Topic: Patch to ban includedir=http:// or _PHPLIB[libdir]=http:// access

[mnirwan]

I've just added a patch to ban URL matching includedir=http:// and the likes. Wordpress is not vulnerable to such exploit. However, people who does that may try to do it like tons of time skewing your StatPress page views and / or wasting your bandwidth.

Check out my post below for how to do it.

http://www.microshell.com/website_internet/security/updating-wp-ban-to-include-bad-urls/

Thanks.

[GaMerZ]

Wow, that is a good one! Could you add in the code to the dev version, http://downloads.wordpress.org/plugin/wp-ban.zip and then I will commit it to the SVN =)

Also perhaps you can post your name and URL to appear in the credit section of the readme.html

[mnirwan]

  Glad you like it. Attached is the zip source code that I've applied the patch for banning bad URLs on your dev version. Let me know if there are problems.

BTW, my name is Maresa Nirwan. For URL, you can put my blog http://www.microshell.com

Thanks

[GaMerZ]

Thanks! I will commit it to the SVN when I am free -D