Not having ppsx defined here causes WordPress? MU to throw the warning “File type does not meet security guidelines. Try another.” when uploading the file (even when the ppsx file type itself is blessed in WPMU’s admin options).

I’ve reported the bug to WordPress MU Track here:

• #1118: PPSX not defined as valid file in functions.php

Update

The fix isn’t quite so straightforward as just adding .ppsx to the list of valid PowerPoint extensions, because technically PowerPoint Shows for 2007 have their own MIME type:

• application/vnd.openxmlformats-officedocument.presentationml.slideshow

As does PowerPoint 2007:

• application/vnd.openxmlformats-officedocument.presentationml.presentation

Specifying the wrong MIME type for PowerPoint Show files caused WordPress to add a .ppt extension to the file, which played havoc with subsequent downloads. The fix was to specify the MIME type in wp_check_filetype:

• ‘ppsx’ => ‘application/vnd.openxmlformats-officedocument.presentationml.slideshow’

My bug report at WordPress MU was closed because this is technically something that needs to be changed in core WordPress; I’ll be reporting it there shortly.

That line shows up in Zork and its variants when you get lost in a labyrinth, and it’s how I feel right now trying to puzzle through the best way (or hell, ANY way of securing WordPress Mu in directory mode).

What I’m trying to do is this:

• I want to enable secure logins and admin pages (so that these pages are protected via SSL and have https addresses).

I’ve got a WordPress Mu install setup in directory mode, e.g.:

• The main blog is at wordpress.foo.edu.
• The daughter blogs will appear in subdirectory format, e.g. wordpress.foo.edu/bar

In normal WordPress, this goal can be accomplished by setting two constants in the config file:

• define('FORCE_SSL_LOGIN', true);

• define('FORCE_SSL_ADMIN', true);

Another option is to make use of the Admin-SSL plugin:

• Admin-SSL: http://www.kerrins.co.uk/blog/admin-ssl/

With WordPress Mu, it seems things are a bit trickier. Ok, a lot trickier.

Both methods will protect the main blog at wordpress.foo.edu, I get nothing but 404s when I try and access any of the daughter blog admin pages at wordpress.foo.edu/bar/wp-admin. Traffic is successfully redirected to https, but the server simply spits out a 404 page, saying there’s nothing there to load.

This is the same thing that happens when you, ahem, forget to include the htaccess file with the various mod_rewrite commands that allow for clean urls in WordPress, so my assumption was I’d just need some more mod_rewrite magic to get WordPress to properly serve these pages.

This led me on a mad chase to try and figure out the best way to do that. Instructions in the following post seem like they should work:

• SSL/LDAP/password security questions

And yet not. More 404s. More headaches. It could just be that I’ve been working on this too long, and need to let it simmer overnight. It seems to me that there must be a way to use mod_rewrite to force Wordpress Mu to resolve these https addressses the same as it does http, but I’m just not seeing it.

My guess is that this all would work just fine using the subdomain method, but we really want to use the directory one.

So yes. There’s a maze. With tiny twisty passages. And they are all alike. Time to hit the reset button, and tackle it with new eyes tomorrow. In the mean time, if anyone has any bright ideas, please let me know.

Update: 2/2/2009

You knew it was going to be something small and obscure right? And you new it was going to be something that prevent the .htaccess file from firing, right?

When last I wrote on Friday, sub-blogs failed to load whenever you tried to access an https-enabled page. I couldn’t help having this gut feeling that my issue had NOTHING to do with .htaccess/mod_rewrite and everything to do with a server configuration issue.

On Sunday, I did some experiments, and I discovered that when I tried to load an SSL-enabled daughter blog, the htaccess file was never even executed.  I tested this by purposefully breaking the htaccess file so it would cause a server error; when I loaded https://wordpress.foo.edu”, I got a “page not found” not a “you idiot, you broke the server” error.

So I switched gears and started looking at issues with httpd.conf and ssl.conf. That’s when I came across the very nifty “Installing WordPress Mu” ebook [pdf], where I saw this bit of advice: 

Permalinks do not work or Can’t find subblogs in subfolder install
If everything looks like it installed okay, but when you start clicking on links and you get 404’s or server errors, you need to do a little Apache configuration. Even if you have mod_rewrite enabled, and the htaccess file is there, on some setups the web account is set to not let these settings through. You’ll need to go to terminal mode and edit the httpd.conf file. See back on page 5, and while you’re in there, look for the directive of your virtual host, find this line “AllowOverride None” and change it to “AllowOverride FileInfo Options”. With no quotes.

Sounds familiar … doesn’t it?

So I look at the wordpress entry in httpd.conf and see that yeah, AllowOverride is configured as “AllowOverride FileInfo Option”. But ssl.conf? THAT was set to “AllowOverride None” As a result, WordPress MU worked just fine on regular pages, but failed on secure ones.

Changing ssl.conf so that AllowOverride was set to “AllowOverride FileInfo Options” fixed the problem. Apache, htaccess and Wordpress are on speaking terms again, login/admin traffic is automagically routed to https, and the freaking page LOADS.

[sigh]. It’s only obvious in hindsight.

• PodPress: The godfather of podcast plugins. It hasn’t been updated in a while, and there have been mixed reports about how well version 8.8 works with WordPress 2.7. A new version 9 is apparently in the works, but no one knows if/when it will appear. The file upload interface is a bit clunky, but there are a huge number of backend-options, plus stat tracking.
• Podcasting: A simple plugin that requires you know the URL of the file you want to podcast. That’s fine for tech-savvy people, but I think it’s going to fail the “quick and easy” test for everyone else.
• Blubrry: The lead contender. It works with the regular file upload interface for WordPress; if you insert a file into a post using the regular interface, it adds an MP3 player to the post. It also has a nice selection of backend feed options.

I still need to experiment with how these different plugins handle video files (so far, Blubrry worked like a charm), and I’m continuing to look at other options. I’d love to get some feedback on how well these different plugins work, as well as recommends for plugins not on the list

Slickr is a AJAX-based plug-in for WordPress that does exactly that. It looks good — check out the demo here — but there are some practical problems with it. The biggest is that it bases its galleries on Flickr albums rather than tags. This is fine, except that non-pro, free Flickr accounts are limited to three albums, while you can have an unlimited number of tags.

It’s a useful tool, especially for those who want to have a social networking tie-in to their photo galleries, but unless I pay for pro accounts for my industrial-strength users, it’s not the right solution. Instead, I’m looking at NextGen Gallery, a locally-hosted solution that simple photo galleries, slide shows, and the uploading of zipped files.

So what do I mean by that? Well, consider this actual use example from the “Research Tools” database I ported over to Drupal for a recent Library redesign project. The original database contained a number of records relating to research tools (journals, indexes, etc.) relating to a particular subject area. These records were assigned to categories like “Africana Studies: Major Research Tools” and “Africana Studies: Other Research Tools”. The original database then dynamically served up lists of these research tools on a single “Africana Studies” themed web page.

In Drupal, I was able to do this by creating a custom content type called “Research Tools” and a taxonomy to go with it. I then imported all the tools into the Drupal database, and used the Views module to create queries for the different categories. I then embeded these Views inline on a page, creating a nicely formatted list of research tools. You can check out the live version, but here’s a screen shot for quick reference:

So the “Major Research Tools” component is one Views query, and “Other Suggested Research Tools” is another Views query.

All well and good … but how do I do this in WordPress?

Imagine the same scenario, but now my “research tool” entries have been added as posts. The posts have been added two different categories: “Major Research Tools” and “Other Research Tools”. I want to query WordPress for that information, and then display it inline on the page.

Here’s another example: a Career Services department might want to have a page that lists all of the internships-related posts on a page, but wants to break them into groups of “paid” and “unpaid” internships. Sure, they could manually maintain that list … but it sure would be nice if they didn’t have to. 

What I’m ultimately trying to do here is provide folks with some simple tools to get dynamic lists of content onto a page. So far, I haven’t come up with much; the common WordPress solution seems to be to hack the site templates to come up with these kinds of pages, which is fine for developers, but is at odds with one of the reasons why we’d want to roll out WordPress: ease of use and ease of maintenance.

I’d rather give people a toolbox than have to handcraft each tool for them. I’m not opposed to doing so in special cases — sometimes you really do need a hydrospanner, but in most cases you don’t.

3. Update your Adobe Flash to the latest version (esp you Linux users!): Flash. NOTE: NOT TO VERSION 10. The new Flash version 10 is incompatible. The latest version 9 of Flash is what you want. There will likely NOT be a fix for this any time soon, since the problem is actually with Flash 10 itself. Stick with Flash 9 for the time being.

This raises the question of how one installs Flash 9 if you’ve already got Flash 10. Adobe doesn’t make this easy — I couldn’t find a direct link from the Adobe Flash home page — but fortunately Google dug up the archived version page:

• http://www.adobe.com/support/flashplayer/downloads.html#fp9

The problem is even after reverting back to Flash 9, this still doesn’t work. Oh I can click the button now and select a file, but once selected said file never uploads; the browser just sits there. Searching it around, it appears I’m not the only one experiencing this.

So the short answer seems to be “use the browser uploader and hope the flash one is fixed … someday.”

It comes with an audio player (I haven’t mucked about with the video options yet) that allows audio to be played on the page.  It supports built-in previews showing you how the podcast’s entry will look in the most popular podcasting directories (including iTunes and Yahoo).

The good news is that it appears to work out of the box with WordPress Mu, which is fantastic. One of our major goals for the WordPress pilot is to be able to support podcasting, and I think this would be a great tool for doing it. It also helps that almost every podcaster I know who uses WordPress also uses podPress … and I know a lot of podcasters.

The only downside to the app that I can see is that you can’t upload files as part of it; you need to upload the file using the “add media” buttons in WordPress, copy the path to said file, and then paste that path into the podPress portion of the page.

It’s clunkier than I expected; if nothing else I’d like for it to be able to browse the user’s media directory. I can see this cutting and pasting of urls being a little clunky for new users, but given the rest of podPress’s feature set, I think we can live with it.

• LDAP Plugin for WordPress Mu

This plugin worked out of the box for me with WordPress Mu 2.6.x, which is always a nice thing.

I see four big needs for the blogging platform:

• Blogging (it does this out of the box, no big deal)
• Podcasting (in theory, I think it creates RSS enclosures for uploaded files, but I’d rather that give people a finer degree of control)
• Video Insertion (plugins for YouTube, Hulu, etc.)
• Photo Galleries

PodPress seems a logical choice for Podcasting, but I’ve heard mixed reports about how well it works with Mu. Photo Galleries are another challenge; we’re debating going with a hosted service like Flickr vs. a locally installed option like Gallery. Authentication is the big issue there; if we go with Flickr, everyone has to maintain their own accounts. If we go with Gallery or something hosted locally, then we have a better chance of integrating it into our existing authentication schemes.

Using Mu? Curious about our own experiments? Post a comment below.