Mikes Musings » Mike Kaply

How My Site Was Hacked

Mike Kaply — Mon, 14 May 2012 15:22:26 +0000

So in case anybody cares, what happened was that I apparently have a theme that got hacked. It appears to be a theme called super blogger had a helper.php file in it’s images directory which allowed files to be posted into that directory.

Using that uploaded file, extra code was added to my functions.php file in my standard theme which opened a backdoor and gave free reign.

Many thanks to Alex McKee who helped me track things down.

I recommend reading this post from Dave Meehan for more detail.

FYI, a couple things that should have clued me in (which I’ll look for in the future). First, I started getting an error on my admin console about extra data sent before the headers. I stupidly went into functions.php and fixed it (even working with 8Bit support) without noticing the added code. Second, in the source to my pages, there was a misspelled “Wordpres Counter.” That should have clued me in as well.

My Site Was Hacked

Mike Kaply — Mon, 14 May 2012 00:12:30 +0000

My WordPress site was hacked and apparently over the past couple days there was an embedded iframe that was causing a virus to be sent down. I did not totally determine what happened, but I’m continuing to investigate. I removed some bad code I saw.

Please make sure you use antivirus and your definition are current. If you do get a warning on any page, please let me know so I can investigate.

Thanks.

Customizing Firefox – Hiding Private Browsing

Mike Kaply — Fri, 11 May 2012 18:27:25 +0000

Update: I was reminded that using visibility: collapse for menu items leaves them in the key navigation. Instead, you should use hidden=”true” or in places that doesn't work (context menus) display: none.

In my previous post, I showed how to setup a basic extension in Firefox. Having this extension will allow us to do some Firefox customization. Before I get into this post, though, I wanted to clarify one thing. I had you put your XUL overlay in the root directory and point your content directory to ./. I did that to make things simpler but in practice you'll want to separate your files. The structure most commonly used is a chrome directory with a content subdirectory underneath. In that case, the directory in the chrome manifest would be chrome/content/.

With that out of the way, let's customize Firefox. We're going to prevent a user from accessing private browsing. We need a disclaimer here, though. We are not removing private browsing, we are just removing access. So if the user has an add-on that invokes private browsing, or if they have access to about:config, they can still turn on private browsing. For any of these customizations, there's an expectation that the right things have been done to prevent the user from accessing functionality via other means.

The first step to removing functionality from the browser is to understand the different ways a user can access that function. For private browsing, there are three entry points, the Start Private Browsing menu item on the Firefox button, the Start Private Browsing menu item under the Tools menu and the keystroke Ctrl+Shift+P (command+shift+P on Mac). We'll need to handle each of these cases and prevent the user from accessing them.

In my previous post, I said that we needed the ID of an item in order to customize it. There are two ways to find the ID. One is to use the DOM Inspector and the other is to search through the Mozilla source code. I prefer to search through the Mozilla source code because it usually gives me a lot more information. Here's how I locate what I need.

The Mozilla source code is hosted in a tool called MXR and can be easily searched. The first thing you want to search on is the text of the menuitem you're trying to remove. So we'll search on Start Private Browsing. What we're looking for usually is a DTD file that has the same text as the menu item. This will help us find the actual menu item. In this case, that file is browser.dtd:

The information we actually need is the label on the left. By using that as a search term, we can find the menus that have this as their text. So we search for privateBrowsingCmd.start.label. This looks a lot more promising. We see references to browser-appmenu.inc and browser-menubar.inc. These files contain the menu items we're looking for. So let's look at one of those menuitems:

There is one of the IDs we need - appmenu_privateBrowsing.

So if we add this to our XUL overlay:

It will hide the menu item on the Firefox button.

If we look further at this menu item, though, it will give some more interesting information. In particular it tells us that when this menu item is invoked, it calls a command - Tools:PrivateBrowsing. What if instead of hiding each menuitem, we could simply disable that command? It just so happens that you can do exactly that.

Commands are XUL elements for invoking operations from multiple sources. Because command is a XUL element, we can override it just like any other element. So let's find this element by searching the source code. In browser-sets.inc, we find this:

So we can prevent access to private browsing by simply overriding the oncommand:

or we can even display a message when private browsing is invoked:

By changing the command, we can prevent the various menuitems and keystrokes from invoking private browsing at all. This keeps us from having to worry about disabling the keystroke. If you do run into a case where disabling the command is not enough, search for the key value in the file browser-sets.inc. Usually it's just a matter of setting the command on the keystroke to nothing:

Occasionally keys use oncommand, so you'll need to set that to nothing instead.

There's still one more menu item, though, so let's go back to our first search and take a look at browser-menubar.inc.

All we need from here is the id. So let's add that to our XUL overlay:

And there you have it. You've disabled access to private browsing.

Using this process, you can find and customize or disable just about any menuitem in Firefox.

Customizing Firefox – Extensions

Mike Kaply — Thu, 10 May 2012 13:36:58 +0000

I’ve decided I’m going to expand on my earlier post about customizing Firefox with extensions. A lot of the things people have asked for recently can only be accomplished with extensions, so I want to try to give people a very basic handle on creating extensions so I can then give sample code of the specific things people are trying to do.

My goal here is NOT to teach people how to build extensions. You can find that information on AMO or MDN. My goal is give people a very basic understanding of how one particular type of extension works so I can produce simple code snippets you can drop in and use for your Firefox distribution. If you need anything more complex, you’re going to have to hire me.

For the purposes of this discussion, we are only going to focus on extensions hosted in the distribution/bundles directory. The reason is simple – these add-ons do not require any infrastructure like install.rdf or icons. They can consist of only two files, a chrome manifest and a XUL overlay.

Step one is to create a directory for our extension under the distribution/bundles directory where Firefox is installed. You might have to create the distribution directory as well. The directory you create can have any name – it does not have to be the ID of the extension or anything like that. In the new directory, we’re going to create a file called chrome.manifest.

The chrome manifest describes an extension to Firefox or any other Mozilla based product. If you want lots of detail, you can read it on MDN. A minimal chrome manifest only needs two lines:

content myextension ./
overlay chrome://browser/content/browser.xul chrome://myextension/content/browseroverlay.xul

The first line tells Firefox where to find the content of the extension (in the same directory) and the second line tells Firefox to overlay the main browser window with our file, browseroverlay.xul. In later posts, I’ll show you how to overlay different windows and dialogs.

myextension should be changed to something unique for your extension. It can clash with other extensions that are installed.

Next up is the XUL overlay. XUL is an XML based language used for the UI of Firefox. You can read more about it on MDN. XUL overlays allows us to change the user interface of Firefox by replacing and changing the attributes of existing user interface elements. A basic XUL overlay looks like this:

Once we’ve created these two files, we can just add code into the overlay to tweak the browser. For instance, I had a request to block the context menu on the bookmarks toolbar. To do that, you add this code to the overlay (between the two overlay tags):

You may wonder how I figured that out. We’ll talk about it in our later posts. For now, just know you have the basics on how to customize the Firefox UI with an extension.

Again, my plan with this post is not to go into detail about how to do specific things. It’s just to give you a basic understanding of how to change the Firefox user interface.

In the next few posts, I’ll show you how to make specific tweaks to Firefox by either modifying this overlay or overlaying other windows within Firefox.

Adding a Pinterest Image Without Impacting Your Page Design

Mike Kaply — Tue, 01 May 2012 14:18:47 +0000

Recently I had to modify a page to work with Pinterest. The problem was that all the images on the page were either CSS background images or had a height or width of less than 80 pixels. In those cases, the Pin It bookmarklet simply ignores the images. So the question I had was how to make a page Pinterest friendly without impacting the design.

I wanted to add a brand new image, but I didn’t want it to be visible on the page at all. So first I tried the obvious – use CSS to hide the image. The bookmarklet was too smart for me. If an image is hidden via CSS, it won’t be found. Then I tried setting the height and width to 0 via CSS. This didn’t work because the images were less than 80×80. The Pinterest bookmarklet honors the height and width specified via CSS.

In the end, I came up with a solution using opacity:

Pinterest picks up this image and it does not display on the page or affect page layout.

This method can also be used if you want a specific image to be the first image Pinterest finds.

If you want to see this in action, check out the MLB.com Personas Interactive page.

Ars Technica Article on Browsers for Business

Mike Kaply — Thu, 26 Apr 2012 17:53:43 +0000

This article on Ars Technica seemed to fly under the radar, so I wanted to make sure people saw it.

Ars browser shootout: which Web browser is best for business?

I was interviewed for the article. You can see my comments on page 4.

Customizing Firefox – Extensions and the CCK Wizard

Mike Kaply — Fri, 13 Apr 2012 14:19:36 +0000

I’ve saved the most powerful method of customizing Firefox for last – writing an extension. Firefox extensions allow you to customize just about every aspect of Firefox. You can override default behaviors, customize the user interface, change and lock default preferences, even replace entire components.

I’ve found that when most people think of extensions, they think of consumer extensions like the add-ons available on addons.mozilla.org. But you can also build extensions to meet needs within your business. I’ve seen extensions for automating the fill in of forms as well as facilitating business processes. If you think a custom Firefox extension would help your business, there are companies that can help you with that, including me.

Going into detail about how to build an extension is not my goal here. There are plenty of resources on the web. MDN is a good place to start. What I would like to do is talk about an extension I built called the CCK Wizard.

Before we talk about what the CCK Wizard is, let’s talk about what the CCK was. CCK stands for Client Customization Kit. The primary purpose of the CCK was customizing Netscape Communicator for ISPs. So when Earthlink wanted to deploy a customized Netscape with all their settings, they used the CCK to change the titlebar to say “Netscape Communicator by Earthlink,” configure connection settings, set the homepage and more. It also repackaged Netscape with a custom installer. You can read more history here.

When I worked at IBM, one of our goals was to increase the enterprise adoption of Firefox, so I decided to take the concepts of the Mission Control Desktop and the Client Customization Kit and combine them to create a new extension for Firefox called the CCK Wizard.

The CCK Wizard takes you through a wizard to customize Firefox and then generates an XPI at the end that you can install into Firefox to use your customizations. The CCK Wizard allows you to:

Change the default home page and startup override home page
Change the title bar text
Add a help menu item that links to a web page
Provide sites for which popups, cookies and XPInstalls are allowed by default
Preinstall browser plug-ins
Preinstall search engines
Add folders, bookmarks and live bookmarks to the personal toolbar
Add folders, bookmarks and live bookmarks to the bookmarks folder
Set default preferences
Lock preferences
Add registry keys (Windows only)
Add certificates
Set default proxy configurations
Package other XPIs with your distribution
Disable about:config

The CCK has been used by many companies including IBM to customize Firefox for their employees.

I would strongly recommend that you take a look at the CCK Wizard if you haven’t. It might save you a lot of work.

The CCK Wizard is open source and is maintained at code.google.com. Anyone is welcome to participate.

To be perfectly honest, I have not been able to invest as much time in the CCK Wizard as I want. I’ve been able to keep it current with changes to Firefox, but have not been able to really give it the love it needs. I’m hoping to be able to carve out more time for it in the future.

And that concludes our series about customizing Firefox. Any questions?

Customizing Firefox – Disabling Safe Mode

Mike Kaply — Tue, 10 Apr 2012 15:55:34 +0000

I have one more post planned about customizing Firefox with add-ons and the CCK Wizard, but I wanted to get this out in the mean time.

A lot of people ask how to disable safe mode in Firefox in an enterprise environment. This post will tell you how to do it with an add-on.

In my previous post about Integrating Add-ons into Firefox, I talked about putting add-ons into the distribution/bundles directory. The important thing to realize about putting add-ons into this directory is they become a part of Firefox. They are not disabled when Firefox is placed into safe mode (and they shouldn’t be!). So we can build an add-on that disables safe mode and by placing it here, it will always be executed.

Unfortunately, we can’t completely remove the concept of safe mode. The code that makes safe mode happen is in C++ startup code, so we can’t mess with that. But we can make it so that when the safe mode dialog appears, it simply is ignored and the browser is restarted. We do that by overriding the safe mode dialog and forcing it to press the “Make Changes and Restart” button without actually making any changes.

This is a very simple add-on that will consist of two files. I’ll tell you exactly where to put them and where to name them.

Note: There is no need for an install.rdf when you put add-ons in distribution/bundles. (I just discovered this.) Also, it doesn’t matter what the directory is called under bundles.

chrome.manifest goes in distribution/bundles/disablesafemode and looks like this:

content disablesafemode content/

overlay chrome://browser/content/safeMode.xul chrome://disablesafemode/content/safeMode.xul

safeMode.xul goes in distribution/bundles/disablesafemode/content and looks like this:

You can test it by starting Firefox with the -safe-mode parameter or holding down the shift key on Windows or option key on Mac. You’ll see the safe mode window show up for a second (sized very small) and then the browser will restart.

Customizing Firefox – Default Profiles

Mike Kaply — Fri, 30 Mar 2012 16:14:46 +0000

Update: I have made major modifications to this post. I was not aware that Firefox copied the contents of the defaults/profile directory on the file system after using the files on omni.ja(r).

This next method of customization is not as widely used, but it is still worth mentioning. It involves changing the files that Firefox uses when creating a new profile. We’ll also take this opportunity to talk about userContent.css and userChrome.css which we mentioned earlier.

When you create a new profile in Firefox, the profile is prepopulated from the directory defaults/profile in the file omni.ja(r) as well as the contents of the defaults/profile directory where Firefox is installed. The contents of the defaults/profile directory are copied over after the files in omni.ja(r). To retrieve the files you want to modify, unzip the file omni.ja(r) in the Firefox directory and you’ll see the following files in the defaults/profile directory:

bookmarks.html
chrome/userChrome-example.css
chrome/userContent-example.css
localstore.rdf
mimeTypes.rdf
prefs.js

Copy the files you want to modify into the directory defaults/profile where Firefox is installed (you’ll have to create this directory). When a new profile is created, these files (and any other files that are also in the directory) are copied over. You have a two choices when it comes to modifying the default profile – changing the existing files or adding your own.

If you add additional files into this directory, those files are copied into the default profile along with the rest of the files. This is most commonly used if you want to have default certificate databases. I’ve seen cases where someone started Firefox, added the certificates and certificates authorities they needed and then copied the various *.db profiles from their profile and put them in the default profile so all their users would get them.

The other thing you can do is modify the existing files.

You can modify bookmarks.html to add or remove bookmarks. The file has a somewhat unique format, but it’s pretty straightforward to change.

You can modify prefs.js to set default preferences for a user. Here’s an example of setting a preference in prefs.js:

user_pref("browser.startup.homepage", "http://mike.kaply.com");

You can overwrite localstore.rdf if you want to customize the browser. localstore.rdf stores things like the size of the browser, whether or not certain toolbars are displayed and more. You can make customizations in your browser and then copy the localstore.rdf from your profile into the default profile.

But by far the most interesting files in the default profile are userChrome-example.css and userContent-examples.css. When these files are present in your profile using their correct names – userChrome.css and userContent.css – they can be used to override just about anything on web pages and in the browser.

userChrome.css allows you to modify the chrome of Firefox. That’s the area around the browser window. So for instance, if you wanted all menuitems to be bigger, you could specify:

menu, menuitem {
  font-size: 32px !important;
}

There are so many things you can do with this file, I couldn’t even begin to describe them here. You can hide menuitems, change parts of the UI, etc. If you choose to hide something, it’s better to use visibility: collapse than display: none. Messing with display can cause very strange results in Firefox. If you’re interested in figuring out the IDs of the various elements of the UI, check out the DOM Inspector. You can also just browser through the source code. browser-menubar.inc and browser-context.inc are particularly useful.

userContent.css allows you to customize the content of web pages. There are even ways to make your styles only apply to certain web pages. There’s a ton of information about userChrome.css on the web, so I can’t really do it justice in this post. I just want to make sure you are aware of it.

If you do choose to use userContent.css or userChrome.css, I would suggest the methods I talked about in my earlier post on autoconfig. Then you don’t have to mess with the default profile.

Modifying the default profile can be a handy way to set some defaults for your user, but remember that these files are only used when a new profile is created.

Customizing Firefox – distribution.ini

Mike Kaply — Mon, 26 Mar 2012 17:46:35 +0000

In many of my previous posts about installing add-ons into Firefox, I have mentioned the distribution directory. While I’ve primarily indicated that it is a place for installing add-ons, it’s actually useful for more than that. Files in the distribution directory are what allow for custom Firefox distributions like Firefox with Twitter or anything produced by build your own browser. Besides installing add-ons with a distribution, there are two other things you can do: install search engines and customize preferences and bookmarks with a file called distribution.ini.

First let’s talk about search engines. Typically when someone includes a search engine with an add-on, they put it in the add-ons searchplugins directory. If, however, you’re installing your add-on by placing it in the bundles directory (see this post), the searchplugin will not appear. You must put your search engine in the file searchplugins/common under the distribution directory. I you have locale specific search engines, instead of putting them in a directory called common, you should put them in a directory that is named the same as the locale.

The distribution.ini file is where we can do more interesting things with our distribution. This file is placed at the top level in the distribution directory. The most basic distribution.ini file looks like this:

[Global]
id=someidentifier
version=1.0
about=Text that appears in About

The interesting things you can do with distribution.ini is to add preferences and to add bookmarks.

To add preferences, you would add a section like this:

[Preferences]
browser.startup.homepage="http://www.yahoo.com"

These preferences become default preferences (not user preferences). It’s also worth noting that this method will allow you to set the browser.startup.homepage (unlike some other methods). In addition, these prefs can be locale specific. You can get more information here.

To add bookmarks to the toolbar, you would add a section like this:

[BookmarksToolbar]
item.1.title=Mike's Blog
item.1.link=http://mike.kaply.com
item.1.description=Lots of cool stuff

You can also add subfolders and place items in the bookmarks menu. You can get more information here.

The distribution.ini file is useful if all you want to do is add a few bookmarks and customize some preferences. It doesn’t support anything advanced like locking of preferences.