alternative to TDO Mini Forms?

Mark Cunningham — Wed, 08 Sep 2010 20:24:32 +0000

I always thought if there was a decent alternative to my wordpress plugin TDO Mini Forms, that I would properly retire the plugin. Well it seems there may be: Gravity Forms. As it says on the website: “the WordPress form management plugin you’ve been waiting for”. The catch? You have to pay for it.

And for that reason I haven’t tried it so I can’t comment on in comparison to TDO Mini Forms, but certainly it looks more polished and contains all sorts of features I never added to TDO Mini Forms. Yet because you have to pay, you get access to proper support, something I’ve struggle to provide (as it’s simply not fun).

A number of commenters on my post about TDO Mini Forms hiatus suggested I should turn it into a paid plugin and that they’d be willing to pay for it. Well I think Gravity Forms have beaten me to the punch there, though I never had the drive to try and make money from TDO Mini Forms at all.

I did say:

…if you’re building a professional website using WordPress and require some special user interface that hides the backend UI, it’s great to mock something up with TDO Mini Forms. But I can’t help but think, it would be better to build your own custom version. TDO Mini Forms is incredibly flexible, but it can’t do everything. And the more complex it gets, the more bug prone it becomes and harder to support and… well it also suffers the fickleness of an author that isn’t under contract to support it long term either. Just saying, it’s not as I’m being paid.

Maybe Gravity Forms is your answer if that paragraph hits home.

Of course, the existence of Gravity Forms does allow me to think, perhaps, I could strip back a lot of the “advanced” features, such as image upload, and just make a simple decent post submit/edit form with moderation. Which is what it should have been all along, rather than the sprawling, monstrous, hacky mess of code and features it is now.

You want Custom Taxonomies in TDO Mini Forms?

Mark Cunningham — Mon, 30 Aug 2010 21:53:44 +0000

While I’ve been on holiday and not doing anything on TDO Mini Forms, others have been quite busy:

How to use custom taxonomies in TDO Mini Forms (from ilovecolors).

TDO Mini Forms is one of the best plugins for WordPress to allow visitors or users to publish posts and upload files without having to access the admin area. You can select categories for the post, add tags, title, content, etc. However, even after WordPress introduced UIs for custom taxonomies in version 2.8, TDO Mini Forms (or tdomf for short) won’t allow you to select custom taxonomies. In this post you will find how to modify the categories widget for TDOMF to enable custom taxonomies.

Fix for TDO Mini Form’s drag’n’drop issue in WordPress 3.0 coming

Mark Cunningham — Tue, 22 Jun 2010 13:57:46 +0000

Got to the bottom of not being able to drag and drop in my TDO Mini Forms plugin after WordPress 3.0 upgrade. The fix will take a bit of time to do as it requires a little re-engineering of the Create Forms screen.

The problem occurred because with WordPress 3.0, they also updated their jQuery libraries and re-engineered how you load them. To be honest, I didn’t expect a jQuery update would break existing jQuery-based code, but sadly it’s nothing more than I would expect.

I’ll get a proper fix out for it something this week.

Run for cover WordPress 3.0 has arrived and TDO Mini Forms mostly works!

Mark Cunningham — Mon, 21 Jun 2010 11:33:17 +0000

I’ve just spent a good hour updating all my sites to the latest drop of WordPress 3.0 (I’m amazing I’m running so many, anyway…). As far as I can tell TDO Mini Forms is still mostly working okay. Certainly you can upgrade right now if you’re security conscious. Submitting post and previewing seems to be okay. But the drag/drop in the form editor is broken, so you can’t edit or create new forms. I’ll see over the next week if I can fix it. Please feel free to log any issues about upgrading here and I’ll see what I can get through.

If you notice anything else that doesn’t work after upgrade, feel free to drop a comment here. I don’t have the bandwidth to test every feature, so I’m sure some minor feature or corner issue may also break.

Forgive me Internet, for I have been lax. It has been over six months since I did any work on TDO Mini Forms…

Mark Cunningham — Mon, 31 May 2010 12:08:39 +0000

Even finding time to write this blog post is problematic, having to push it into the few spare minutes during my lunch break. I simply have not found the time to work on TDO Mini Forms. Well that’s not entirely true, I haven’t found time and motivation this last six months.

Part of the problem is that I implemented TDO Mini Forms for fun, a neat little plugin for WordPress I could use on some web projects (all dead now by the way). Then it was driven by my love of coding and the small crowd of users. But I changed projects in work several months back and could no longer slip the time in to bash away at some code for myself, at least during the daylight hours and now there is a mountain of support requests on the forums that I can’t even comprehend getting through and a slow disconnect between what I enjoyed about it and what I wanted to enjoy about it.

Essentially, it’s not fun any more. It’s bug fixes, RTFM and maintaince upgrades (with WordPress 3.0 is coming and that’s like a big stomping unstoppable giant, which I fully expect to splat my plugins…) it becomes daunting. I’ve added too many features (that can do wonderful things), and people either complain about them (“it’s too complex”) or demand more (“editable image uploads ftw!”). The whole code base of TDO Mini Forms evolved chaotically and the idea of re-writing (and having to maintain some degree of backwards compatibility) it’s quite off-putting.

And then I’m working on another creative project that I’m genuinely motivated about, but isn’t software. And when I have free time, I dive into this project, because I want to, not because I have to.

It might be more interesting if I was getting more out of it, say I was a web-developer (I’m not, I’m embedded engineer) and it was promoting my career or getting my clients, I was a big wordpress-advocate and people were coming to my blog to hear the cool things I say (I don’t have much cool things to say, unless you like tabletop roleplaying…), I was making enough money from donations I could afford to get a new gadget every once in a while or it was powering a big project I loved, but it’s not.

So I’m not sure where that leaves TDO Mini Forms. I think probably it’s been on an unofficial hiatus for the last while already. I don’t want to dump it, but I’m not sure of when I’ll get back to it. I have been thinking about it a lot, but not working on it. (I may write up those thoughts in a future blog post).

One thing I will say, if you’re building a professional website using WordPress and require some special user interface that hides the backend UI, it’s great to mock something up with TDO Mini Forms. But I can’t help but think, it would be better to build your own custom version. TDO Mini Forms is incredibly flexible, but it can’t do everything. And the more complex it gets, the more bug prone it becomes and hard to support and… well it also suffers the fickleness of an author that isn’t under contract to support it long term either. Just saying, it’s not as I’m being paid.

I have to send out a big thanks to all the people who have donated to the plugin. I really do appreciate it and it’s why I went so far with it. Thanks for listening.

The answer to my question: WordPress “Press It” feature

Mark Cunningham — Fri, 16 Apr 2010 12:40:50 +0000

I asked, not too long ago, if anyone had suggestions on sharing stuff from google reader in a nice way into WordPress. No-one answered and I didn’t find any solutions myself.

However, I did come across this plugin for WordPress: Quick Post. It didn’t install properly when I tried it, but I played with it and bit and got it to work. What it does is add a little “Bookmarklet” (works in Chrome and Firefox at least) which you can click on when you’re on a webpage and it’ll pop up a window with some details of the page you’re on already embedded in the post. What is nice about it, is that you can select a portion of the page, click the bookmarklet, and it’ll pop up a post with that text in it. It can also embed videos and images.

How does this solve my problem? I can’t get Google Reader to automatically create a draft post. But that’s not a big deal. I don’t want to be sharing loads of stuff here, so doing a little bit of manual work is fine. I just go to the link, select a summary or an image and I can use Quick Post to generate an entry. I’ll have to copy over my comment, but that’s fine. It forces me to write a blog post instead of just dumping a link compared to say doing it on Facebook or Twitter.

I did some digging, planning on forwarding my fixes to the author, and found that it is no longer supported! Not only that, it’s already supported in WordPress 2.6 (the latest version is 2.9). It seems if you go under the Tools menu, you’ll find a link called “Press It”, which you can drag to your Browser’s bookmarks. This little bookmarklet does something similar to Quick Post. Go to a webpage, select the text from the page, click the bookmarklet and you get a simple post screen with the link and title plus your summary. It’s pretty funky.

My one complaint is that if you want to use an image from a website, it only allows you to use the URL as the image (i.e. hotlinking). It doesn’t automatically download the image, which would make it the ultimate solution.

So there you go, that’s my wordpress tip for the month. Now you shouldn’t have any excuse for automated regurgitated content.

Suggestions for how to share stuff from Google Reader in a WordPress blog?

Mark Cunningham — Thu, 25 Mar 2010 09:50:28 +0000

I know of plugins that can take your Google Reader Shared Items and automatically generate a post for you. (I was using this one and it’s quite good). This is nice, but doesn’t actually make a great post.

I know you can setup a “Send To” in Google Reader to post items from Google Reader in your WordPress blog. But the format of the post is awful. It holds just a link and a title. I’d like something a kin to the way the posts are presented in Google Reader. YouTube videos expanded, summary of the post, my comment/note on it, etc. Anyone have any suggestions?

My plan is to post some or occasional items from my Google Reader shared items. I want to control the flow and only post those few that I think people may like (who see my blog).

thedeadone.net » Wordpress

Where has TDO Mini Forms plugin gone?

Related Posts:

Pet Projects, TDO-Mini-Forms and Forums

Related Posts:

Working on a Taxonomy Widget for TDO Mini Forms

Related Posts:

An alternative to TDO Mini Forms?

Related Posts:

You want Custom Taxonomies in TDO Mini Forms?

Related Posts:

Fix for TDO Mini Form’s drag’n’drop issue in WordPress 3.0 coming

Related Posts:

Run for cover WordPress 3.0 has arrived and TDO Mini Forms mostly works!

Related Posts:

Forgive me Internet, for I have been lax. It has been over six months since I did any work on TDO Mini Forms…

Related Posts:

The answer to my question: WordPress “Press It” feature

Related Posts:

Suggestions for how to share stuff from Google Reader in a WordPress blog?

Related Posts: