That regex looks for all registered shortcodes within a string. For each match, it runs a replacement with a callback function, which also take the time to parse the shortcode attributes, before finally calling the actual callback function that’s been registered with add_shortcode.

Regular expressions are pretty fast in PHP, especially for short strings, but do we really have to have WordPress do all that extra work, when all we really intended was to call our shortcode callback function?

echo do_shortcode( '[foo]' ); // Boo
echo foo_shortcode_callback(); // Yey!

I ran a quick search in the plugins directory, using the following regex:

do_shortcode\(\s*['"]\[

Not the best crafted regex, but it’s supposed to look for calls to do_shortcode followed by a string literal starting with an opening square bracket. Obviously it might get a few false positives for special cases, but it also misses quite a few matches where the shortcode string is put into a variable first.

I found over 600 entries in over 270 plugins, including some of my own. Guilty! So the lesson I learned today is: don’t use do_shortcode when you can use your callback function directly, which is much more efficient.

Click here to comment

More from Konstantin Kovshenin

• WordPress Turns 10!
• WordCamp Austin Was a Blast!
• Don’t Hide the Fact That You’re Using WordPress
• Using get_template_part within Shortcodes
• Attending WordCamp Austin 2013

I’m co-organizing a WordPress anniversary meetup tonight here in Moscow. We’ll be looking through some of the WordPress releases, and maybe peek into b2. We’ll also talk about translating WordPress themes and plugins into Russian, so come join us if you’re in town.

More from Konstantin Kovshenin

• Don’t do_shortcode
• WordCamp Austin Was a Blast!
• Don’t Hide the Fact That You’re Using WordPress
• Using get_template_part within Shortcodes
• Attending WordCamp Austin 2013

Austin has always been on my list of places to visit, and now that I did I know it was totally worth the long travel. Huge WordPress community, very friendly people and a well organized WordCamp, not to mention that wonderful food experience.

I met and chatted with a lot of new folks – developers, designers, bloggers, business owners and beginners eager to use and learn WordPress. It was so overwhelming, in a good way obviously, and the BBQ – so delicious! The unofficial CigarCamp was the perfect way to end the day.

Dev Day on Sunday was a total blast, that’s where all the super geek talk happened over pizza. That’s where I was able to get a few minutes on stage to talk about contributing to WordPress and encouraged people to chime in.

So huge props to everybody who made it happen: organizers and volunteers, speakers, sponsors, attendees, and a very special thanks to the WP Engine folks for hosting Dev Day.

Hope to make it next year!

Click here to comment

More from Konstantin Kovshenin

• Don’t do_shortcode
• WordPress Turns 10!
• Don’t Hide the Fact That You’re Using WordPress
• Using get_template_part within Shortcodes
• Attending WordCamp Austin 2013

There are hundreds if not thousands of ways to not only find out the fact that you’re using WordPress, but also find out the exact version number, regardless of any plugins or hacks changing or hiding the “generator” meta tag, the readme file and so on. A great post by my brother Gennady illustrates that.

Security

Most of these “hide my WP” solutions tend to market themselves from a security standpoint, especially with the recent botnet attack on WordPress sites. The truth is that these attacks don’t really care which version of WordPress you’re running. In fact, they don’t even care whether you’re running WordPress at all! How? Well that’s easy, they just take your domain and blindly fire POST requests to a file called wp-login.php, even if you’re running a non-CMS pure HTML website.

The same applies to known theme and plugin vulnerabilities. Go ahead and check your web server’s access logs, there’s a pretty good chance you’ll find requests to timthumb.php even though none of your themes or plugins use the TimThumb library.

So from a security perspective, the secret sauce is to use a strong password, as well as keep your themes, plugins and especially WordPress core up to date. Plugins such as Google Authenticator and Limit Login Attempts can give you that little extra protection.

The Ferrari Analogy

Sometimes people try hide the fact that they’re running WordPress because they’re afraid other humans will spot that and think they’re “unprofessional” or cheap. Well WordPress is the most professional content management system known to human kind, trusted by some of the largest companies worldwide and although free and open source, certainly not cheap.

When you buy yourself a new Ferrari, do you remove the Ferrari logos before showing it to your friends? No. Although if you did, it would still be obvious.

To wrap that up — don’t hide the fact that you’re using WordPress. Use a strong password, keep it updated and drive it with pride. If you bought a premium “hide my WordPress” plugin, you should ask for a refund and buy something useful instead.

Click here to comment

More from Konstantin Kovshenin

• Don’t do_shortcode
• WordPress Turns 10!
• WordCamp Austin Was a Blast!
• Using get_template_part within Shortcodes
• Attending WordCamp Austin 2013

When using get_template_part with the Shortcode API, there are two things you should always keep in mind:

• get_template_part executes .php files which (most likely) generates output
• shortcode callback functions are expected to return a string and not generate any output

So when calling get_template_part within a shortcode callback function, you’ll see that all the output generated by get_template_part is output before the post content, and not replaced inline.

The solution is to use PHP’s output buffering. Create a buffer in your shortcode callback before running get_template_part, clear the buffer and return the content right after. Here’s a quick example with an ads shortcode, which can insert your theme’s ads.php file contents anywhere within a post or page:

function my_ads_shortcode( $attr ) {
    ob_start();
    get_template_part( 'ads' );
    return ob_get_clean();
}
add_shortcode( 'ads', 'my_ads_shortcode' );

The ob_get_clean() function stops buffering and returns whatever was output to the buffer after ob_start(). The same approach could be used with other functions and statement that generate output, such as include and require.

Click here to comment

More from Konstantin Kovshenin

• Don’t do_shortcode
• WordPress Turns 10!
• WordCamp Austin Was a Blast!
• Don’t Hide the Fact That You’re Using WordPress
• Attending WordCamp Austin 2013

Click here to comment

More from Konstantin Kovshenin

• Don’t do_shortcode
• WordPress Turns 10!
• WordCamp Austin Was a Blast!
• Don’t Hide the Fact That You’re Using WordPress
• Using get_template_part within Shortcodes

With quite a few options available, it’s not easy to make the right choice, plus, there’s almost always a learning curve involved, especially with shortcodes like:

[fourcol_two_last]

I crafted an experimental columns plugin quite a while ago, which hopefully simplifies the shortcodes to a bare minimum, and makes them look slightly more like HTML. Put as much columns as you want into a column group, and it can figure out the rest:

[column-group]
    [column]This is my first column[/column]
    [column]This is my second column[/column]
[/column-group]

Hopefully this is much easier than memorizing cryptic shortcode names, and even if you end up deactivating the plugin in the future, you can always run a (fairly) simple regex search and replace to “lock yourself out.”

I recently released the plugin for public use. It’s called Columns (duh!) and it’s available at the WordPress.org plugins directory. Give it a spin and let me know what you think!

Click here to comment

More from Konstantin Kovshenin

• Don’t do_shortcode
• WordPress Turns 10!
• WordCamp Austin Was a Blast!
• Don’t Hide the Fact That You’re Using WordPress
• Using get_template_part within Shortcodes

More from Konstantin Kovshenin

• Don’t do_shortcode
• WordPress Turns 10!
• WordCamp Austin Was a Blast!
• Don’t Hide the Fact That You’re Using WordPress
• Using get_template_part within Shortcodes

Lucky for us, Subversion comes with a remote repository mirroring tool called svnsync. It’s like database replication, but for Subversion. It allows us to create a complete mirror of the WordPress Subversion repository and host it locally, for quicker access. We can then set up a cron task to keep the mirror in sync every once in a while.

Preparing the Mirror Repository

It’s fairly easy to start a mirror. You’ll need to create an empty Subversion repository with svnadmin, like so:

mkdir /home/kovshenin/svn
cd /home/kovshenin/svn
svnadmin create wordpress

Since svnsync will need to modify revision properties after revisions have been committed, we’ll need to allow revision property changes, which are disabled by default. To do that, we’ll just have the pre-revprop-change hook exit with code 0:

cd wordpress/hooks
echo '#!/bin/sh' > pre-revprop-change
echo 'exit 0' >> pre-revprop-change
chmod +x pre-revprop-change

Initializing the Mirror and Syncing

The destination repository is now ready to become a mirror.

svnsync init file:///home/kovshenin/svn/wordpress https://core.svn.wordpress.org
svnsync sync file:///home/kovshenin/svn/wordpress

At this point, svnsync will start reading revisions from the WordPress Subversion repository, and replaying them on your local mirror. At the time of writing, WordPress has over 24,000 revisions, so this may take a while, especially on a slower connection. Another option is to use a dump file, which we’ll talk about in a sec. If the sync process is interrupted, you can start it again with “svnsync sync” and it’ll always pick up where it left.

Using the Mirror

After the sync is complete, you can use your new repository mirror to check out working copies, browse revision logs, switch branches and so on, which will be extremely fast:

cd /home/kovshenin/www
svn checkout file:///home/kovshenin/svn/wordpress .
svn log -r 9
svn sw ^/branches/3.5

If you’ve already have a working copy of the WordPress source code checked out, you can easily relocate it to your new local mirror with svn relocate:

cd /home/kovshenin/existing/
svn relocate file:///home/kovshenin/svn/wordpress/trunk

Note, that for a successful relocate, the UUID of both repositories should match. You can change the UUID of your mirror repository with svnadmin setuuid.

Finally, since running svn update on any working copy, will not pull in the new changes from the original Subversion repository, but rather update from your mirror, it’s important to keep your mirror in sync:

svnsync sync file:///home/kovshenin/svn/wordpress

It’s also a good idea to create a cron job that would run svnsync every hour or so.

The most painful part is reading all the 24k revisions from the WordPress Subversion repository, which can take a while, depending on your Internet connection. Luckily, there’s a trick you can use to speed up the process.

Starting from a Subversion Dump File

Before initializing the mirror, you can use a Subversion dump file (or backup file) to pre-populate your empty repository, which will only take a few minutes, and then have svnsync simply fill in the remaining revisions from source.

svnadmin load /home/kovshenin/svn/wordpress < wordpress.dump
svnsync init --allow-non-empty file:///home/kovshenin/svn/wordpress https://core.svn.wordpress.org
svnsync sync file:///home/kovshenin/svn/wordpress

So the question is where does one get a 24,000 revision dump file? Unfortunately, at the time of writing, there isn’t one you can get directly from WordPress.org, but you can download my dump file if you like.

That’s about it! Hopefully the above tips will help you maintain a local mirror and make your Subversion experience faster, as well as not require an Internet connection at all times. Make sure you keep your mirror in sync, and also make sure you never commit anything to your mirror manually — svnsync doesn’t like that, and may easily result in a corrupt repository. You can learn more about svnsync here.

A final word to Git and Mercurial fans: I love Git and Mercurial as much as you do, in fact, I use Git (not necessarily GitHub) on a daily basis. And if you came here to say I “should try git,” please go away :)

More from Konstantin Kovshenin

• Don’t do_shortcode
• WordPress Turns 10!
• WordCamp Austin Was a Blast!
• Don’t Hide the Fact That You’re Using WordPress
• Using get_template_part within Shortcodes

svn: The path '.' appears to be part of a Subversion 1.7 or greater
working copy. Please upgrade your Subversion client to use this
working copy.

Turns out there’s an official Subversion PPA on Launchpad, so for Ubuntu 12.04 all you have to do is add the following couple lines to your /etc/apt/sources.list file:

deb http://ppa.launchpad.net/svn/ppa/ubuntu precise main 
deb-src http://ppa.launchpad.net/svn/ppa/ubuntu precise main 

And upgrade Subversion to its latest version with apt-get:

sudo apt-get update
sudo apt-get install subversion

At this point you should be running the latest, and the greatest:

$ svn --version
svn, version 1.7.8 (r1419691)
   compiled Mar 23 2013, 23:38:40

Hope this helps!

More from Konstantin Kovshenin

• Don’t do_shortcode
• WordPress Turns 10!
• WordCamp Austin Was a Blast!
• Don’t Hide the Fact That You’re Using WordPress
• Using get_template_part within Shortcodes