[Source]

This vulnerability could be prevented by securing the /wp-admin directory.

BlogSecurity has recommended before that the /wp-admin/* directory should be password protected or restricted to IP address. This would mitigate this problem. See our advisory here for details. [Source, BlogSecurity, WordPress <= 2.8.3 Reset Admin Password Vulnerability]

See details of the exploit at milw0rm.

So I jump over to Reality Me to see if it exhibits the same behavior. On Reality Me, I can create a post with tags with no problem. But on the dashboard under Incoming Links, Plugins, and WordPress Development Blog, I get a fatal error:

Fatal error: Please call SimplePie_Cache::create() instead of the constructor in /home/www/htdocs/realityme_net/wp-includes/class-feed.php on line 13

I have not tested the other blogs and sites yet. For both Reality Me and Domestic Psychology, I went back and deleted almost all files with the exception of the wp-content directory, the robots.txt, and the .htaccess. I rebuilt the WordPress installation and yes cache directories were removed. WP-Cache is not used. I also repaired and optimized all database tables. Active plugins on Reality Me: Audio Player, Seesmic, ShareThis, SimpleLife, Spam Karma 2, Subscribe to Comments, WordPress.com Stats, and WordPress XHTML Validator. Active plugins on Domestic Psychology: Audio player, Get Recent Comments, Lifestream, ShareThis, Spam Karma 2, Subscribe to Comments, and WordPress.com Stats.

In typing this, I realize that the SimpleLife plugin uses SimplePie and is likely to be the root cause for the Reality Me problem.

Update: Deactivating SimpleLife fixed the Reality Me problem.

Update: Disabling all plugins on Domestic Psychology did not change the fact that Post Tags could not be added to to the post.

Update: I’ve narrowed it down to Cathy’s theme. None of the active plugins on Domesticp Psychology are causing the problem. She is using a Woo theme called irresistible. Disabling this theme fixes lets her use tags with posts again. Time to see if Woo Themes has posted a fix. Yes. irrestible 2.0.0 fixes the post tag problem.

At ShareThis.com, a publisher generates a script that looks like this:

<script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=abcdefgh-ijkl-mnop-qrst-uvwxyz012345&amp;type=wordpress&amp;embeds=true&amp;post_services=facebook%2Cdigg%2Cdelicious%2Cybuzz%2Ctwitter%2Cstumbleupon%2Creddit%2Ctechnorati%2Cmixx%2Cblogger%2Ctypepad%2Cwordpress%2Cgoogle_bmarks%2Cwindows_live%2Cmyspace%2Cfark%2Cbus_exchange%2Cpropeller%2Cnewsvine%2Clinkedin%2Cfriendfeed&amp;headerTitle=Thank%20you%20for%20sharing!"></script>

After updating, the code will have a 2nd publisher id appended to the end. With two publisher ids, ShareThis will not register your site nor collect statistics.

<script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#publisher=abcdefgh-ijkl-mnop-qrst-uvwxyz012345&amp;type=wordpress&amp;embeds=true&amp;post_services=facebook%2Cdigg%2Cdelicious%2Cybuzz%2Ctwitter%2Cstumbleupon%2Creddit%2Ctechnorati%2Cmixx%2Cblogger%2Ctypepad%2Cwordpress%2Cgoogle_bmarks%2Cwindows_live%2Cmyspace%2Cfark%2Cbus_exchange%2Cpropeller%2Cnewsvine%2Clinkedin%2Cfriendfeed&amp;headerTitle=Thank%20you%20for%20sharing!&amp;publisher=a1b2c3d4-ijkl-mnop-qrst-u4w2y10a2r4d"></script>

After reviewing the plugin code, I realized the way ShareThis generates the script must have changed overtime. Crowd Favorite wrote a great plug-in but it expects the publisher=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx to be at very end and if it does not find a publisher id at the end, it puts one there which is why you will end up with two publisher ids. To fix this, simply move the publisher id to the end of the script before pasting the code into the ShareThis settings box in the WordPress admin:

<script type="text/javascript" src="http://w.sharethis.com/button/sharethis.js#type=wordpress&amp;embeds=true&amp;post_services=facebook%2Cdigg%2Cdelicious%2Cybuzz%2Ctwitter%2Cstumbleupon%2Creddit%2Ctechnorati%2Cmixx%2Cblogger%2Ctypepad%2Cwordpress%2Cgoogle_bmarks%2Cwindows_live%2Cmyspace%2Cfark%2Cbus_exchange%2Cpropeller%2Cnewsvine%2Clinkedin%2Cfriendfeed&amp;headerTitle=Thank%20you%20for%20sharing!&amp;publisher=abcdefgh-ijkl-mnop-qrst-uvwxyz012345"></script>

Note: In the settings box, the &amp; will be converted to just & but the code correctly uses &amp; with the post. Your code will still be xhtml compliant.

Spam Karma puts Akismet and other spam fighting tools to shame. I think in all the time I have been using Spam Karma, I have had only one false positive. I get false negatives on trackbacks but that is because it was only recently that I realized I could change the settings for how Spam Karma handles trackbacks so I’m still making adjustments.

I also found Dave’s comments on a WordPress replacement very interesting. Specifically he notes, "If you look at it, blog systems are over 10 year old now. Their UI have barely evolved since the first versions. … There is a bad need for a groundbreaking platform that would get rid of ten years of accumulated UI habits."

Update: If you add Seesmic video comments to your blog, be sure to immediately add yourself to the wiki. It takes only seconds. I could have been within the first 100 but ended up being like 187 because I waited to look at the wiki.

Update: Looks like MaciVerse is back up. I just caught caught it during Maciverse’s face lift.

How To: Import your iWeb Blog to WordPress

Written by Dan on March 8, 2008 – 3:50 pm –

iWeb, Apple’s website creation application that comes with each new Apple computer is designed to allow users to quickly create websites and blogs. While the process is quick and simple it also lacks some of the more complicated features that you see in many blog sites today.

If you’ve created an iWeb blog but want to add features and a bit of complexity to your site, moving to WordPress may be just what you’re looking for.

WordPress is one of the most popular free website and blogging software options that allows you to create custom blogs with all the features you like. Additionally, setting up WordPress so that it is easily indexed by Google and other search engines is easy, something that iWeb has never done well.

The rest of this article will walk you through the process of moving your blog from iWeb to a new WordPress install.

SETTING UP WORDPRESS

Before you move your site to WordPress you need to get it installed on web server. You can download the files you need to then upload and customize to your webserver at wordpress.org.

After you’ve downloaded the file you can follow the 5 minute install instructions :

“Here’s the quick version of the instructions, for those that are already comfortable with performing such installations. More detailed instructions follow.

1. Download and unzip the WordPress package, if you haven’t already.
2. Create a database for WordPress on your web server, as well as a MySQL user who has all privileges for accessing and modifying it.
3. Rename the wp-config-sample.php file to wp-config.php.
4. Open wp-config.php in your favorite text editor and fill in your database details.
5. Place the WordPress files in the desired location on your web server:
   • If you want to integrate WordPress into the root of your domain (e.g. http://example.com/), move or upload all contents of the unzipped WordPress directory (but excluding the directory itself) into the root directory of your web server.
   • If you want to have your WordPress installation in its own subdirectory on your web site (e.g. http://example.com/blog/), rename the directory wordpress to the name you’d like the subdirectory to have and move or upload it to your web server. For example if you want the WordPress installation in a subdirectory called “blog”, you should rename the directory called “wordpress” to “blog” and upload it to the root directory of your web server. Hint: If your FTP transfer is too slow read how to avoid FTPing at : Step 1: Download and Extract.
6. Run the WordPress installation script by accessing wp-admin/install.php in your favorite web browser.
   • If you installed WordPress in the root directory, you should visit: http://example.com/wp-admin/install.php
   • If you installed WordPress in its own subdirectory called blog, for example, you should visit: http://example.com/blog/wp-admin/install.php

That’s it! WordPress should now be installed.”

The most difficult process of the installation is setting up the database that will store all your blog data for you, but your webhosting provider should be able to assist you if following the guide linked to above is not enough information.

Once you’ve finished installing WordPress you’ll need to get ready to to import your iWeb Blog entries.

PREPARE WORDPRESS FOR AN iWEB IMPORT

Now that you’ve finished installing wordpress you’ll need to navigate to the wordpress login page and login with the admin account created for you during setup. Once you’ve logged in, I suggest creating another account with your “Posting” name so that articles you publish in the future will be listed as something you created.

On the WordPress Management page, navigate to Manage and then click import. You’ll see that there are a number of other blogging software tools that wordpress lists as options for imports but that iWeb is not included.

Fear not, one option that is listed will allow you to import all of the articles you’ve previously created in iWeb. But before we do that we need to make sure that we have the iWeb files ready for import into WordPress.

PREPARING iWEB FILES TO IMPORT TO WORDPRESS

Since you’ve been using iWeb for your previous blogging efforts you you’ve already created a number of posts for your blog. To prepare those posts to be imported into WordPress you need to export your iWeb site to a folder.

1. Open iWeb
2. Select the Blog Site you plan to import into WordPress
3. Click File and then Publish to a Folder
4. Save the folder to your desktop so that you can access it easily.

Like most new website applications, iWeb has built in RSS support. We’ll use the RSS file that is created in iWeb to import your blog into WordPress. Since we published to a folder on the desktop we can find the RSS feed for the blog in that folder.

IMPORT YOUR iWEB BLOG TO WORDPRESS

Navigate back to the admin page for your new WordPress Install and follow these steps:

1. click again on Manage and then Import.
2. Select RSS
3. Click Browse next to choose a file
4. Select your desktop and then the folder you exported your iWeb Blog to
5. Open the folder, and then the Blog Folder inside it.
6. Locate the rss.xml file, select it, and click open
7. select upload file and import

At this point wordpress shall import the posts 1 at a time and show the results with “1. Importing Post… Done” for each post in the rss feed file you have for your blog. When this has finished click the View Site link on the WordPress Admin site and you’ll see the results of your import from iWeb into WordPress.

NOTE: Not all formatting and image link structure always imports correctly. You may have to adjust the format of some of your posts to make them look the way you like. Additionally some picture images or links may not have transfered over completely and you’ll have to update their internet linkage.

CONCLUSION

Even though everything doesn’t import across with the same formatting that you set in iWeb, this is a way to import your iWeb blog to WordPress so that you can make your site more Search Engine (SEO) friendly and have additional customizable features. Be prepared to make adjustments to links and images in addition to restructuring the format of some of your posts. These adjustments are often just a few clicks from the WordPress Admin page.

To see our example of an iWeb page before check out our iWeb to WordPress page and then view it in WordPress.

if you enjoyed this article, please subscribe to our RSS feed so that you don’t miss future hints, tips, and reviews.

[Source, MaciVerse, How To: Import your iWeb Blog to WordPress] [Googe cache]

In short, I need to do troubleshooting which could take a lot of effort. If you notice problems with Reality Me or Domestic Psychology, please email me or Twitter me and let me know about the issue or error message. I am also going to try out the WP-Cache plugin so I would be interested in hearing about any odd behaviors (or improvements) it created. Thank you!

I think having the ability to post by email when I cannot otherwise reach the blog is a powerful feature. Having the post hidden from publication by slapping it into a pending review status makes posting by email a bit useless, at least for my purposes.