Vida y muerte de un plugin de WordPress: Lightbox Plus Colorbox by Dan Zappone

Este plugin lo usé durante años para hacer los lightboxes en docenas de instalaciones, seguramente os suene. Era completito, ligero y estable. Allá por mayo de 2016, de la noche a la mañana desapareció del repo pero nada más. Lo busqué por ahí pero no encontré ninguna noticia al respecto de por qué había desaparecido.

El caso es que tenía una vulnerabilidad y como el autor no la parcheó en un tiempo se eliminó del respositorio. Y yo me he enterado ahora por un hilo y de casualidad.

We recently discovered that the Lightbox Plus Colorbox plugin has a cross-site request forgery (CSRF)/cross-site scripting (XSS) vulnerability in version 2.7.2, and some prior versions, on the page/wp-admin/themes.php?page=lightboxplus.

No nonce is included on the page, leading to the CSRF issue.

For the XSS issue, in the file /lightboxplus.php starting at line 326 settings are saved and there is no sanitization done.


  • 3/29/2016 – Developer notified.
  • 4/5/2016 – WordPress Plugin Directory notified.
  • 4/5/2016 – Plugin removed from WordPress Plugin Directory.

Ahora me veo en la tesitura de revisar todas esas instalaciones y cambiarlo por otro (hay muchos plugins y mejoras, eso es lo de menos) pero lo que me da rabia es haberme enterado de chiripa.

Conclusión: hay que repensar qué hacemos con un plugin vulnerable si el autor no puede o no quiere parchearlo. Quitarlo del repo sí, pero había que notificarlo de alguna manera. Y siguiendo esa lógica el mensaje de “Actualización disponible” en el listado de plugins instalados en WP debería ir claramente marcado si es una actualización de seguridad.

PD: Ahora estoy usando Responsive Lightbox by dFactory que es además responsive y reconoce gestos táctiles.


Black Mirror, Asimov´s laws of robotics and Anchovy Face.

So, I was watching Black Mirror´s “Hated in the nation” (spoilers ahead). I´d say it has been my favorite episode so far in season 3. I found it a lower key and was more realistic (and hence scarier) than previous episodes in this third season. Continúa leyendo Black Mirror, Asimov´s laws of robotics and Anchovy Face.

Domain registration spammers are gonna spam


My name is Gredel and I have recently got hold of indemadrid dot com.
Funds are a bit short so I am thinking of releasing it for a small fee.
Would you be interested?

Thank you for your time.

So, are you telling me every time someone goes for a .net domain there is an automated system out there that does a whois and offers and alternative with .com? Wow.

Of course I marked it as so and did not reply.

Two English Poems

Two English Poems


The useless dawn finds me in a deserted street-
corner; I have outlived the night.
Nights are proud waves; darkblue topheavy waves
laden with all the hues of deep spoil, laden with
things unlikely and desirable.
Nights have a habit of mysterious gifts and refusals,
of things half given away, half withheld,
of joys with a dark hemisphere. Nights act
that way, I tell you.
The surge, that night, left me the customary shreds
and odd ends: some hated friends to chat
with, music for dreams, and the smoking of
bitter ashes. The things my hungry heart
has no use for.
The big wave brought you.
Words, any words, your laughter; and you so lazily
and incessantly beautiful. We talked and you
have forgotten the words.
The shattering dawn finds me in a deserted street
of my city.
Your profile turned away, the sounds that go to
make your name, the lilt of your laughter:
these are the illustrious toys you have left me.
I turn them over in the dawn, I lose them, I find
them; I tell them to the few stray dogs and
to the few stray stars of the dawn.
Your dark rich life …
I must get at you, somehow; I put away those
illustrious toys you have left me, I want your
hidden look, your real smile — that lonely,
mocking smile your cool mirror knows.


What can I hold you with?
I offer you lean streets, desperate sunsets, the
moon of the jagged suburbs.
I offer you the bitterness of a man who has looked
long and long at the lonely moon.
I offer you my ancestors, my dead men, the ghosts
that living men have honoured in bronze:
my father’s father killed in the frontier of
Buenos Aires, two bullets through his lungs,
bearded and dead, wrapped by his soldiers in
the hide of a cow; my mother’s grandfather
–just twentyfour– heading a charge of
three hundred men in Peru, now ghosts on
vanished horses.
I offer you whatever insight my books may hold,
whatever manliness or humour my life.
I offer you the loyalty of a man who has never
been loyal.
I offer you that kernel of myself that I have saved,
somehow –the central heart that deals not
in words, traffics not with dreams, and is
untouched by time, by joy, by adversities.
I offer you the memory of a yellow rose seen at
sunset, years before you were born.
I offer you explanations of yourself, theories about
yourself, authentic and surprising news of
I can give you my loneliness, my darkness, the
hunger of my heart; I am trying to bribe you
with uncertainty, with danger, with defeat.

– Jorge Luis Borges (1934)