Steve Grunwell

Open-source contributor, speaker, and coffee snob

Page 3 of 13

A home sitting on a midwestern, prairie homestead.

Developer-specific Laravel Homestead Configurations

Since joining Liquid Web, I’ve gotten to revisit Laravel, my favorite application framework for PHP. I’m still doing plenty of WordPress work, of course, but when building web applications — especially those with robust APIs — building atop Laravel makes so much more sense than shoehorning it into a WordPress environment.

In their mission to make application development delightful, Taylor Otwell and the other Laravel developers (including my friend Joe Ferguson) maintain Laravel Homestead, a pre-packaged Vagrant box for Laravel development. While the environment can be installed globally, Laravel Homestead can also be installed on a per-project basis, ensuring each application has its own, dedicated virtual machine.

Continue reading→

My Laravel Tests were Failing because of my App URL

In my role as Senior Software Engineer at Liquid Web, I’ve gotten to get back to my roots of not only doing WordPress, which has been great. In particular, I’m getting back into Laravel, getting to build real web applications in an environment that makes testing a breeze (aside: if you haven’t checked out Adam Wathan’s Test Driven Laravel course, I cannot recommend it enough!).

I ran into an interesting problem today, however, when I updated the APP_URL variable in my .env file: running my [previously 100% green] test suite, I was getting random errors and failures within my feature tests that I hadn’t been seeing before. Controller actions weren’t responding properly, model relationships weren’t always behaving, and redirects following actions were hit-or-miss.

Continue reading→

Fjallsárlón glacial lagoon in Iceland

Six Things I Wish I Knew Before Iceland

My wife, Kim, and I just got back from a week abroad in Iceland — our first trip out of the country together since our Jamaican honeymoon and the first trip away from our toddler for more than a long weekend.

First of all, photos cannot capture the beauty that is Iceland. The mountains, the waterfalls, and the views are things you have to see in person. From the enormous glaciers to the east to the vibrant capital of Reykjavík in the west, Iceland is every bit what the guidebooks and travel blogs make it out to be.

For our trip, we wanted to be able to take in as much of Iceland as possible without losing the freedom to move at our own pace. As a result, we opted to rent a car at the airport, drive along the southern end of the country (staying just outside of the town of Vik), see the southeast end of the glacier field, then end the trip in Reykjavík.

Now that we’re back, I wanted to share a few things that I wish I had known before heading to Iceland.

Continue reading→

Screenshot from ExploitBox's CVE-2016-10033 video

Keeping WordPress Secure

A few days ago, a YouTube video was passed around a few Slack teams I’m a member of showing a proof of concept of an unauthenticated remote code execution vulnerability in WordPress core (in other words, a way for people to execute arbitrary code on your server, which is obviously bad). The video, posted by Dawid Golunski of Legal Hackers, purported that the vulnerability was exploited against a clean installation of WordPress with no plugins and only the default configuration.

This morning, Dawid’s new site, ExploitBox, posted details about the vulnerability. In short, by spoofing a request’s “Host” header, it’s possible to trick WordPress into sending a password reset email with a return path pointing to a domain you control.

The author goes on to hypothesize that if an attacker were to first overload the target’s inbox with large messages (effectively filling it to the point that it couldn’t hold more messages), this would cause the mail host to “bounce” (reject) the message, returning it to the sender (the attacker). Assuming the returned email contained the body of the original message, the attacker now has the link that will allow them to change the user’s password.

Continue reading→

Today is my last day at Growella

Though it was only a few short months ago that I left my Lead Web Engineer position at 10up to join Growella as their Director of Technology, today is my last day in that position. It’s not a decision I’ve arrived at lightly, but it’s a move that I feel is necessary for my career satisfaction.

I’m extraordinarily proud of what I’ve accomplished in my few months at Growella; our small team was able to take the site from concept to release in less than two months, rolling out the “Prime” release on January 17. I pitched, built, and have been writing weekly on the Engineering @ Growella blog, a place to discuss how we approach engineering challenges at Growella. Growella’s GitHub organization has a number of open-source contributions to its name, including several WordPress plugins, a WP-CLI package, and several contributions to other open-source projects.

Continue reading→

A glass of cold-brew coffee, served over ice, with a swirl of cream.

Brewing your own cold-brew coffee in a French Press

I’ve read plenty of tutorials on making your own cold-brew coffee in a French Press before (Home Grounds has a great guide), but it wasn’t until today that I realized just how easy (and tasty) it can be!

My good friend Matthew Haynes, Head Roaster at Inland Seas Coffee, has a beautiful glass cold-brew maker that serves double-duty as a brewer and an art piece, but there are also plenty of more economical choices for the home cold-brewer, like the popular Toddy system.

Did you know that you can easily make great tasting cold-brew coffee at home with items you likely already have lying around? I’ll show you a few ways you can be drinking great cold-brew coffee by tomorrow morning!

Continue reading→

8 Highlights from Engineering @ Growella

If you recall, I launched the Engineering @ Growella blog at the beginning of 2017. Since then, I’ve been publishing at least once a week on that blog, but this site has been neglected as a result, which is unfortunate.

I’m very proud of the content that’s being published on the Engineering @ Growella blog, however, so I thought I’d take a moment to highlight some of the better pieces from the last two months.

Continue reading→

The Tuletornen residential project in Sundbyberg, Sweden

Schemify: Automatic structured data for WordPress

It’s been several months in the works, but I’m thrilled to announce that my latest WordPress plugin, Schemify, is now available on WordPress.org!

Schemify is designed to automatically generate Schema.org-compliant structured data for WordPress, with full customization capabilities through actions and filters. With Schemify, you can rest assured that Google, Bing, and other search engines see your posts as articles, pages as webpages, and ensure that your authors get the credit they deserve.

Best of all? Schemify is able to inject structured data into your site without you having to change your markup!

Continue reading→

I just launched the Engineering @ Growella blog

As you may be aware, I joined a Cincinnati-based startup, Growella, as their Director of Technology in mid-November. Since joining, I’ve been hard at work building our site (which is slated to launch within the next few weeks), building our hosting infrastructure, and generally being the point-person for all things technological at the company.

I’m already learning a lot in my new role, and I wanted an outlet to be able to share those things. I’m also very fortunate that the rest of the company embraces open source software, so I wanted a place (besides this blog) to share what Growella has been working on, the problems we’ve been solving, and any releases of new software.

With all of that in mind, I’m proud to announce that about an hour ago we launched the Engineering @ Growella blog.

Continue reading→

A series of links in several chains

Using symlinks for WordPress MU plugins

If you haven’t run into them before, WordPress Must-Use (MU) plugins can be a great way to say “no, seriously, my WordPress site needs this plugin in order to function”. Other times, MU plugins may be used to activate required functionality that site maintainers don’t want the site editorial team to have to worry about (for example, caching plugins like Batcache).

There are a lot of things that can be done with MU plugins, but there’s one major limitation right out of the gate: WordPress MU plugins cannot run in sub-directories.

Continue reading→

Page 3 of 13

Be excellent to each other.