Joomla Chrome and Template Overrides

When you developing a template for a new site you often get stucked, and hit your head against the wall: the code outputted by Joomla sometime severely limits your ability to format the output as you wish. This is true not only for Joomla 1.0.*, but partially for the Joomla 1.5.*. Yes, partially, because you can do things here - and you can do a lot. Searching for a solution for a problem I had run into developing a template for one of my clients I fount this great tip of Jonathan on his blog on http://www.beckettwebdesign.com:
 

---

While working on a client project recently, I had to delve further than ever before into the templating engine within Joomla, and thought recording some tips may be beneficial both for the community and for myself - because I will most likely forget everything I learned.

The Problem - Overriding Joomla Module Styling

If you have looked at building your own Joomla templates, you may have tripped over this already. Overriding the HTML template for a module (such as mod_newsflash) only replaces the list part of the module. It doesn't replace the "container" - the heading, and surrounding HTML elements.
It turns out the containing HTML, or "wrapper" is called Chrome in Joomla terms, and can be overridden too - although in a different way than normal template overrides.

A Worked Example

First, we will imagine we have our own Joomla template, and that it has a position within it called "latest-news" - the code within the template may look like this:

Normally, we would just make a folder within our template, and make a modified version of the existing component view file. The core file would come from here...

/components/mod_newsflash/tmpl/_item.php

... and put the file (with your changes) in ...

/templates/[template_name]/html/mod_newsflash/_item.php

As discussed earlier though, this only changes the internal contents of the component - not it's title, or surrounding HTML elements.
To do that, we have to make or modify the "modules.php" file in the template html subdirectory. The "modules" file sets out the Chrome used by Joomla to wrap components with. All will become obvious once you see the new function we will write within the modules file.
We make the following text file (if it doesn't already exist)...

/templates/[template_name]/html/modules.php

... and within it, we write the following...

function modChrome_foo($module, &$params, &$attribs)
{
if (!empty ($module->content)) : ?>

showtitle) : ?>
title; ?>
content; ?>
}
?>

The trick here is the name of the function. Notice the "foo" bit? If you change the position in your original template file to have the style "foo" instead of "xhtml" as follows:

... and you suddenly have complete control over the wrapping of modules (through the modules.php file), as well as their content (through the template overrides).

---

All kudos are going to Jonathan who published the tip on his blog at  http://www.beckettwebdesign.com

Read full story

Register Globals-Joom la Tips

Many of you probably had seen already the red warning in Joomla's admin interface, that you need to have the Register Globals set to "on", otherwise your site is exposed to security treats.
And also many of you haven't a clue how to do it...
So, let's see what an average webmaster can do about this problem.
Joomla! has always featured the ability to emulate PHP's register globals setting. However, controlling this feature has always been one of the more difficult aspects of configuring your Joomla! installation because it required manually editing a core file.
Namely you needed to edit the globals.php file from the Joomla root and change the line:

define( 'RG_EMULATION', 0 );

to

define( 'RG_EMULATION', 1 );

For Joomla! 1.0.13, all that is history. Joomla!'s register globals emulating controls have been moved into the Global Configuration settings to allow for fast and easy control over this feature. The advantages of this change are two-fold: 1) it will be easier to secure your Joomla! powered website and 2) disabling register globals emulation will help you identify some extensions that will not work in Joomla! 1.5.
But even if you're running earlier versions of Joomla you can avoid to edit a core Joomla file - which is not recommended anyway.
One of the simplest ways to do it is to set server side the corresponding variable to the needed value. This can be set by your webserver's administrator globally or you can set it locally, using local php.ini or .htaccess files, if your server allows that.
The needed line in the php.ini or .htacces file is simple, just insert:

php_flag magic_quotes_gpc on

in a standalone line.
If you're using Plesk, howewer, this may not work. Basically, if you are on a shared server that uses plesk, you will not be able to access the php.ini and generally you're not allowed to use local php.ini files. And, on Plesk by default, magic_quotes_gpc is set to off.
To set magic_quotes_gpc, you will have to edit your vhost.conf. The vhost.conf file will need to be located in the conf directory on your site's ftp. Inside the file you will need the following...

 php_admin_flag magic_quotes_gpc on
 
 

Don't forget to change the path in the Directory directive to your server's actual path to the web directory.
Once this has been placed into the conf directory, run from the command line...

# /usr/local/psa/admin/bin/websrvmng -a -v 
 

Once run, the last thing you will need to do is restart apache.

# service httpd restart

On other servers there may be easier ways to do it. If you're on one of Dreamhost's servers, for example, you have in the hosting control panel the chance to do some of needed settings. If your domain is running PHP4, that has register_globals set "on" by default, and you don't need to do anything.
If from some reason you need to, you can change your domain to use PHP5, which has register_globals turned off. To do this, go to the Hosting Control Panel -> Domains -> Manage Domain screen and click the "edit" link under the "Web Hosting" column. Modify the choice of PHP to use for your domain in the provided "pull down" selector and save the changes. After a few minutes, when the change is complete, you will be running PHP5 with register_globals "off". And you need to fix the situation using some of the above solutions.

Read full story

How To Track Your Advertising Campaigns

Often we spend good amount of money on advertising but fail to convert the incoming traffic. One of the reasons is almost nil meaningful traffic analysis that is so vital for any successful advertising campaign. With the advent of new and improved web analytics services there are plenty of options at our disposal, provided we identify and utilize them in a correct way. Let's see how to track and improve our advertising campaigns that can give us maximum returns in limited budgets.

Divide - Segregate - Segment

Let's start with old principle of divide and rule. Whether you are tracking text links in email newsletters, regular text link ads, graphic banners ads or video/flash ads, the basic principle to track these ads is to separate each group of ads/campaigns and then associating identifiable and unique metadata to them. Let's assume you are planning to advertise about your new twitter marketing ebook. Let's further assume that you are going to use multiple ad formats with different landing pages for selective ad formats. To make it simple, lets say you have four text link ads and four banner ads (each with unique creative and different size).

At macro level, these ads can be divided into two groups. Each group can be further divided into four sub-groups each one containing ads of different size and different anchor/description text. Once you have completed the classification, you are ready to move on to next level. You can use Google Analytics to track your advertising campaigns. It's a powerful web analytics service that is often undermined by large number of users. It's free, simple to use and provides plethora of options to monitor, analyze and improve your web traffic.

Tag it! - Make Intelligent URL's

As I mentioned earlier, associating metadata with your ad links can help you track and analyze your ad campaigns in an effective manner. This technique is called - URL Tagging. Major PPC advertising networks like Google Adwords inherently supports URL tagging for intense campaign tracking and analysis. For other ad types (direct ads, promotional links), you can use the services of Google Analytics URL Builder to tag your ad links. Tagging a link involves associating variables with it starting with (? question mark) and each variable separated by (& ampersand) mark. For example,

http://www.xyz.com/landingpage.php?variable_1=value&varialble_2=value

Google's URL Builder uses 5 variables for tagging links out of which 3 are mandatory while other 2 are optional.

1. utm_source - As the name implies, this variable identifies the source of ad where it is going to appear. This can be an email newsletter, a feed, a page, a search engine or any other similar source. In simple words, it denotes the referrer. For example: (twitter_newsletter_v1,google,bing)

2. utm_medium - Again the name says it all. The ad medium is identified through this variable. For example: (email,banner,cpcflash,video)

3. utm_term - (optional) Generally, it is used by auto-tagging feature of Google Adwords to assist in better targeting of paid ads. Use this variable to identify paid keywords.

4. utm_content - (optional) Another non-mandatory option used to specify the type of ad associated with any ad link. If you want to differentiate ads on the basis of their types, you can use this variable to classify them. For example: (textlink,bannerlink)

5. utm_campaign - Identifies the campaign name. Use this variable to differentiate between multiple promotional campaigns running simultaneously. For example: (twiiter_ebook, seo_320pack)

So let's get started with tagging of ad links of our fictitious twitter marketing ebook ad campaign.

In first example, we have tagged a text link ad that will appear only on home page of site x. This ad will be served on cpc basis and is associated with twitter ebook promotional campaign.

http://www.xyz.com/ebook.php?utm_source=sitex_home_page&utm_medium=cpc&utm_content=toc_text_link&utm_campaign=twitter_ebook_promo

In second example, we have tagged a URL associated with a banner ad (of size 468x60) that will be served on CPM basis on twitter ebook review page of site y. This ad is also associated with twitter ebook promotional campaign.

http://www.xyz.com/ebook.php?utm_source=sitey_review_page&utm_medium=banner_cpm&utm_content=toc_banner_link_468_60&utm_campaign=twitter_ebook_promo

Once you have tagged all the links, you can see the reports in your Google Analytics account via 'Traffic Sources -> Campaigns'. URL tagging not only allows you to track visits from a source, but you can further break it down to specific page and specific placement within that page. Combined with the power of goals, you can take it to the next level to get the actual performance of your advertising campaigns.

Analyze and Improve

Every successful advertising campaign is supported by analysis of ad performance data and doing improvisations wherever required. Here are some of the common methodologies that are implemented to improve the advertising campaigns.

Identifying performing creatives - Every creative is different and yield different results irrespective of its placement on the web page. Through Google Analytics campaign reports you can easily identify high-performing creatives. Design similar creatives or replace the non-performers with the other ones. Tip: Even if all your creatives are performing well, consider replacing them with the new ones after some time to help reduce ad-blindness.

Identifying best placements - It's almost similar to finding the best combination of your Adsense ads that gives you the best performance. Again, GA campaign reports can easily help you identify best performing spots within a single page.

Identifying performing landing pages - Some landing pages are like honey pots that inherently have very high conversion rates. Identify these high performing landing pages through GA campaign reports and make necessary changes to your ad links to divert the traffic to these pages. Alternatively, you can redesign the non-performing landing pages leaving the ad links intact without any changes.

Over To You

I would like to know your experience about tracking your advertising campaigns. What other techniques and methodologies you adopt to track your ad campaigns?

Read full story

How To Secure Your Wordpress Installation

Security has always been a major issue on self-hosted Wordpress blogs. Hackers look for vulnerable web sites whose security can easily be breached to exercise their evil intentions. With every new version, the core engine of Wordpress is getting more and more secure. Still some extra steps are needed to harden its security to the maximum. There's no silver bullet that can guarantee complete protection from hackers, but we can make sure they get a tough time while attempting any intrusion.

There are three sub-systems that needs your attention to secure it from potential threats viz., blogging CMS, back end database and web server. Normally we have complete control on blogging CMS and database, while web server administration is normally maintained by hosting service provider unless you own a VPS (virtual private server) or have your own dedicated server. Remember, your Wordpress installation is only as secure as your web server. If there is any weak link in the server, all the security measures discussed below will go in vain.

Securing Wordpress Directory Tree

The basic strategy to make your installation secure is to restrict public access to sensitive files and directories. Whenever any CMS is installed, the directory tree is assigned certain access permissions that may vary according to the their importance, functionality and usage to help protect them from unauthorized access. Following is the step-by-step method to protect your Wordpress files and directories.

Assigning directory permissions - Start with assigning correct permissions to your Wordpress installation tree. Here are some of the basic rules to follow.

1. No file or directory should have a permission of 777.
2. No file should have a permission of 666, except those theme files that are edited via built-in theme editor through Wordpress dashboard.
3. Ideally, all files should have permission of 644. Similarly, all directories should have permission of 755.
4. Some servers require permission of 'wp-content/uploads' folder to be 777.

Disabling public browsing of directory tree - Add the following code to .htaccess file to prevent any kind of direct browsing activity. This ensures no one can view the contents of directory by simply typing directory paths in their browsers.

Options All -Indexes

Although the same effect can be achieved by placing blank index.html files in every directory, but it is the most inefficient and least preferred method to disable directory browsing.

Securing wp-admin, wp-content, wp-includes and wp-config directories - Apart from disabling direct browsing of directory tree, some extra steps should be taken to restrict access to important directories.

Add the following lines to .htaccess to protect wp-config.php from unauthorized access. As the name implies, this file contains important Wordpress configuration settings needed to connect to your blog's database. It includes MySQL username and password.

<files wp-config.php>
Order deny,allow
deny from all
files>

Adding following lines to .htaccess will protect wp-admin.php from unauthorized access. This will ensure your admin dashboard is protected from intruders.

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName "Access Control"
AuthType Basic
<LIMIT GET>
order deny,allow
deny from all
allow from xx.xx.xx.xx
allow from xx.xx.xx.xx
LIMIT>

Here xx.xx.xx.xx are the static IP addresses used by you or other administrators/contributors of the blog. In case you get a dynamic IP address each time you connect to Internet, this method will not work at all. In that case, you can use AskApache Password Protect plugin to protect wp-admin, wp-includes and wp-content without any need to edit .htaccess yourself. This excellent plugin acts as a firewall and adds an extra layer of security protecting your sensitive files from automated spam bots and hackers.

Securing Database

Hackers often target Wordpress database to insert countless spam links within the posts. Whenever you install Wordpress, by default every table gets a prefix of wp_ regardless of the table type. Intruders use this information to launch certain type of SQL injection attacks on the database. For better security, you must change this default prefix to something unpredictable. There are 3 methods to change this prefix.
Changing table prefix at the time of installation- This is one of the easiest method to provide a random table prefix to your Wordpress database tables.

At the time of installation, you get a chance to edit the table prefix. Choose a random and unpredictable table prefix that cannot be easily guessed.

Changing table prefix manually - This method can be painful for technically challenged. It requires editing of more than one .php files along with execution of multiple SQL queries. However, if you are comfortable with basic blog maintenance (technical) skills, this excellent tutorial shows you how to change table prefix in Wordpress through direct file editing.

Changing table prefix via plugin - Fortunately, Wordpress has large repository of plugins available for almost every requirement. You can also use WordPress Table Prefix Rename Plugin to achieve the same effect.

Regular database backups - Backups are lifesavers in event of any catastrophe that may bring down your entire site. You can use WP-DB-Backup plugin to backup core as well as additional (plugin & 3rd party script tables) tables of your blog's database. Make the habit of taking backups at least once a week followed by saving of more than one copy in two different locations.

Securing User ID's & Login Procedure

Almost every CMS has built-in user access control mechanism that defines a hierarchy of user-types with each type having different set of privileges. Wordpress is no different and supports pretty good user access control mechanism. Hackers target this system to gain complete control of the CMS leaving no chance to recover from the disaster. Here are some methods and safe practices that can help you in strengthening Wordpress access control mechanism.

Delete default administrator account - As soon as Wordpress installation is completed, we get a default administrator account with user id admin and random system generated password. DO NOT use this account for maintaining your blog. Create a second account with administrative privilege and delete the default admin account.

Strengthen login procedure - With the help of these 2 plugins you can make your Wordpress logins more secure and safe. Chap Secure Login encrypts your password to prevent anyone stealing it while it's in transit to the web server. Login LockDown is an excellent plugin that helps prevent brute force attack to guess your passwords. It disables the login function after specified number of failed login attempts within a given time frame blocking an IP range for specified period of time.

Fine-tuning user access privileges - For multi-author Wordpress blogs,
Role Manager plugin is a boon. If you want to exercise greater control over user access permissions, this plugin can help you assign specific rights at granular level.

Role manager can create custom roles with tailor made access privileges that can be assigned to any Wordpress user on your blog. You can even change and tweak the default roles provided by Wordpress, although it is not recommended and should be avoided.

Miscellaneous Steps To Harden The Security

Hide Wordpress version - Older versions of Wordpress have several loopholes that can be easily breached by seasoned hackers. It is always advised to hide your Wordpress version to mask any vulnerabilities (if any) that may exist in the release you are using. The best way to hide this information is placing the following code in function.php file of your theme.

php remove_action('wp_head', 'wp_generator'); ?>

This ensures removal of Wordpress version information while generating html files for client side.

Keep search engines away from Wordpress folders - You'll never want your blog's entire directory tree to be indexed by search engines. This may expose the contents of sensitive directories making it easy for hackers to analyze and find the potential loopholes. Add the following line to robots.txt file, which is located in the root directory of your blog.

Disallow: /wp-*

Adding this line will ensure none of the search engine bots are allowed to index the directory content.

General Safety Precautions

1. Create strong passwords and change them frequently.
2. Keep your plugins and Wordpress release updated.
3. Regularly backup files and database.
4. Create a disaster recovery plan and simulate it on a test blog.
5. Avoid using plugins from unknown sources (may include malicious code).
6. Use WP Security Scan plugin to find any vulnerabilities in your Wordpress installation.
7. If possible, avoid remote publishing via 3rd party publishing tools.
8. Use SSH or SFTP for secure editing of files and directories.

Read full story

30+ Blogger Widgets And Plugins

Blogger platform has undergone major improvements in last two years. Not only the blogger development team has added several new features to the platform,, but countless new blogger templates are being developed around the globe. Here are some best widgets and plugins for blogger powered blog that can spice up your blog for better reader experience.

1. Top Commentators Widget by BloggerPlugins - This excellent plugin has two versions. One for blogs having small number of comments and the second variant for blogs receiving lots of comments.

2. Translation Widget by BloggerPlugins - This one click install widget add multiple language translation support to your blogger blog.

3. Recent Post Widget by BloggerPlugins - This is highly customizable widget. You can set number of posts to display, post summary and it's length.

4. Recent Comments Widget by BloggerPlugins - A highly customizable widget. You can set the number of comments to display, author name, date and size of comment. You can also use CSS to gel it with your theme.

5. Label Cloud Plugin by phydeaux3 - This is one of the most popular label cloud generation plugin for blogger. You can customize various options after installing this plugin.

6. Archive Calendar Widget by PurpleMoggy - Very impressive archive calendar widget with customizable options.

7. Archive Calendar Widget by phydeaux3 - Another very popular archive calendar widget. Highly customizable for better browsing experience for the readers.

8. Recent Posts Widget by Feed2JS - This excellent plugin makes plugin installation and customization very easy. Just fill in the form and click the button to generate widget code.

9. Recent Comments Widgets by Blogger-Templates - Just fill in the options in the form and one click widget code generation. Excellent plugin which is highly customizable.

10. Picasa Web Albums Slideshow Widget by Blogger Templates Designs - A unique plugin to show photo slideshow from any picasa account. Ideal for personal blogs, photo blogs and web design blogs.

11. Search Form Widget by Blogger Templates Designs - If you want to add site search box in your blog's sidebar, install this plugin.

12. Google Talk Widget by Blogger Templates Designs - This plugin adds the Google Talk client to your blog so that your readers can directly converse with you.

13. Recent Comments Widget by Blogger Templates Designs - Yet another recent comments widget with customizable options and one-click install.

14. Sudoku Game Widget by Blogger Templates Designs - Want to add some interesting puzzle games for your visitors? Then install this plugin to integrate sudoku puzzle game in your blogger blog.

15. Google Translate Mini-Flags Widget by MadToMatoe - Very useful translation plugin powered by 'Google Translate'. One click install with multiple language translation facility.

16. Recent Comments Widgets by MadToMatoe - One more recent comments widget for blogger blogs. Again you can customize the number of recent comments to be displayed.

17. Reactions Mini-Poll Widget by ThemeLib - Want to host a poll on your blogger blog? Install this plugin and get customizable polls for your readers.

18. Alexa Traffic Widget by TechKnowl - Display your Alexa stats with this customizable widget.

19. Snow Flakes Widget by TechKnowl - Add a stunning snowfall effect in your blogger template in the festive season.

20. Popular Posts Widget by TechKnowl - A very simple popular posts plugin using Yahoo pipes to filter out popular posts on your blog.

21. Flash MP3 Player Widget by TechKnowl - This cool plugin allows you to embed flash mp3 player in your blogger blog. The player is very light with custom options.

22. Rating Widget by Outbrain - If you want to integrate rating system with your blogger posts, then this excellent plugin is the best choice. It has rating system plus related posts integration in same widget.

23. Multi-tab TOC Widget by Beautiful Beta - If you want to display multi-tab table of contents section in your blogger blog, then install this widget. Very popular among blogger users.

24. Tab View Widget by Hoctro - The coolest plugin showing tabbed posts with animated post excerpts. A must for your blog's sidebar.

25. Random/Rotating Banner Widget by FreeYaSoul - Very useful widget for displaying rotating banners in your blog's header. You can customize and can choose any number of headers.

26. Social Bookmarking Widget by Lasvak - This is perhaps the most easily installable bookmarking widget for blogger. Just copy and paste a single line of code in your blogger template and your bookmarking icons are ready.

27. Paypal Donation Widgets by Etienne - Integrate different types of paypal donation widget in your blogger blog with ease.

28. Podcating Plugin by Talkr - If you want to integrate podcasts to your blog, register for this service and get free podcasting plugin for your blogger blog.

29. What's Next? Section Widget by eblogtemplates - Integrate a Wordpress style 'What's Next' section below blogger posts with this excellent widget.

30. Twitter Profile Widget by BloggerBuster - Add your twitter profile and twitter updates with this useful plugin developed by Amanda Fazani.

31. Bookmarking Widget by SocioFluid - One of the best social bookmarking plugin for blogger. Big animated icons with one click installation.

Read full story