Current plugin version: 1.0rc2.DA1
Few months ago I found a great plugin SecureImage, which helped me to get out of all nasty spam comments in my blog. However, during the plugin’s usage I found some very nasty problems:
1. Probable and dangerous SQL injection in some parts of the code (original author was already notified)
2. Sometimes the PNG image was not displaying correctly, and also PNG image stream contained the whole blog’s main page after the PNG image. Obviously, this was causing wrong images for some contents of the main page (most of the times the contents were OK and the PNG image was displayable).
3. Pingbacks and trackbacks were disabled. Mike Baptiste’s comments told me how to re-enable this back, and I integrated it in this custom version of the plugin.
As direct result of all the problems above, I decided to create new version of this great plugin. The new version is based at the original plugin, plus the three fixes above. Please feel free to download and use it. Installation instructions are simple – just copy the plugin and enable it – it should be quite sufficient.
Please have in mind that I also changed a bit the form with the secure image – I like the image to be just after the edit box, where the user should enter it. I find it more compact this way.
If you find a problem, or have an idea, or just want to say something, please do not hesitate to comment below!
_Update_: It seems to me that the pingbacks/trackbacks still do not work. Any help with that will be much appreciated!
I had secureimage.php working, and then installed yours (basically overwrote secureimage.php with your version). i get a mysql error with your version… something about not being able to find the img hash or something. then it spews out a bunch of random characters. what am i doing wrong?
It seems you just replaced the php file, without disabling/enabling the plugin itself.
You suppose to disable/enable the plugin, because it needs to re-create its table.
The error you see is because you miss one of the fields in the database.
Nice job on the update. I modified the plugin to put it back mostly to the way it was before, i.e. without the “Security code […]” stuff. So, on my installation it just shows the image.
Nice catch on the sql inject..