Category Archives: WordPress News

News regarding WP and its community

WordPress 3.2 Gershwin Released

Posted on by
Reply

While most of the United States was barbequing and lighting fireworks, the WordPress team was hard at work getting the final release for 3.2 out the door. It’s not available for download. Of notable features, a full screen mode for writing posts, as well as a newly designed admin interface. As someone who’s been using WordPress since the 1.2 days, I’ve seen every evolution possible, and this one is growing on me. The “big” header is gone, which is the hardest part to get used to. Certainly frees up more room on the screen for actually doing stuff.

Another major note is the change in minimum requirements to run WordPress. Your server now needs to be running PHP 5.2 or greater, and MySQL 5.0 or higher. While making this change, some refactoring under the hood was done to make the admin lighter and faster.

I haven’t had the opportunity to fully explore these changes, but the cursory feedback I’m hearing, it was mission accomplished.

To read the full notes on the release, check the official WordPress 3.2 release announcement.

WordPress Security Releases – 3.0.2 & 3.0.3

Posted on by
Reply

In case you’ve been under a rock the last couple of weeks, two security releases have been issued for WordPress, 3.0.2 and a week later, 3.0.3. I (kinda) jokingly explained to my coworkers that these security releases were less “someone left the front door open”, rather, “someone left a small window upstairs open that only the neighbors can see”. Needless to say these are legitimate security issues in some environments, as well as a couple of bug fixes, and all sites should apply them. The 3.0.3 release is specific to sites that enable the XML-RPC, remote publishing option.

What was most impressive is that the the first and larger security release was pushed out 4, yes, four, hours from when the core developers were made aware of the exploit. For a bunch of volunteers spread across multiple time zones, that’s impressive.

Crowd Sourcing Plugin Compatibility

Posted on by
Reply

Mark Jaquith posted on the WordPress blog about a new feature on wordpress.org, plugin compatibility a couple of days ago. The idea behind it is simple, let the community give feedback on whether or not the latest version of a plugin works with the latest stable release of WordPress. Mark points out that the number one reason people don’t upgrade is because of plugin compatibility. Considered one of WordPress’s greatest assests, it also can be it’s greatest drawback. Sure, you can extend your site to do all kinds of amazing things, but what happens when that awesome plugin lingers without updates, while WordPress releases a couple times a year? Eventually, something is going to break.

Since WordPress has made the decision that security means staying up to date with the latest release, that becomes a greater issue as time goes by. Potentially, this data will give developers insight into what is breaking popular plugins, so they can either address that in the code, or (purely speculation on my part) adopt the plugin and bring it up to date.

My only concern with the data is that I think most people will tend to find plugins that are broken, and then report that, rather than think, “hey, I should go through my three hundred plugins and go report that they are working fine with the latest release.” The article does mention that eventually they’d like users to be able to report directly from the plugin page, but then that opens the whole “phone home” can of worms.

From a site developer stand point, I think the whole thing should drive home the point of trying to use the core tools as much as possible, and not relying on as many plugins to develop a site. Certainly there are ones you can’t get away from for certain projects, but often times, people will employ a plugin for convenience, which will later bite them on the behind when that plugin breaks an upgrade.

WordPress Security

Posted on by
Reply

As I’ve ventured back into doing a lot of WordPress development these days, and will be taking on a housekeeper type role for a company that manages hundreds of WP sites, I figure as I begin to more closely follow WP development, I figured it would be a good time to resurrect this site.

On that note, I found that there’s been quite a bit of buzz this weekend about some new found exploits in out of date installations. One in particular it seems manages to create a hidden admin account. Hidden in the sense that when you look at your list of users, you won’t actually see the account. From what I’ve read, part of the genuine pain that this exploit causes users is that even after updating to the latest version, the exploited account will still exist and potentially still wreak havoc.

If you haven’t caught the link from the dashboard (or if like a lot of people, you change/disable the planet feed), Dougal Campbell has provided a SQL query to check for all users who have administer privileges.

As I follow up on these exploits, I may post more information, but in the meantime, if you aren’t running the latest version, I highly recommend taking the time to dust off your backup notes and tackle the sometimes easy, sometimes PITA task of upgrading your site(s).

WordPress 2.6.5 in detail

Posted on by
1

westi on wordpress

WordPress 2.6.5 has been released, addressing a few small bugs, and a few fringe security issues it seems. At first glance, I thought this was an odd thing, considering 2.7 is around the corner, but after a little thought, it makes sense. One, a security issue was found and fixed, and two, some people (this author for one) dislikes immediately upgrading to the latest and greatest release, so having a secure (as possible) 2.6.x release with a few nagging bugs taken out allows for sites to wait, test out, and take their time to upgrade to the 2.7 release.

WordPress 2.7 b2 Now out

Posted on by
Reply

WordPress › Blog.

A slew of fixes since b1 are in this release, perhaps too many, suggesting to me that it went beta too quickly, though I’ve never quite grasped beta/alpha/release candidate structures. Every project seems to have their own ideas.

I’ve not tested 2.7 myself, but the comments on twitter and via a few feeds have been positive, what are your impressions?

Interesting…

Posted on by
Reply

While reading up on the upcoming changes in WP 2.7,I came across an article aboutThe New 2.7 Dashboard. Tucked towards the bottom was this little ditty:

rather than including something rushed and clunky, we’re holding off until a later version

They were speaking of some “inbox” feature that was temporarily in trunk, but has been removed. I must say, that’s one of the first times I’ve seen that acknowledgment in WordPress development, and more often than naught, it has been the contrary. New features have been thrown in at the last minute, and result in confusion by users, too many bugs to count, and dissatisfaction by long time users. It’s nice to see the prudent approach being taken for a change, particularly in a release that seems to already have quite a bit of change included.

Think You’ve Got the Coolest Blog?

Posted on by
Reply

WP Freedom Blog is sponsoring a contest to find the “coolest blogs”. First prize includes $500 cash (via paypal) and $500 in services. 2nd place half that, and 3rd $250 total cash and prizes.

Winners will be selected by voting, after a selection by the host blog of the eligible entrants. To get rules and specifics visit the hosting site, or go visit one of the cooler blogs I subscribe to , Deziner Folio.

WordPress 2.6.3

Posted on by
1

A vulnerability in the Snoopy library was announced today. WordPress uses Snoopy to fetch the feeds shown in the Dashboard. Although this seems to be a low risk vulnerability for WordPress users, we wanted to get an update out immediately.

WordPress › Blog » WordPress 2.6.3.

Not sure what “low risk” really means, but I never recommend skipping security releases. The official post goes on to provide the affected file, so a full upgrade isn’t necessary, which is nice. Not sure I’ve seen that done in a long time. Guess it’s a case of 2.7 being close, and no desire to roll any other bug fixes in with this release. And because of that, it would seem that doing this upgrade is a no brainer.