Get A Sys Admin

sysadmin linux open source centos redhat rhel ubuntu apache mysql amazon ec2 s3 tutorial

Jan 23, 2010

WordPress and dubious themes

If you are like me and deal with a lot of WordPress themes chances are that you have encountered several themes that contain something like:
eval(base64_decode('ZnVuY3Rpb24gY2hlY2tfdGhlbWVfaGVhZGV
yKCkgeyBpZiAoIShmdW5jdGlvbl9leGlzdHMoImZ1bmN0aW9uc19maWxlX2V4
aXN0cyIpICYmIGZ1bmN0aW9uX2V4aXN0cygidGhlbWVfZm9vdGVyX3QiKSkpI
HsgdGhlbWVfdXNhZ2VfbWVzc2FnZSgpOyBkaWU7IH0gfQ=='))

Now, all the people, or at least most of them would advice not to use such things on your WordPress and probably they are right. But if you are a curios person like me you have to know what that long string means.
function check_theme_header() { if (!(function_exists("functions_file_exists") && function_exists("theme_footer_t"))) { theme_usage_message(); die; } }
Meh, not a big deal. Someone is very obsessed about his links in the footer of your WordPress theme. He want's to make sure you keep his precious links in place. Whatever!
I find this very rude however and a headache for anyone that installs wordpress themes, especially free ones. A simple "Please keep the footer intact" would do better. People are going to replace the footer anyway if that's what they desire. No one wants some strange text that he doesn't know what's doing on his server.

And because I like to have at least one useful thing in my posts here is a link to an online decoder, the same I have used to decode the example: http://www.motobit.com/util/base64-decoder-encoder.asp

To quickly find such precious bits of information you can run something like:
grep "eval(base64_decode" -r /path/to/some/dir 2>/dev/null

LE: An so I discover another bug in my blogger theme ...

Labels: , , , ,

0 Comments:

Post a Comment

Subscribe to Post Comments [Atom]

<< Home