29
Mar
2011

Changing Your WordPress Multisite Admin Username – Network Admin

No doubt you found and followed some tutorials to change your admin user name, you most likely found some old MU tutorial and then found that your new WordPress 3.1 Network Admin menu/area just disappeared.

Well this quick set of pointers should help you out! ;-)

Log into your PHPMyAdmin or what ever you are using to edit your database.

1. Find the table “_users”.
2. Edit the row where the “user_login” column is equal to “admin”. Change the admin part to what ever is your desired user name.
3. Also edit the row where “user_nicename” column is equal to “admin” (same as above) Change this to your desired “nice” name (no spaces or such) – This is also used within BuddyPress for the profile link and @admin.
4. BuddyPress users will want to change their profile where it echoes out “admin”, this is located in the table “_bp_xprofile_data”.

Now you will most doubt have done all that but now can’t find the “Network Admin” link and section, well you need to edit one more thing:

5. Open the table “_sitemeta” There is a row “site_admins” with data under the column “meta-data”, it will look like this:

a:1:{i:0;s:5:"admin";}

You will want to change this including the number 5 which is the character count of your username, so in my instance it will look like this:

a:1:{i:0;s:3:"tim";}

Save and test it out, that should fix the issue for you.

Please note: There could well be other instances in the database on a multisite install, I haven’t thoroughly checked. I only worked through this to help another user find a solution, this worked for me and then worked for them. Always make a backup of your database first! ;-)

Hopefully this should help someone out there! :-)

24
Mar
2011

noreply@ wordpress@ Ripping Your Hair Out And Want To Change These?

You might find these when using BuddPress, Contact Form 7, WPMUDEV Supporter Form and no doubt it annoys you! ;-)

First of all if you are runing a vanilla install of WordPress you will have no doubt noticed that when system e-mails are sent out that the address is usually wordpress@yourdomain.com and of course you could most likely find a plugin to combat this but is a another plugin bloating your install really what you need?

So, where can you change this in the core code?

/wp-include/pluggable.php

Around line 391:

391
$from_email = 'wordpress@' . $sitename;

Around line 1057:

1057
$wp_email = 'wordpress@' . preg_replace('#^www\.#', '', strtolower($_SERVER['SERVER_NAME']));

So that is the default out of the way!

Now you are running BuddyPress and you notice that your “Contact Form 7″ or Supporter form is sending out e-mails with a sent address from noreply@yourdomain.com, of course this is damn annoying, it makes it more time consuming when you make replies, often you send an e-mail to yours noreply address and then get angry clients asking why you haven’t contacted them back, or if you use a support desk so you can’t just reply to that ticket. Its most annoying when all you need to do is reply yes or no and especially so when using the supporter form for your clients.

So the problem! It is actually buddypress causing the issue here. At least in 1.2.8 (Not checked other versions) You see it ads filters to the default WP_Mail function forcing its own headers. What you need to do is remove those filters and everything will be back working as it should.

Contact Form 7, Add the following:

remove_filter('wp_mail_from', 'bp_core_email_from_address_filter' );
remove_filter('wp_mail_from_name', 'bp_core_email_from_name_filter');

In the compose_and_send_mail() function around line 693:

693
694
695
696
697
698
	function compose_and_send_mail( $mail_template ) {
 
		remove_filter('wp_mail_from', 'bp_core_email_from_address_filter' );
		remove_filter('wp_mail_from_name', 'bp_core_email_from_name_filter');
 
		$regex = '/\[\s*([a-zA-Z_][0-9a-zA-Z:._-]*)\s*\]/';

Now it will use what ever you stipulate in the admin area of Contact 7 which is usually the e-mail address for the person contacting you!

And the WPMUDEV Supporter plugin, open the following:

/wp-content/mu-plugins/supporter-premium-support.php

Add it to the supporter_support_page() function which is approx. line 94 it should then look like this:

94
95
96
97
98
function supporter_support_page() {
  global $current_user;
 
	remove_filter('wp_mail_from', 'bp_core_email_from_address_filter' );
	remove_filter('wp_mail_from_name', 'bp_core_email_from_name_filter');

You could if you wished wrap it up in some conditional statements to check for BuddPress first, but for me it is always installed, at least for now! ;-)

If you are not using BuddyPress or you still have this issue after removing the filters then chances are there is another plugin or even theme which is forcing its use of the wp_mail() function.

Note: One thing to remember is that making changes directly to the main files of WP, a plugin or theme means that when you come to upgrade you will need to remember to make those changes again! I prefer this over bloating an install with plugin after plugin. ;-)

15
Feb
2011

Winamp Forums hacked – Winamp Forums Security Breach FAQ

If you ever use Winamp and have ever registered for their forums then you should consider changing your password for that site, if you use that password elsewhere then change them there as well:

http://forums.winamp.com/showthread.php?p=2747002

They were recently hacked and now your details may have been exposed.

Winamp Management Team — On February 11, we discovered that the Winamp Forums (forums.winamp.com) servers were compromised, resulting in a security breach where Winamp Forums users’ email addresses and passwords may have been compromised.

We understand how important trust is, and we’re deeply sorry for and embarrassed about this breach of security. We immediately closed the exploit that led to this compromise and we’re working around the clock to ensure our security moving forward. We’re also committed to communicating openly with you to make sure you understand what has happened, how it may or may not affect you, and what we’ve done to fix things. If you are a registered Winamp Forums user, you should have received an email from us notifying you that your account may have been compromised.

We have confirmed that this attack was isolated to the Winamp Forum (forums.winamp.com) site only. Other Winamp sites and products such as Winamp.com, dev.winamp.com and the Winamp Desktop Media player were not affected in any way.

We have prepared the following FAQ for questions you may have about this incident. If you have additional questions please feel free to contact us at support@winamp.com.

1) How do I know if my password was hacked?

If you’ve registered an account on the Winamp Forums (forums.winamp.com), then it’s best to assume that your username and password were included among the compromised data.

Passwords in our database are encrypted (i.e., not stored in plain text), but they may still be vulnerable to hackers. You should immediately change the password on your account, and if you used that password on any other web site, you should change your passwords on all of those accounts as well.

2) What data was exposed in this breach?

We have confirmed that your email address was exposed as a result of this attack. We have not confirmed but must assume that other Winamp forums user account detail, including your forums username, date of birth, time zone preference and password hash (not your clear text password).

3) Should I be concerned about my other online accounts? What if I used that password on other sites?

If you used your Winamp Forums (forums.winamp.com) password on any other web sites, you should change the password on those sites as well, particularly if you used the same username or email with that site. To be safe, however, you should change the password on those accounts whether or not you were using the same username. We’ve put together a guide to help you audit and change your passwords.

4) How can I delete my account?

We understand how important trust is on the web, and some of you may wish to delete your Winamp Forums account. To delete your account make sure that you are logged into the Winamp Forums and follow these simple instructions:

Scroll down to the bottom of the forum home page and click on ‘View Forum Leaders’. Scroll down to the Root section to see the list of Administrators. Send your deletion request to DJ Egg or DrO using the contact link to the right of the administrator’s name. The Administrator will delete your account upon receiving the private request message.

5) How do I change my password?

You can change your password in your “User Control Panel” settings. Log in to your account, click the “User Control Panel” in the Forum Nav, then click “Edit Email & Password” under “Settings & Options” Enter your old password and your new password, re-enter to confirm new password and click “Save Changes.” Your password will be updated. You can also change the email associated to your Winamp Forums account on the same screen.

6) What if I forgot my Winamp Forums password?

On the Login screen attempt to log in once, after you fail one login you will see “Forgot your password? Click here!”. Enter the email associated to your account and text/numbers in the image verification box (aka Captcha). You will be sent an email at that address that will reset your password. Follow the link you will be taken back to Winamp Forums and another email will be sent to the same account. Use that username and temporary password to login. You can reset your password now by going to the User Control Panel. See instructions in #5 above.

7) Who was responsible for the security breach? How did it happen?

Our security team was able to identify and block access to the application flaw which resulted in this breach. The application was patched and new security measures have been deployed to keep this type of breach from happening in the future.

8) How are you notifying those whose details were compromised?

We are in the process of notifying all users with a registered account for the Winamp Forums via email. Please feel free to forward these FAQs to anyone you know who uses Winamp Forums. We can also be reached at support@winamp.com

9) What are you doing to ensure this doesn’t happen in the future?

The security team has introduced new web application protections and monitoring processes to detect abusive activity.

10) What should I do now?

You should change your password as soon as possible, both on the Winamp Forums and on any other site where you use that password.

11) When did you discover the breach had occurred?

We discovered the breach on Feb. 11. We actively monitor Winamp Forums and all Winamp products via a rigid security plan and software that alerts us whenever there are attempts to breach that security. Those processes alerted us of this breach and we reacted within 24 hours and shut down the exploit.

12) I received an email from “Winamp” on February 15, was that from you?

Yes, we sent an email on February 15 to all Winamp Forums users informing them of this breach and asking them to reset their passwords for the Winamp Forums and any accounts where they use the same email and/or password. The subject was “Winamp Forums Security Notification” and the body of that email was as follows:

Hello,
My name is Geno Yoham and I am the General Manager of Winamp. First, thank you for your support of Winamp. The Winamp Team is dedicated to providing you with the best possible media player experience so it gives us great pain to share that we have recently experienced a security breach of our user forums database.

We have confirmed that your email address was exposed as a result of this attack. We have not proven but must assume that other Winamp Forums user account detail which includes your forums username, date of birth, time zone preference and encrypted password (not your clear text or unencrypted password) was exposed. We have secured our Winamp Forums application and we would like to notify you of the incident and ask you to immediately change your password as a precautionary measure. If you have used your Winamp forums password across other web sites, please change the password on those web sites as well.

We apologize for any inconvenience this has caused and want to assure you that we are taking every possible step to ensure that your data and personal information remains secure as a part of our ongoing commitment to protecting your privacy.

If you have any questions or would like to speak to someone at Winamp for more information about your account, please contact:support@winamp.com. We have also set up an FAQ at forums.winamp.com for questions you may have related to this incident.

Best,
Geno Yoham
Winamp

13) What can I do if I’m receiving spam because my email was leaked?

You can take steps on your own to wipe out spam from your inbox, but you’ve also got legal recourse.

The CAN-SPAM Act of 2003 allows for private right of actions against spammers. If you receive any spam in your inbox that you believe is related to your leaked email address, please report it to the Federal Trade Commission. Send a copy of unwanted or deceptive messages tospam@uce.gov. The FTC uses the unsolicited emails stored in this database to pursue law enforcement actions against people who send deceptive spam email. For additional information, please visit the FTC’s website. Note, you should not respond to a spam email. By doing so, you confirm that your email account is active, and you’ll likely be flooded with more spam.