Common Mistakes as Python Web Developer

A few weeks ago I had a heated discussion with a bunch of Python and Open Source people at a local meet-up about the way Python's path joining works. I was always pretty sure that people are aware of how the path joining works and why it works that way. However a bit of searching around on the internet quickly showed that it's actually a pretty common mistake to use the os.path.join function with arbitrary and unfiltered input, leading to security issues. Because the most common case where user input comes from another system is web development I went a bit further and tried to find a few other cases where people might be blindly trusting an API or operating system.
So here it is: my list of things not to do when doing Python web development.

Untrusted Data and File Systems

Unless you are running on a virtualized filesystem like when you are executing code on Google Appengine, chances are, vital files can be accessed with the rights your application has. Very few deployments actually reduce the rights of the executing user account to a level where it would become save to blindly trust user submitted filenames. Because it typically isn't, you have to think about that.
In PHP land this is common knowledge by now because many people write innocent looking code like this:

<?php

include "header.php";
$page = isset($_GET['page']) ? $_GET['page'] : 'index';
$filename = $page . '.php';
if (file_exists($filename))
    include $filename;
else
    include "missing_page.php";
include "footer.php";

Now the problem is that if you accept the filename blindly one could just pass a string with some leading “go one layer up” markers and access files somewhere else on the file system. Now many people thought that wouldn't be a problem because the file has to end with “.php” so only PHP files can be accessed. Turns out that PHP never (at least not until recently) removed nullbytes from the string before opening the file. Thus the underlying C function that opened the file stopped reading at the null byte. So if one attacker would access the page ?page=../../../../htpasswd he would see the contents of the passwd file.
Python programmers apparently don't care too much about this problem because Python's file opening functions don't have this problem and reading files from the filesystem is a very uncommon thing to do anyways. However in the few situations where people do work with the filenames, always always will you find code like this:

def upload_file(file):
    destination_file = os.path.join(UPLOAD_FOLDER, file.filename)
    with open(destination_file, 'wb') as f:
        copy_fd(file, f)

The problem there is that you expect os.path.join never to go a folder up. While in fact, that's exactly what os.path.join is capable of doing:

>>> import os
>>> os.path.join('/var/www/uploads', '../foo')
'/var/www/uploads/../foo'
>>> os.path.join('/var/www/uploads', '/foo')
'/foo'

While in this case the attacker is “just” able to overwrite files anywhere on the filesystem where the user has access (might be able to override your code and inject code that way!) it's not uncommon to read files on the filesystem as well and expose information that way.
So yes, os.path.join is totally not safe to use in a web context. Various libraries have ways that help you deal with this problem. Werkzeug for instance has a function called secure_filename that will strip any path separators from the file, slashes, even remove non-ASCII characters from the path as character sets and filesystems are immensly tricky. At the very least you should do this:

import os, re

_split = re.compile(r'[\0%s]' % re.escape(''.join(
    [os.path.sep, os.path.altsep or ''])))

def secure_filename(path):
    return _split.sub('', path)

This will remove any slashes and null bytes from the filename. Why also remove the Null byte if Python does not have a problem with that? Because Python might not, but your code. A nullbyte in the filename will trigger a TypeError which very few people are expecting:

>>> open('\0')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: file() argument 1 must be encoded string without NULL bytes, not str

On Windows you furthermore have to make sure people are not naming their files after device files, but that is outside of the scope of this post. If you are curious, check how Werkzeug does it.
If you actually do want to allow slashes in the filename there are a couple of things you have to consider. On POSIX the whole system is incredible easy: if it starts with a trailing slash or the combination of ../ it will or might try to reference a file outside of the folder you want the file to be in. That's easy to prevent:

import posixpath

def is_secure_path(path):
    path = posixpath.normpath(path)
    return not path.startswith(('/', '../'))

On windows the whole situation is more tricky (and I fell into that trap a few days ago as well). First of all you have backslashes you have to consider. Technically you would also have to consider colons on Mac OS, but there are very few people that still aim for Mac OS compatibility. Thus the backslash is the main culprit. Secondly you can't just test for absolute paths by checking if the path starts with a slash. On windows there are multiple different kinds of absolute paths: regular Unix absolute paths and secondly absolute paths that also include a drive letter. Thankfully the path module provides ways to reliably check if the path is absolute.
The following function checks if paths will not manage to escaped a folder on POSIX and Windows:

import os

non_slash_sep = [sep for sep in (os.path.sep, os.path.altsep)
                 if sep not in (None, '/')]

def is_in_folder(filename):
    filename = os.path.normpath(filename)
    for sep in non_slash_seps:
        if sep in filename:
            return False
    return os.path.isabs(filename) or filename.startswith('../')

The idea is that we consider the filenames to be in posix notation and that the operating system is fine with filenames containing slashes. That is the case for all operating systems you would care about these days. Then if the native operating system path separator is in the string we can assume it's not a valid character for a filename on the web anyways and consider it unsafe. Once that passed we make sure the path is not absolute or does not start with the special ../ string that indicates going to a higher level on both Windows and POSIX.
Generally speaking though, if you do aim for windows compatibility you have to be extra careful because Windows has its special device files in every folder on the filesystem for DOS compatibility. Writing to those might be problematic and could be abused for denial of service attacks.

Mixing up Data with Markup

This is a topic that always makes me cringe inside. I know it's very common and many don't see the issue with it but it's the root of a whole bunch of problems and unmaintainable code. Let's say you have some data. That data for all practical purposes will be a string of some arbitrary maximum length and that string will be of a certain format. Let's say it's prosaic text and we want to preserve newlines but collapse all other whitespace to a single space.
A very common pattern.
However that data is usually displayed on a website in the context of HTML, so someone will surely bring up the great idea to escape the input text and convert newlines to <br> before feeding the data into the database. Don't do this!
There are a bunch of reasons for this but the most important one is called “context”. Web applications these days are getting more and more complex, mainly due to the concept of APIs. A lot of the functionality of the website that was previously only avaiable in an HTML form is now also available as RESTful interfaces speaking some other format such as JSON.
The context of a rendered text in your web application will most likely be “HTML”. In that context, <br> makes a lot of sense. But what if your transport format is JSON and the client on the other side is not (directly) rendering into HTML? This is the case for twitter clients for instance. Yet someone at Twitter decided that the string with the application name that is attached to each tweet should be in HTML. When I wrote my first JavaScript client for that API I was parsing that HTML with jQuery and fetching the application name as a string because I was only interested in that. Annoying. However even worse: someone found out a while later that this particular field could actually be used to emit arbitrary HTML. A major security disaster.
The other problem is if you have to reverse the stuff again. If you want to be able to edit that text again you would have to unescape it, reproduce the original newlines etc.
So there should be a very, very simple rule (and it's actually really simple): store the data as it comes in. Don't flip a single bit! (The only acceptable conversion before storing stuff in the database might be Unicode normalization)
When you have to display your stored information: provide a function that does that for you. If you fear that this could become a bottleneck: memcache it or have a second column in your database with the rendered information if you absolutely must. But never, ever let the HTML formatted version be the only thing you have in your database. And certainly never expose HTML strings over your API if all you want to do is to transmit text.
Every time I get a notification on my mobile phone from a certain notification service where the message would contain an umlaut the information arrives here completely broken. Turns out that one service assumes that HTML escaped information is to be transmitted, then however the other service only allows a few HTML escaped characters and completely freaks out when you substitute “ä” with “&auml;”. If you ever are in the situation where you have to think about “is this plain text that is HTML escaped or just plain text” you are in deep troubles already.

Spending too much Time with the Choice of Framework

This should probably go to the top. If you have a small application (say less than 10.000 lines of code) the framework probably isn't your problem anyways. And if you have more code than that, it's still not that hard to switch systems when you really have to. In fact even switching out core components like an ORM is possible and achievable if you write a little shim and get rid of that step by step. Better spend your time making the system better. The framework choice used to be a lot harder when the systems were incompatible. But this clearly no longer is the case.
In fact, combine this with the next topic.

Building Monolithic Systems

We are living in an agile world. Some systems become deprecated before they are even finished :) In such an agile world new technologies are introduced at such a high speed that your favorite platform might not support it yet.
As web developers we have the huge advantage that we have a nice protocol to separate systems: it's called HTTP and the base of all we do. Why not leverage that even further? Write small services that speak HTTP and bridge them together with another application. If that does not scale, put a load balancer between individual components. This has the nice side effect that each part of the system can be implemented in a different system. If Python does not have the library you need or does not have the performance: write a part of the System in Ruby/Java or whatever comes to mind.
But don't forget to still make it easy to deploy that system and put another machine in. If you end up with ten different programming languages with different runtime environments you are quickly making the life of your system administrator hell.

Stolen from: http://lucumr.pocoo.org/2010/12/24/common-mistakes-as-web-developer/

Introduction to ZSH

Introduction

Recently I switched from using bash to zsh as my main shell. I'd heard a lot of good things about it (and how complex it is woah) so I decided to try it out for myself, the main reason I decided to try it was because it was already installed on my system (Mac OS X) and it has emacs key bindings. What i found was "the missing shell" in a lot of ways interactive mode is similar to bash, which is great, I can easily fit into it and feel comfortable but it has a lot of things that extend on bash such as completion, globbing and customisation. Next we'll look at some of the most important aspects of zsh that I found in my short experience with it, and some examples which might motivate you into using it yourself. NOTE: I have purposely left out the scripting side of zsh because I haven't had much experience with it yet and I have about the same amount of experience with bash scripting.

Why use zsh?

As mentioned before, here's some of the most important aspects of zsh for me.

Expressive

One aspect of zsh that first stood out for me was its extensive globbing capabilities, for example:

ls -d ^*.zsh 

This will display all files except (^) files with the .zsh extension.

ls *.zsh~i*

This will list all files with the .zsh extension except files beginning with the letter 'i'.

ls *.(zsh|rb|)

This is grouping and will print files with zsh and rb extensions.

ls **/*zsh

Will output:

configs/aliases.zsh
configs/bindings.zsh
configs/completion.zsh 
configs/exports.zsh
configs/prompts.zsh
init.zsh

This globs the directories with the asterisk for zsh files.
To enable these features you'll need setopt extendedglob in your config.

Completion

Zsh's completion is more advanced than what I was used to with bash, with zsh you can get suggestions in a menu that you can browse with the arrow keys, more intelligent context aware suggestions, and more.
Here's an example of context aware suggestions:

kill <TAB>

With this you'll get a list of running processes.
When you're browsing a directory you also get more information about what the file is, for example:

ls ~/.z <TAB>

And you'll get what you expect, but if you have symlinked files they'll look like this:

.zshrc@

The @ symbol denotes a symlink. This is only a small feature but it's nice and you don't need to ls -l.
There is also support for remote completion!

Prompts

You can have multiline prompts which can have many features attached to it like battery charge and load. see this blog for a good example. The prompt is at the heart of zsh customisation capabilities, you can pretty much configure it to look anyway you want and there are plenty of examples out there ranging from simple to mad!

alias -g alias -s

With zsh you can have a file for global (-g) aliases and suffix (-s) aliases, for example:

alias -s pdf=xpdf

So now if you execute a single file ending in pdf is will be re-written to xpdf foo.pdf.
Global aliases are expandable anywhere on the command line, not just the beginning. Global aliases can be dangerous if something gets expanded that shouldn't.

Easy setup

To get a reasonable config it only takes about 4 lines of code:

autoload -U compinit promptinit        
compinit
promptinit        
prompt walters

With that you get a tab completion (compinit) and coloured prompt (promptinit). You can see the list of built in prompts with:

prompt -l

You can also add a prompt to your config with:

export PS1="$(print '%{\e[1;34m%}%n%{\e[0m%}'):
$(print '%{\e[0;34m%}%~%{\e[0m%}') → 

This can all go into your config file at ~/.zshrc. As zsh is fully customisable I prefer to split up my files (see a link to my config at the end of this article). With this you're ready to go with some of the best features of zsh to play with, and as you grow your config will grow with you.

Emacs

Being able to use one set of keybinding across applications is handy and as an emacs user I was pleased to find out zsh supports emacs keybinding out the box by default (Vim users can set the $EDITOR variable in their config), so normal navigation rules apply!

Conclusion

I've only scratched the surface here of what you can do with zsh and how it can make your terminal life a little bit easier. You should give zsh a try it's expressive, very powerful and fits nicely into a programmers' toolbox. If you want somewhere to get started you can take a look at my configs or if you're a git user you can clone it with:

 git clone git@github.com:jbw/zsh.git 

Happy tweaking!

References

• Z shell Homepage Here you can find links to a lot resources.
• Z shell Intro A quick-ish read on zsh to give you an overview.
• Z shell Refcard A cheatsheet sort of document.
• Caphuso's Z shell Talk A long talk on zsh magnifying some of its cool features.

Stolen from: http://jbw.cc/2010/07/20/using-zsh/

C++ Streams & Typedefs: Be Charful

The C++ typedef keyword is indispensable in many situations, especially for writing portable low-level code. However, in some circumstances it can cause trouble, particularly when it comes to function overloading. Consider the following C++ template class:

template <typename T>

struct foobar
{
    foobar( const T foo ) : foo_( foo ) {}
    T foo_;
};

One might want to write a simple stream output operator to format the template class’ member values, e.g. for debugging purposes:

template <typename T>

ostream& operator<<( ostream& s, const foobar<T>& fb )
{
    return s << "foo: " << fb.foo_;
}

This seems reasonable. Now, let’s assume that this template is going to be used in a context where T will be one of several fixed-width integer types. These are usually typedefs from a header like stdint.h (for those that don’t mind including a C header) or boost/cstdint.hpp (to be a C++ purist). They are commonly named int64_t, int32_t, int16_t, and int8_t, where the X in intX_t specifies the number of bits used to represent the integer. There are also unsigned variants, but we’ll ignore those for this discussion.

Let’s now explore what happens when we initialize a foobar<intX_t> instance with its foo_ member set to a small integer and print it to standard output via our custom stream output operator:

cout << foobar<int64_t>( 42 ) << endl;
cout << foobar<int32_t>( 42 ) << endl;
cout << foobar<int16_t>( 42 ) << endl;

Each of these statements prints “foo: 42″, as expected. Great, everything works! But wait, there was one type that we didn’t test:

cout << foobar<int8_t>( 42 ) << endl; 

 This prints “foo: *” instead of “foo: 42″. This is probably not the expected result of printing the value of an int8_t. After all, it looks and feels just like all of the other intX_t types! What causes it to be printed differently from the other types? Let’s look at how the integer types might be defined for an x86 machine:

typedef long int int64_t;
typedef int int32_t;
typedef short int16_t;
typedef char int8_t;

The problem is that the only way to represent an integer with exactly 8 bits (and no more) is with a char (at least on the x86 architecture). While a char is an integer, it is also a… character. So, this trouble is caused by the fact that the char type is trying to be two things at once. A simple (but incorrect) approach to work around this is to overload1 the stream output operator for the int8_t type, and force it to be printed as a number:

// This is incorrect:
ostream& operator<<( ostream& s, const int8_t i )
{
return s << static_cast<int>( i );
}

The problem with this approach is that the int8_t typedef does not represent a unique type. The typedef keyword is named poorly; it does not introduce new types. Rather, it creates aliases for existing types. By overloading the stream output operator for the int8_t type, the char type’s operator is being overloaded as well. Since the standard library already defines a stream output operator for the char type, the above definition would violate the One Definition Rule and result in a compiler error. Even if it did compile, the results of redefining the way characters are printed would probably not be desirable.

An alternative (working) solution to the problem is to overload the output stream operator for the foobar<int8_t> type:

ostream& operator<<( ostream& s, const foobar<int8_t>& fb )
{
    return s << "foo: " << static_cast<int>( fb.foo_ );
}

This definition does not clash with any existing overloads from the standard library, and it effectively causes the int8_t to be printed as an integer. The downside is that it will cause unexpected behavior when a foobar<char> is printed, if the programmer intends char to represent a character. The only way to avoid this would be to define int8_t as a class instead of making it a typedef, and providing a well-behaved stream output operator for that class. The class’ arithmetic operators could be overloaded to make it look almost exactly like a POD integer, and it wouldn’t necessarily take up any extra memory. However, this solution is still not ideal, because classes behave differently than POD types in subtle ways (e.g. POD types are not initialized by default, but classes are).

If there’s anything to take away from this, it’s that the C++ char type is an odd beast to watch out for. Also, the name of the typedef operator could use some improvement…

To subscribe to the "Guy WhoSteals" feed, click here.
You can add yourself to the GuyWhoSteals fanpage on Facebook or follow GuyWhoSteals on Twitter.

25 Unique uses of WordPress as CMS

WordPress is often thought of as little more than a blogging platform. But it’s capable of so much more. Through a little customization and the use of plugins, WordPress can easily be transformed into a full-featured content management system. Here are more than 25 sites who have done just that (and done it well).

---

UGSMAG

UGSMAG is a Canadian hip hop magazine. The home page is laid out in a grid, with featured articles along the left two columns and news on the right. The color scheme and design choices reflect the young, independent audience they attract. The lack of a category list (other than the top nav, which simply lists “News,” “Features,” and “Interviews”) and archives lend the page to looking more like a traditional news or magazine website than a blog.

Subtle changes to individual article pages, such as removing the category labels, the use of a drop cap initial character, and moving the date from it’s usual blog-centric location under the title to the upper-right hand corner of the page all also contribute to the site looking more like a magazine and less like your standard blog.

The Weather Pops

The Weather Pops are a group of weather-related characters available for licensing. The site is simple and straightforward, and an excellent example of how WordPress can be used to build a simple yet powerful website. The pages included on the site offer great examples of how you can incorporate a gallery, contact form, and standard pages into a WP site.

The integration of plugins, such as the NextGEN Gallery plugin used on the gallery page, further improves the functionality of the site. Unless you looked at the code of the site, it’s unlikely anyone would have any idea this site was built using WP.

Temple Bar TradFest

The Temple Bar TradFest is an Irish music and culture festival held each year. The home page of this site bears absolutely no resemblance to a blog. The same can be said for internal pages, too. Individual pages within the site have no date or timestamp, no category or other tags, and otherwise look nothing like a traditional blog post.

Good use of plugins for the gallery and other pages further improves the functionality of this WP installation. This is another site where your average visitor would have no clue it was built on WP unless they checked the source code.

Table Talk

Table Talk is an online store selling dining furniture, tableware, and similar products. The home page features a product gallery with rotating images and the product pages show products laid out in a grid format. The site was built using the WP e-Commerce plugin for the online store functionality. E-commerce plugins greatly increase WP’s ability to be used as a CMS for virtually any kind of site.

Pages within the Table Talk site are set up without comments, date and time stamps, and categories. Categories are used for products, instead.

TP Hire

TPs is a teepee rental company serving Sussex and South East England. This site is actually a great example of using WordPress as a CMS. In addition to the standard pages found on most business sites (news, information, about us, etc.), there’s also a really great gallery page that uses the Lightbox formatting for viewing larger images and the option to view images in a slideshow. The layout of the events page is also an excellent example of how pages can be thoroughly customized within WP to suit the needs of the individual site.

The Art of Catalin Bridinel

The Art of Catalin Bridinel is your basic portfolio site. This site is a bit more blog-ish than most of the others here, but still offers up a good example of how to use WordPress for something other than your traditional blog. Paintings are listed in blog posts, with a large image appearing immediately under the title and a brief description under that. Comments are enabled here, unlike on many other CMS sites. The overall design, lack of sidebars, and other stylistic elements make this look more like a traditional portfolio site than a blog.

Search Inside Video

Search Inside Video is a service that provides searchable transcripts for online video content. Their site is one of the more innovative uses of WordPress as a CMS that I’ve seen. The overall site design is very simple, basically consisting of one long page with anchor tags for different content. Not exactly a revolutionary idea. But the implementation of it is very slick. It’s a great example of thinking outside the box in using WP as a CMS.

P2P Rescue

P2P Rescue is a non-profit organization working to help Sri Lanka and other Southeast Asian countries. The home page offers up basic information and articles about the organization and their cause. The overall site architecture is very simple, but again, bears little resemblance to a regular WP blog. Use of plugins for allowing donations to be made through PayPal further increases WP’s base functionality. The site also includes an online store powered by WP e-Commerce. Other pages include basic information about the organization and a blog (under the “Voices” section).

Myshli

Myshli is the portfolio of Danil Kryvoruchko. The home page of the site offers a gallery of designs, including a JavaScript slideshow of selected works. Individual pages on the site include galleries for each different type of work they do (web, print, etc.) along with an about page. Pages for individual projects show a variety of screenshots and images. The site also includes a blog with a different theme from the rest of the site (the main site has a black background whereas the blog has a white background).

Little White Lies

Little White lies is a website that revolves around movies. The home page is not unlike many other news and magazine websites, offering up links to current content, including interviews and reviews of upcoming and recently released films. Category pages (such as for interviews or reviews) use a different layout than the home page, though it does make them feel a bit more blog-like.

The article pages have stripped out the majority of blog-centric features, but have left in the comments section (many newspapers and magazines have added comment functionality to their articles both in and outside of blogs). The shop section on the blog appears to be the only section not powered by WordPress. Why this is is unclear, as there are some great plugins for e-commerce on WP.

KMX Karts

KMX Karts are manufacturers of recumbent trikes. The home page bears no resemblance to a blog, with the exception of the presence of a somewhat blog-like footer. The site includes a number of different kinds of page templates. There are pages for the different Kart models, pages for accessories, and pages for general company information. Each type of page, because they have their own unique functions, is slightly different from the other pages. The theme, though, is consistent throughout the site. The e-commerce aspects of the site are powered by the Shopp plugin.

IconDock

IconDock sells stock icons to designers. This is one of the prettiest sites I’ve seen using WP as a CMS. The home page is simple while still offering up plenty of content and some icons for sale right on the home page. Navigation is easy, with top nav and links placed within the content (such as the “Browse Icon Library” in the main image on the home page). The e-commerce portion of the site is powered by the WP e-Commerce plugin. The product pages offer up plenty of information about individual icon sets as well as different pricing options.

One of the coolest features on this site, though, is the drag-and-drop shopping cart (just drag an icon or set to the box on the left-hand side of the screen to add it to your cart). The box on the side shows your cart’s contents and removing an item is as simple as clicking the “x” in the corner. It’s definitely one of the slicker shopping cart UIs I’ve seen.

Ginger Restaurant

Ginger is a restaurant in South Africa. The overall site design and architecture are very simple while also being very attractive. The home page offers up basic information, including their hours and phone number. Other pages include more information about the restaurant, an online menu, and a gallery of the restaurant and their food. The gallery uses the JavaScript Thickbox functionality for displaying photos. There’s also a slideshow in the header of their offerings.

A couple of features that really set this site apart from similar sites, though, are their addition of links to their Facebook page and a page that lets you tell friends about Ginger. This kind of functionality is rarely seen on local business sites but should be utilized more often.

Fraai Magazine

Fraai Magazine is a free online magazine offering up creative inspiration. The site uses a the FLV Embed plugin to embed the Flash magazine into the site. (FYI: There is also a plugin available for WordPress, Page Flip Image Gallery, that allows you to create a flip-book style magazine right within WP.)

Other pages on the site include a visual index of articles and a page listing the issues available. The overall site is very simple but it’s an effective implementation of WP and appears to work well for what they’re doing.

Ford Motor Company—Global Auto Shows

This is the site of Ford Motor Company’s global auto show coverage. This is another site where you’d never guess it was powered by WordPress if you didn’t look at the source code. The home page offers up a gallery of featured vehicles, links to the different Ford brands, and a list of recent articles. Other pages on the site include a show schedule, information on concept cars (including a gallery) and information on vehicle types. From the looks of it, there’s a lot of custom programming going on on the site, including some custom Flash modules.

Executive Warfare

This is the site for Executive Warfare, a book by David F. D’Alessandro with Michele Owens. The basic layout of the site is very simple, as is the site architecture. The home page features some basic information about the book as well as a couple of sample articles. Pages contained on the site include a sample chapter, “10 Rules”, Reviews, an “About the Authors” page, and a video page.

The site also has a blog. The page templates are all the same, though the use of images and block quotes gives them each a unique look. Overall, it’s a great site that offers up its content in a way that is both aesthetically pleasing and practical.

Cubicle Ninjas

Cubicle Ninjas is a design firm offering up web design and development, graphic design and illustration services. The overall design is bold while still being simple. Their portfolio pages are some of the best I’ve seen, offering up embedded video on some pages in addition to images of individual projects. The Cforms2 plugin (which offers great customization options) is used for their “Request a Quote” page.

Camacho Cigars

This is the site of the Camacho Cigars company. The site architecture is completely un-blog-like. For example, the “Our Story” page contains subpages (“History of Camacho,” “Tobacco in Honduras,” and “Production Tour” linked with icons from the page itself. Other pages on the site include a page detailing their cigars, a “Where to Buy” page, a “Press Room” and a contact page. This is another site that does well by linking their social network profiles right from their home page.

Alpha Multimedia Solutions, Inc.

This is the online portfolio of Alpha Multimedia Solutions. The site’s design is simple and elegant, as is the architecture and navigation. The offer up case studies for their different clients and the pages for these use a slightly different template than their other pages. The use of slideshows for each project in the header also add to the overall look of the site very nicely.

Gaijin Film & Sound

Gaijin Film & Sound is a film, sound and new media production and consultancy company. Their home page offers up basic information about the company, including contact information in the sidebar, a list of services, and an abbreviated list of clients.

The top nav on the site is very effective and includes links to “About,” “Portfolio,” “Production,” and other pages. Their portfolio page is one of the nicest on the site, offering up links to videos within a very aesthetically pleasing layout.

Frisk Design

Frisk Design is a web design company. Their site makes great use of pages within WP for offering up information about the company, their services, portfolio, and contact. A blog is also included, though it’s not the focus of the site. The portfolio has a very elegant layout that offers up information about each site without having to click through to individual project pages.

Feedback Audio

Feedback Audio provides music production, film audio production, and live sound production services. The home page of the site offers up a great overview of the company, their services, and ongoing projects. It’s an elegant design that offers some great visual pop. The individual page templates are simple and the lack of a sidebar keeps this from looking anything like a blog.

Eye-Fi

Eye-Fi is a company that provides SD cards for digital cameras with built-in wifi for transferring photos to your computer. The site has an excellent layout that is at once visually interesting and easy to navigate. There’s no blog on the site, only pages that offer up information about the products, including where to buy and how they work. Overall, it’s an excellent example of a WP-powered site.

Earth911.com

Earth911.com is an environmental information site. The top navigation is one of the best I’ve seen, offering intelligent drop down menus that are only there when you want them to be. The overall site design is exceptional, simple while still be visually pleasing. Individual category pages are also beautifully designed, offering up basic information at the top along with articles related to the topic below. Overall, the site is one of the better designed portals I’ve seen powered by WP.

OriginOne

OriginOne is a clothing company that celebrates human oneness and connectedness. The site design is edgy and complex while still being very user-friendly and easy to navigate. The online store is powered by the Shopp plugin for WP. There’s no blog present on the site. Individual pages are kept simple, with the content as king. The shop itself is beautifully laid out and works well for a shop without a ton of products.

To subscribe to the "Guy WhoSteals" feed, click here.
Shamelessly stolen from: http://www.noupe.com/wordpress/25-unique-uses-of-wordpress-as-cms.html
You can add yourself to the GuyWhoSteals fanpage on Facebook or follow GuyWhoSteals on Twitter.