19 Dec, 2008
Top Commentators Link Hijack Vulnerability
I was using the Top Commentators plugin, created by WebGrrrl, downloaded from WordPress.org. Supposedly the latest version released by her fixed the link hijack vulnerability by allowing you to group by name or email address, but as I discovered today, it didn’t work. I don’t know if it was intentional link hijacking, but will assume it was not…
While I commented about it here, I thought that enough people use this plugin that I should highlight this problem in case people are using that version.
Instead of using that plugin, try this one, found at StuffBySarah.net. Unfortunately it’s not as plug-and-play as the original, but it only took a matter of minutes to get it set up.
In order to use it as a widget, you will need the ExecPHP plugin found here. Once you install and activate that plugin, you can go to your Widgets and drag over “PHP Code” – edit that widget and paste in the following code:
<?php if(function_exists('ns_show_top_commentators')) { ?>
<li>
<ul><?php ns_show_top_commentators(); ?></ul>
</li>
<?php } ?>
If you don’t use widgets, you can add this code to your sidebar php file:
<?php if(function_exists('ns_show_top_commentators')) { ?>
<li>
<h2>Top Commentators</h2>
<ul><?php ns_show_top_commentators(); ?></ul>
</li>
<?php } ?>
I should point out that the code above is not what I found to work best due to the unordered lists… Here is the exact code I have in the widget:
Want to be listed here? Leave some comments!
<br/><br/>
<?php if(function_exists('ns_show_top_commentators')) { ?>
<ul><?php ns_show_top_commentators(); ?></ul>
<?php } ?>
Now, I don’t know if everyone using the original Top Commentators plugin was experiencing this problem, but I was able to replicate it on two different blogs and have since tested the new plugin on both blogs with no hijacking. I hope this helps some of you…
