Blogging

• The Five Worst Ways to Title a Blog Post
• Is Creative Commons Right for Your Blog?
• Should Bloggers be involved in Unethical Marketing?
• How to Craft the Perfect “About” Page for Your Blog

WordPress

• The TimThumb Saga
• TimThumb Security Flaw, Akismet-HubSpot integration & Varnish+Apache+WordPress
• WordPress Shortcode: Display a Thumbnail of Any Website
• How to Customize the Display of WordPress Archives in Your Sidebar

SEO

• How to Pick a Domain Name for Your Local Business
• SEO Metrics You Must Track and Report
• 4 Tips for Hiring an SEO Firm
• Do You Know These SEO Social Secrets?

Social Media

• Social Media and Search Engine Optimization: Why They Work Together
• Social Media Pitfalls
• The Social Media Map
• Please Tell Me Why I Should Like, Follow, +1 You?

Technology

• Computers Could Grade Essay Tests Better Than Profs
• Technology Blamed For Helping UK Rioters
• DHS Creating Database of Secret Watchlists
• The London Riots and Facial Recognition Technology

Gadgets

• Sony ESSP-2000 Battery and UPS
• Tokyoflash’s Kisai 3D Unlimited Watch
• Panasonic DY-PS10 Pocket Server
• Lenovo ThinkCentre M71z All-In-One Desktop

Pinoy Blogs

• NFC Demo with the Nokia C7 at the Jump Store in Megamall
• TDK IE-500 In-Ear Headphones Review
• Samsung Galaxy Tab 10.1 Philippines : Price, Specs, Hands-on Video, Quick Review
• Twitter Adds New Reply Feature

JaypeeOnline Weekly Recap

• HowTo: Enable the W3TC Google Page Speed Report WordPress Dashboard Widget
• BonPress – Free Tumblr-Like WordPress Theme
• State of the Internet 2011 [Infographic]

If you have any questions, comments, suggestions or would want to share your article or any interesting story that you found in the Internet and have it featured in the next Weekend Roundup, feel free to leave a comment or send me a message via the contact page.

A zero day vulnerability has been recently found on TimThumb, a popular image resizing utility widely used in a lot of WordPress themes. This issue was first discovered and reported by Mark Maunder after his blog got hacked via the timthumb.php file/script.

The TimThumb zero day vulnerability allows malicious users, hackers and other third parties to upload and run PHP code in the timthumb cache directory. When the uploaded PHP code is run and executed, the attacker can do whatever they want with the affected site or blog.

Recommended measures:

If You Use TimThumb
If your current WordPress theme is using timthumb.php, make sure that you update to the latest version of TimThumb and to reglularly check on the official TimThumb site for updates and announcements.

Aside from updating the TimThumb file there’s another thing you need to do. Open up the timthumb.php or thumb.php file with a text editor and look for this line ALLOW_EXTERNAL and make sure that the value is set to FALSE.

define ('ALLOW_EXTERNAL', FALSE);

Once ALLOW_EXTERNAL is set to FALSE, next thing to do is remove the domains inside the $allowedSites array to ensure that remote file downloading is disabled:

Before

$allowedSites = array (
	'flickr.com',
	'picasa.com',
	'img.youtube.com',
);

After

$allowedSites = array ();

If You Do Not Use TimThumb
If you don’t use or need timthumb.php but have other WordPress themes stored in your wp-content/themes folder that uses timthumb.php, it is recommended that the timthumb.php or thumb.php file or even the entire theme or plugin folder be deleted/removed from your web server.

The theme I’m using here on JaypeeOnline – FreshNews by WooThemes uses TimThumb. After reading about this vulnerability, I immediately removed the thumb.php file and replaced it with an updated one. I was worried that I was using a very old version of TimThumb and that upgrading might mess up my blog but after the upgrade, I checked all the thumbnails and everything seems to be working fine. I also removed everything related to the old version of TimThumb and cleared the the cache.

If you want to know more about the TimThumb zero day vulnerability, how it was discovered and other additional info, check out Mark Maunder’s blog post.

These days, its not uncommon to find free premium quality WordPress themes. A lot of WordPress theme authors, design websites and even Premium theme sellers are now creating and releasing freemium WordPress themes and sharing it with the WordPress community. One good example of such a theme is the Milano theme brought to us by Web2Feel. The Milano theme is an advance magazine style, 2-columned theme that has the qualities of a premium theme and lots of built-in features.

Here’s a short description for the Milano theme.

This is an elegant theme designed with attractive color combination for bloggers who look to make money online via ads. This theme is suitable for any niche. The theme layout is stylish and dynamic contents modules like, image slider, tabbed content area are built into it.

List of Features:

• Premium theme layout
• Multi-level dropdown javascript navigation menu
• Featured sliding posts
• Site wide customizable 125 x 125 custom banner ads
• Adsense enabled
• Tabbed content area * Featured Video * Recent posts * Popular Posts
• Two widgetized sidebars
• Customizable welcome message
• Page navigation enabled
• WP 2.7 ready, threaded comments
• Theme support
• Custom theme option page in the admin panel

Screenshot:

My Take:
Like the Monkeypr theme that I reviewed recently, the Milano is hands down a very pretty and well designed WordPress theme and could easily be marketed as a premium theme. It has a lot of features and built-in functions that most free WordPress themes don’t have and can be found only on premium themes.

The feature that stands out the most from the Milano theme is the featured post slideshow. This feature not only enables the author a cool and attractive way to promote the featured posts but it also provides the user easy access to check out the blog’s featured posts. You can configure the slider, video, Adsense and banner ads from within the WP dashboard via the theme options page. It also has features a javascript-powered multi-level drop down navigation menu that is useful when your blog has a lot of categories and sub-categories.

The Milano theme features page navigation, post excerpts and popular posts and in order for it to work, you’ll have to install 3 plugins – WP Page Navi, Popularity Contest and Limit Post. The theme author has included those 3 plugins into the theme download zip file. This theme also uses the TimThumb script to generate the post thumbnails.

So far, I haven’t found anything negative to say about the Milano theme. Maybe the only things that can be an issue for some users are the color scheme and those required plugins, but those can be easily fixed with a few minor tweaks. Other than that, the Milano theme is an awesome theme. It’s very customizable, easy to install, has lots of features and can be used by any blogger and used for any type of blog niche – personal, technology, entertainment, sports, movie reviews, gadgets, etc.

Great job by the theme designer and hope they’d release more free WordPress themes like these in the near future. Btw, the theme author also provided the PSD file for the header logo, so users can customize it to their own preference.

For more detailed installation instructions, check out the Milano Theme Setup Guide.

Preview or Download the Milano WordPress theme.

ColdStone is a 2-column, widget-ready and feature-packed premium WordPress Theme created by Nick Roach of Elegant Themes.

Coldstone offers a unique blend of grungy and professional elements. The theme comes with three unique homepage formats, including Business Style, Blog Style, and Magazine Style, and a robust options menu that makes managing ColdStone fast and easy.

Screenshots:

Homepage

Post page

Features:

• Widget ready sidebars
• Theme Option Pages
• Custom thumbnail images
• PSD files
• Valid XHTML + CSS
• Smooth tabless design
• IE7 + IE6, Firefox, Opera, Netscape, Safari compatible
• WordPress 2.7 compatible
• Three Unique Post Formats
• Threaded Comments
• Featured Articles
• Gravatar ready
• Firefox compatible
• Advertisement Ready

My Take:
The key features of the ColdStone theme are the three unique post layouts, featured articles, advertising management, automated thumbnail resizing and in-depth theme options. ColdStone has three styles of layouts that you can choose from to suit your blog’s needs: The default or Business style (has a unique sidebar), Blog style which displays full-length posts and the Magazine style that displays the main sidebar on the homepage and has additional post and thumbnail options. With this theme, you can also feature your favorite posts on the homepage powered by a javascript scroller. For those of you who run 125×125 banner ads, you won’t need to install or purchase a third-party program or WordPress plugin to manage your ads because ColdStone has a built-in advertising management system. With the ColdStone theme, you only need one image for your posts and you don’t have to manually create thumbnails for your images because it uses the TimThumb script to automatically resize thumbnail images. This is the same script that my current theme is using. Since ColdStone is a premium theme, I wasn’t able to see and check the theme options.

ColdStone is widget-ready which is a must-have feature for widget lovers and it is also Gravatar ready so you won’t have to worry about installing a WordPress plugin or customizing/editing the theme’s comments.php file to enable gravatars. As an extra bonus, the theme author has included the PSD files for this theme for customization purposes. Although I’m not 100% sure, I’m pretty positive that it includes a PSD file for the header image so you can customize it and change it to your blog’s name.

One important thing to note is that the ColdStone theme is already WordPress 2.7 compatible so you won’t have to bother editing your theme files to work with the latest version of WordPress. Since it is compatible with WordPress 2.7, it also means that you can have threaded comments on your blog.

I’ve always admired the WordPress themes created by Nick Roach over at Elegant Themes but if you ask me based on what I’ve seen and tried from the demo, ColdStone is by far the best work done by Nick. I love every element of this theme from the color scheme to the custom graphics (especially the background image) to the overall layout and design. The ColdStone theme is very neat and professional looking. Honestly, I would’ve purchased this theme for JaypeeOnline if I haven’t just recently purchased one.

For those of you who arent’ familiar with Elegant Themes, for a small fee of $19.95/year you’ll have access to their entire collection of premium WordPress themes including the ColdStone theme and support if you need any help with the themes you purchased.

Preview or Purchase the ColdStone premium WordPress Theme

DISCLOSURE: JaypeeOnline is an affiliate of Elegant Themes.