Recently, I came across discussions on Twitter, and a blog post about ‘hidden links’ in my WP-Cumulus WordPress plugin. Quite frankly, I’m a little embarrassed by this, and I’d like to explain how the situation came to be, and what I plan to change in upcoming versions.

History

When I did the first couple of versions of WP-Cumulus, it was not hosted on wordpress.org. All there was in terms of user support was the comments section of a blog post on this blog. To help people troubleshoot flash plugin trouble, I linked to that post in the alternative or “no flash” content. This content is shown only to user without (the right version of) Flash. It is very common among Flash developers to link ‘home’ this way. I was aware this would also be shown to search engines, but at the time there were only a couple of users. My reasoning back then was that providing a helpful message was important enough to warrant putting the link there.

Whoa, millions of incoming links…

Then, Cumulus started catching on. I moved it to wordpress.org, where it made the top 10 most popular plugins a few times. People were starting to port the plugin to other platforms, and I started getting tons of support requests. Some days, just answering these would take hours. I was overwhelmed. Around the same time, I started noticing an increase of traffic on my blog. At first I thought it was because people were googling for the plugin, but it soon became apparent that there was more going on.

As an unexpected side-effect of the ‘no flash’ link, my blog now had thousands of incoming links, causing it to rank well in Google. Because I sometimes write about things like hosting, advertisers were starting to show interest, and I have to admit I jumped at the opportunity. As time went by, it became increasingly ‘difficult’ to remove the links. Here I was, making a little extra money because of a link I forgot to remove somewhere along the way. But even so, I no longer feel comfortable with the current situation, and have been planning to remedy it for a while.

Future versions

As you may have read on this blog, I’ve been trying to get more people involved in the project. It needs a better programmer than I am to keep it up to date. Unfortunately, this has not proven very easy. As a result, WP-Cumulus 2.0 has been in development for over a year, and one of the things it aims to fix is this ‘hidden links’ situation. I’ve decided that any link in the alternative content should be optional, and disabled by default. And it should probably point to the wordpress.org page instead of this blog. By default, it makes sense to show the regular (html) tag cloud to users without Flash. Version 2.0 will probably do it that way.

I’ll be working on Cumulus 2.0 this week (with one of the best software developers I know, whoohoo!), and I hope to have a rough version some time this month. It’ll put you in control of what is shown to users, search engines and everthing else. As it should have been all along.

Related posts:

1. Finally, a new WP-Cumulus update It’s been a while since I released the last version...
2. WordPress plugin: WP-Cumulus Flash based tag cloud I love tags. I think it’s a brilliant idea to...
3. WP-Cumulus updated to address yet another security issue A few weeks ago I rushed out an update to...

I’ve been promising a new version of WP-Cumulus for a long time. I’ve tried working with more experienced PHP developers, but it’s been hard to find a really good one who’s able to devote time to the project. I still think a plugin like this should be a team effort, but for now I’m going to kick things back into motion again myself.

What’s ready at this point is a much cleaner rewrite of the plugin files, with the display logic in a neat little class that port authors will hopefully be able to reuse. I’ve also got a Flash movie that uses a user-defined system font, as a result is much smaller, and supports unicode tags.

Burning bridges

I’ve decided to bump the required WordPress version to 2.8 or 2.9. There’s so much code in the current version that’s there only to support older versions and adds nothing. Running older WP versions is a bad idea anyway, and I want to use the new widget and option page APIs.

Another thing I consider a bad idea in hindsight is the “compatibility mode”. It way helpful for debugging WP-Cumulus on blogs with poor markup, but I’m going to trust that SWFObject 2.2 does a better job and once again skip all the extra code required.

Lastly, to support unicode, your blog’s visitors will need Flash Player 10.

Security

Now that I have the main two parts (plugin and Flash movie), I need to hook the two up to each other. The basic idea behind how WP-Cumulus works has always been that WordPress supplied the tags through its wp_tag_cloud function. It was easy and convenient to simply pass that function’s output through to the movie using the “flashvars” interface.

However, as some experts have found, the technique of passing URLs through flashvars, while extremely common among Flash programmers, poses a security risk. Versions 1.22 and 1.23 pathed the biggest holes, but there’s still a very eloborate social XSS that could pose a risk to Cumulus users. Another issue is that some themes alter the output of wp_tag_cloud through an API hook. This is fine for the html tag cloud, but for WP-Cumulus it means my Flash movie doesn’t get the data as it expects it.

This means I’ll have to rethink the flow of data, and as a result, the movie’s technical interface is going to be radically different. I’m thinking along the lines of having the movie request its content from a fixed, relative url, and using JSON instead of XML. I know this also affects the authors of ports to other systems, but my primary concern is the WordPress community.

ASAP

There are lots of things that still need to be done. Like i18n, the data interface and better alternate (“no-flash”) content. I’m really committed to getting a completely rewritten version of the plugin out there as soon as possible, but I also want to make sure it’s stable. Think weeks, at least. There’s not a single line of code in the new version that I copied from 1.23, so it’ll need extensive testing.

Related posts:

1. Finally, a new WP-Cumulus update It’s been a while since I released the last version...
2. WP Cumulus released! WP-Cumulus has moved to WordPress.org. The information on this page...
3. WP-Cumulus updated to address yet another security issue A few weeks ago I rushed out an update to...

I hate having to do this, but I’m going to be closing the comments on most of the WP-Cumulus related posts on this blog. Because some have several hundred comments, they’ve become impossible to read and I find that the same questions keep getting asked over and over again. I’ve tried to patiently answer all of them, but I’m no longer able to keep up. Blog comments just aren’t a very good support mechanism.

If your question is about WP-Cumulus, the original WordPress plugin, not one of its ports or variations, please post it in the WordPress forums. This allows others to find the answers, and chances are your question has been discussed already. The forums are an invaluable resource, and offer a much better platform for WP-Cumulus support. If you add the “wp-cumulus” tag to your thread, I’ll almost certainly see it.

I’ll also try to update the FAQ more often. It’s a little out of date, but definitely still a good place to start. Oh, and for more info, see my support page.

Related posts:

1. “Get Recent Comments” makes your comments look so much better Get Recent Comments is probably the WordPress plugin that I’ve...
2. Assorted WP-Cumulus news There’s been a lot going on in what is becoming...
3. WP-Cumulus is now open source This is a first for me. Even though I’ve always...

WP-Cumulus has been ported to quite a few other platforms. I keep bumping into it, often on sites not running WordPress. I’ve given up trying to post about all of these spin-off projects, but this one feels a little special. Gautam Gupta has created a bbPress version. As far as I’m aware this is the first port to another Automattic project (I’m still waiting for a wordpress.com ‘port’, come on Matt ).

So, if you want your forum tags to fly like your blog tags, head over to http://bbpress.org/plugins/topic/bb-cumulus/ for the download.

Related posts:

1. Assorted WP-Cumulus news There’s been a lot going on in what is becoming...
2. WordPress plugin: WP-Cumulus Flash based tag cloud I love tags. I think it’s a brilliant idea to...
3. WP-Cumulus 1.15: Color! Ever since I released the first version of WP-Cumulus, people...

The one feature I’ve always wanted to add to WP-Cumulus is true unicode support. Flash player 9 made this impossible because it needed to have the font characters embedded into the movie, and unicode fonts are simply too big for that. But with Flash 10, Adobe has introduced new ways of handling text, and those now allow for non-embedded text to be animated quite smoothly. There’s also no longer any need to specify an exact font name, you can simply tell the player to get a sans-serif font. Flash player 10 is on over 93% of computers now, so it starts to make sense to use it to finally add this long-awaited feature to WP-Cumulus.

I’ve created a test movie (above) that uses these new features, and I’m anxious to find out if it works for you, especially if you’re in Asia, Russia or anywhere else with a non-Latin character set.

What are you seeing?

• Are you seeing all 45 tags (approximately), in many languages?
• Are you seeing your (non-Latin) language?
• Any other issues?
• Do you want me to add your language to the test? Post the language name here.

Please leave a comment below and tell me if the movie works as it should. Thanks!

Related posts:

1. About WP-Cumulus in Chinese I’ve been getting questions about a possible Chinese version of...
2. How to add more characters to WP-Cumulus One of the major shortcomings of Flash (imho) is the...
3. WP-Cumulus 2.0 is finally in development (again) I’ve been promising a new version of WP-Cumulus for a...

A few weeks ago I rushed out an update to fix a potentially dangerous Cross-Site Scripting (XSS) vulnerability in WP-Cumulus. With the PHP part of the plugin shielded from ‘outside use’, I was hoping no more issues would pop up. Still, I’m glad MustLive alerted me to another issue that uses the Flash movie itself. The exploit worked by calling the SWF file directly, and supplying link with javascript. I’m not quite sure how dangerous this is, but I’ve modified the movie so it only executes regular links.

Please update your copy of WP-Cumulus to 1.23 asap. For most users it should only take two clicks.

The should not affect how WP-Cumulus works on WordPress blogs. But there have been a number of ports and other projects that use the Flash movie. I urge the authors of those projects to examine the new Flash movie, and see if it still works in/with their product. The exploit is not unique to WordPress, and they may need to modify the security check to fit their project.

Related posts:

1. WP-Cumulus 1.22 fixes a security hole, please upgrade! Yesterday, Thomas Scholz alerted me to a security weakness in...
2. Finally, a new WP-Cumulus update It’s been a while since I released the last version...
3. WP-Cumulus 2.0 is finally in development (again) I’ve been promising a new version of WP-Cumulus for a...

Over the last few months, I’ve not been able to dedicate as much time to the WP-Cumulus project as I’d hoped to. Freelance work has been keeping me pretty busy, and I’ve had to deal with acute issues rather than be able to focus on new features. That’s why I decided to look for help. Just around that time, Luke Morton launched a spin-off version of the plugin that implemented something I’d been meaning to work on too. I contacted Luke and I’m very happy he’s agreed to help develop WP-Cumulus from now on.

Some of the things we’ll be working on are pretty major. We’ll finally move to SWFObject 2.x, look into internationalization (both for the plugin and the Flash movie) and make improvements to the admin screen. We hope to be able to release a true 2.0 version sometime this year.

Related posts:

1. WP-Cumulus 2.0 is finally in development (again) I’ve been promising a new version of WP-Cumulus for a...
2. Help me test WP-Cumulus unicode support The one feature I’ve always wanted to add to WP-Cumulus...
3. About WP-Cumulus 1.20′s compatibility mode Flash sucks. There, I’ve said it. Or to be more...

Yesterday, Thomas Scholz alerted me to a security weakness in WP-Cumulus. He noticed XSS hacking attempts targeted at wp-cumulus.php that could, in rare cases allow malicious code to be executed. This issue has been fixed in version 1.22, and I strongly recommend you upgrade straight away. It’s better to be safe than sorry, and the attack has already been seen ‘in the wild’.

WP-Cumulus can be downloaded here, but chances are your blog will notify you of the new version and allow you to upgrade automatically.

Related posts:

1. WP-Cumulus updated to address yet another security issue A few weeks ago I rushed out an update to...
2. Cumulus as a Flex component A while ago I was asked to do a Flex...
3. WP-Cumulus is now a team effort Over the last few months, I’ve not been able to...

I guess it was about time I updated my Tagnetic Poetry plugin. WP-Cumulus’ lesser known brother now has shortcode support, as well as several other improvements. It’s not as mature as Cumulus, but it’s definitely stable enough to deserve a 1.0 version number.

The Flash movie now has support for the ‘xmlpath’ flashvar that WP-Cumulus has supported for a while now. This affects you only if you’re attempting to use it outside of the context of WordPress, but is very handy if you do. Putting more than one instance of the plugin on a page should also no longer cause issues, and several other little issues were fixed.

Using shortcodes allows you to place TP all over your blog. The parameters allow you to control the way it looks per instance, as opposed to the one set of options the plugin used to have. Those will still be used as defaults, but you can override them if you like by adding attributes to the [tagneticpoetry] shortcode. Here are some examples of how that works:

The new shortcode is all lowercase, but the older [TAGNETICPOETRY] tag is still supported for backwards compatibility. You could in fact add lowercase attributes to it if you’re using WordPress 2.5 or higher, but if you’re going to be editing the page anyway I guess it makes sense to use the lowercase code instead.

Currently, Tagnetic Poetry supports these attributes:

A more detailed blog post on how to use shortcodes is here. The original post about Tagnetic Poetry is here.

Related posts:

1. How to use WP-Cumulus shortcodes Contrary to what I originally thought when I released WP-Cumulus,...
2. WordPress plugin: Tagnetic Poetry Tagnetic Poetry is another experiment using Flash to display your...
3. WordPress plugin: WP-Cumulus Flash based tag cloud I love tags. I think it’s a brilliant idea to...

It’s getting hard to keep track of all the projects that are based on my little WordPress plugin. The most recent two are ports to MediaWiki and ReloadCMS. The latter is documented (in Russian) on opensoft.110mb.com and maintained by Victor Nabatov. My Russian is pretty poor, but I can see Cumulus tumbling about on the sidebar, so I guess it works

The MediaWiki port is listed as being beta, but the demonstration works beautifully. If I understand correctly it displays the categories on your wiki using ‘my’ Flash movie. Now if only they’d install it on Wikipedia… that would be so cool .

Related posts:

1. On ZDNet, the recession and optimism I really should ‘egosurf‘ more. It was only because I...
2. What to do with foreign language spam? I guess anyone who runs a WordPress blog will have...
3. WP Cumulus released! WP-Cumulus has moved to WordPress.org. The information on this page...