Macrotone Blogs

Macrotone blogs upon Joomla, our products and other matters.
Categories
Tags
Archives
Calendar
Categories:   All Categories
Suggested keywords
x
Geoffrey Chapman

Joomla 2.5 Language overrides

b2ap3 icon joomlaI was recently asked a question about language templates and how custom changes made by a site would be over ridden on a component update. This got me thinking and it seems that Joomla already provides a convenient way to create language overrides.  I am not talking about language overrides just specific strings being used instead of the standard supplied text.

This can all be done in the Joomla administrator.

Continue reading
Tags:
overrides Tools joomla developers Language Issue Tracker
Geoffrey Chapman

Reflections on Joomla

b2ap3 icon joomlaI looked at an installation of Joomla 1.5 the other day and was struck by how much has changed and how far the current version has progressed over the years.

The obvious differences in the platform using an MVC structure were obvious but also changes in how plugins, modules and components are installed, exception handling, library changes etc. all combined to make it almost a different product altogether despite the outward appearance.

Having been developing extensions concentrated on Joomla 1.6 and above, it was easy to see how far the Joomla product has evolved.  Whether it is all good is perhaps more subjective. There was a simplicity in the early releases that has in many/some ways been lost as the product has changed. If one takes the ‘blogging’ aspect of the platform, I suppose this is why new products such as 'Ghost’ (to name just one) continue to appear, all boasting of the ‘ease’ of use. These immediately bring to mind the similar claims of Wordpress, Pressword etc.  Perhaps it also goes some way to explain the desire to implement things such as Wordpress ‘under’ Joomla, an admirable step well executed by WP4J or CorePHP all of which strive to bring the perceived ‘simplicity’ and ‘ease of use’ back to Joomla. Whether this is achieved or whether it creates more ‘complexity’ is open to doubt and interpretation.

This is not to say that there is anything at all wrong with the current Joomla onward design, which is after all the way of all things, which continue to develop, just that there is a ‘beauty’ in simplicity, which can often be lost if one is not careful.  Change is not a ‘bad’ thing and should be accepted and welcomed but at the same time one should question  whether it is ‘just change for changes sake’ which is another thing altogether.

Geoffrey Chapman

SQL Injection Attacks

mysqlWe are experiencing a spate of SQL injection attacks upon our site.

These take the form of appending SQL strings upon the end of valid URL addresses.  A simple Google search reveals that there are many sites where the examples given below have triggered problems. Two typical strings are shown below: 

(/**/sElEcT+1+/**/fRoM(/**/sElEcT+count(*),/**/cOnCaT((/**/sElEcT(/**/sElEcT+/**/uNhEx(/**/hEx(/**/cOnCaT(0x217e21,0x4142433134355a5136324457514146504f4959434644,0x217e21))))+/**/fRoM+information_schema/**/tAbLeS+/**/lImIt+0,1),floor(rand(0)*2))x+/**/fRoM+information_schema/**/tAbLeS+/**/gRoUp/**/bY+x)a)   

Or

+or+1=(/**/sElEcT+1+/**/fRoM(/**/sElEcT+count(*),/**/cOnCaT((/**/sElEcT(/**/sElEcT+/**/uNhEx(/**/hEx(/**/cOnCaT(0x217e21,0x4142433134355a5136324457514146504f4959434644,0x217e21))))+/**/fRoM+information_schema/**/tAbLeS+/**/lImIt+0,1),floor(rand(0)*2))x+/**/fRoM+information_schema/**/tAbLeS+/**/gRoUp/**/bY+x)a)+and+1=1   

As one can see the code is specifically targeting MySQL databases.  We presume that they would then, If successful, make further attempts to obtain more information to make a more specific targeted attack.

Continue reading
Geoffrey Chapman

CSS: text wrapping in a table cell. word-wrap

The subject of wrapping text in a cell with CSS is reasonably well documented, and we recently investigated a specific case where the use of the standard ‘options/commands’ didn't seem to be having the desired effect. This was complicated by the fact that the target cell was a variable width.

The obvious commands are:

word-wrap  - which can take the one of two optional parameters:  ‘normal’ which will break words only at allowed break points; and ‘break-word’ which allows unbreakable words to be broken.

word-break – which has three possible values: ‘normal’ which breaks non-CJK scripts according to their own rules; ‘break-all’ where lines may break between any two characters for non-CJK scripts; ‘hyphenate’ where words may be broken at an appropriate hyphenation point.

Despite ‘playing’  with these the text was not breaking at the end of suitable values.

Continue reading
Tags:
website tables CSS
Geoffrey Chapman

sh404SEF housekeeping and€“ shURLS

9539.png We turn our attention today to the question of shURLs. To quote Anythingdigital “shURLs — formerly called pageID — are tiny URLs automatically created by sh404SEF®. Their short length make them ideal for use in social networking sites or on print media such as business cards or promotional items.”

They seem to come preconfigured to be generated (at least we have no recollection of turning their generation on) by sh404SEF for certain Joomla components and we have observed the large number of ‘automatically’ created short URLS on our modest site.  We ourselves do not tend to use them, but what is interesting is the contents of these ‘short URLs’.  The vast majority were for subjects that have no relevance for our site what so ever and typically for subjects that would fall under the category of ‘SPAM’. They (most of the invalid/unrequired/unrelated ones) seem to be trying to ‘redirect’ or send email to external locations.

Continue reading
Tags:
sh404sef joomla links browser
Geoffrey Chapman

Joomla JCE editor problems

jceFor some time I have been experiencing a few problems with the changing  of formatting within articles etc.  Typically these showed themselves as repeating space characters being converted to '’non breaking spaces’ (&nbsp). and then after saving a second time being converted to ‘A caret’ characters.

Web searches showed that many others have seen these types of problems as well, although there were no definitive solutions, despite many suggestions that didn’t work when we tried them.

Other examples we have seen include occurrences such as the removal of <br> tags by <p> tags enclosing a non breaking space character were also seen.

These tend to become very annoying over time so we think we might now have a solution that seems to work for us.

To resolve <br> & <br clear="all" /> tags getting deleted or converted to <p></p>

Go to components >> JCE >> Editor Global Configuration >> Formatting and Display >> Container element >> Change to : No container and parameter on enter

To resolve Contiguous (repeated) spaces getting deleted.

Go to components >> JCE >> Editor Global Configuration >> Cleanup and output >> Entity Encoding >> Change to Named

To ensure all <br> tags are retained over HTML cleanup.

Go to components >> JCE >> Editor Profile>>Default >> Editor Parameters >> Advanced>>Extended Elements>>Add: br

Tags:
joomla editor website
Geoffrey Chapman

Joomla - Breadcrumb links

b2ap3 icon joomlaWe recently noticed a peculiarity on our site with some breadcrumb links containing certain entries which when clicked displayed a page in ‘Joomla Blog’ format containing articles which generally would not be seen, except under specific circumstances.  Nothing security related in our situation but potentially could be.  These pages were certainly not explicitly created on our site and were obviously generated ‘on the fly’.

Using the standard Joomla breadcrumbs generation there is nothing specific that one can configure/change to resolve this type of problem so it was down to some possibly lengthy investigation as to the cause(s).

To resolve the problem we discovered that the URL being used was from a SEF plugin/component (in our case SH404SEF) which contained several aliases and it was necessary to remove the specific URL (plus aliases).  Then once we had done this and  purged the page cache, the page and its breadcrumb links displayed as correctly as expected without the additional link that had been present before.

[Note: If there are several aliases for a speciifc SH404SEF URL then one might possibly be able to choose one of the alternative aliases which no not show the 'additional unrequired' breadcrumb link, but this is not necessarily the general situation and may involve some trial and error.]

Before reaching this point we did wonder about how the link to the page from an article had been created, having previously been selected from the article, so we changed it to be via the menu link.  This is not really required, but the observation is that a name(s) of the 'additional/unwanted' breadcrumb link(s) related to the category to which the article was attributed and it does make the site a little cleaner perhaps. 

On a large site with many pages such a situation may be difficult to discover and there may be many such situations, but we are unaware of any current method to discover these other than careful page inspection.  It was bad enough on our modest site, let alone a really large site.

Tags:
website links joomla breadcrumbs
Geoffrey Chapman

Web slow down?

spamI have previously posted an entry on the latest version of Firefox 19.0.2 where I mentioned that there were speed problems accessing certain web sites, including but not restricted to the BBC web sites.

The following article was posted the other day which may go some way to explaining my observations. Access to the article may be slow, but it describes how a row between a spam-fighting group (Spamhaus) and hosting firm (Cyberbunker) has sparked retaliation attacks affecting the wider internet.

Tags:
browser SPAM website
Geoffrey Chapman

Detected intrusion attempts again

We are seeing a persistent number of web attacks on our site by hackers which seem specificaly designed to attack a WordPress site.

These attacks take the form of Remote File Intrusion attempts. These are where hackers try to force a vulnerable extension into loading PHP code directly from their server. This is done by passing an http(s):// or ftp:// URL in their request, pointing to their malicious site.

They are using Wordpress plugins in the main, so if you are a WordPres site this is something be to aware of. The source of the attacks is a little varied but the IP addresses tend to indicate the US and Canada, but of course these may be compromised addresses hiding the real source.

Tags:
security website
Geoffrey Chapman

Now we have BACN in addition to SPAM

spamA new term seems to have entered usage used to describe nuisance emails. Bacn is the term used for all those reminders, newsletters, notifications, limited offers, alerts and other ephemera sent by websites, e-tailers and other services you have used ever since you made your first mouse clicks on the web.

It takes its name 'bacn' because it tries to describe those messages that sit in the middle of a short continuum between which technical folks call spam (fake meat/junk mail) and ham (real meat/real mail). These messages are bacn because they are not quite real messages but are not quite junk either.

It is classed as a problem because it is something you probably want to read, yet not quite yet, and it masks the real email messages you want to read now.

The BBC web site has an article expanding upon the topic you might or might not want to read.

 

 

Tags:
Privacy SPAM
Go To Top

Joomla! Debug Console

Session

Profile Information

Memory Usage

Database Queries