WPIntell

Source evidence

Random folder name

Sell My Plugin · support · 2012-11-20T00:04:00+00:00

mixedsentiment
mediumseverity
0.73relevance
1replies
Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

3 / 31 rows with source links

9.7% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

28 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support
trentb2 resolved
I tried your plugin, looks great but had a hard time getting it to even install. Turned out the random folder name had a slash in it which of course could not be in name of a folder. Perhaps need to create random name but exclude characters not allowed in directory names. thanks. http://wordpress.org/extend/plugins/sell-my-plugin/ Replace the function with this one. I am just looking for a way to make it as secure as possible without the ability to guess the name. I have never run into this issue but with a bit of digging, i see that php crypt() does include these characters. in sell-my-plugin.php replace with this. function gen_secret_dir() { //set the random id length $random_id_length = 10; //generate a random id encrypt it and store it in $rnd_id $rnd_id = crypt(uniqid(rand(),1)); //to remove any slashes that might have come $rnd_id = strip_tags(stripslashes($rnd_id)); //Removing any . or / and reversing the string $rnd_id = str_replace(".","",$rnd_id); $rnd_id = strrev(str_replace("/","",$rnd_id)); //finally I take the first 10 characters from the $rnd_id $rnd_id = substr($rnd_id,0,$random_id_length); return $rnd_id; } # End Secret Dir Let me know if there are any other issues.

Comments

1 shown
Rob Landry 2012-11-20T20:03:00+00:00

Replace the function with this one. I am just looking for a way to make it as secure as possible without the ability to guess the name. I have never run into this issue but with a bit of digging, i see that php crypt() does include these characters. in sell-my-plugin.php replace with this. function gen_secret_dir() { //set the random id length $random_id_length = 10; //generate a random id encrypt it and store it in $rnd_id $rnd_id = crypt(uniqid(rand(),1)); //to remove any slashes that might have come $rnd_id = strip_tags(stripslashes($rnd_id)); //Removing any . or / and reversing the string $rnd_id = str_replace(".","",$rnd_id); $rnd_id = strrev(str_replace("/","",$rnd_id)); //finally I take the first 10 characters from the $rnd_id $rnd_id = substr($rnd_id,0,$random_id_length); return $rnd_id; } # End Secret Dir Let me know if there are any other issues.