Wordpress 1.2.1

Michael Dale

This release of Wordpress is principally a bug fix and security release. This version fixes the problems talked about here (http://blog.dalegroup.net/archive/blog/newsid/149) and also a few other problems. The full run down can be found here:
http://wordpress.org/development/2004/10/wp-121/

It is highly recommended that you upgrade to this version asap.

[quote]Upgrading from 1.2 is very easy. Your existing templates and plugins should work just fine; all you need to do is overwrite the wp-* files and folders. To upgrade:

1. Download 1.2.1
2. Unzip
3. Upload the new files to your site, taking care not to overwrite anything you may have modified like index.php
[/quote]

To download the latest version see this link: http://wordpress.org/download/

XSS Security Holes in WordPress

Michael Dale

Security vulnerabilities have been found in WordPress that allows users to enter code into the site through certain urls (whose content is not checked).

Examples:
http://[victim]/wp-login.php?redirect_to=[code]
http://[victim]/wp-login.php?mode=bookmarklet&text=[code]
http://[victim]/wp-login.php?mode=bookmarklet&popupurl=[code]
http://[victim]/wp-login.php?mode=bookmarklet&popuptitle=[code]
http://[victim]/admin-header.php?redirect=1&redirect_url=%22;[code]//
http://[victim]/bookmarklet.php?popuptitle=[code]
http://[victim]/bookmarklet.php?popupurl=[code]]
http://[victim]/bookmarklet.php?content=[code]
http://[victim]/bookmarklet.php?post_title=[code]
http://[victim]/categories.php?action=edit&cat_ID=[code]
http://[victim]/edit.php?s=[code]
http://[victim]/edit-comments.php?s=[code]
http://[victim]/edit-comments.php?mode=[code]

XSS (cross-site scripting) holes are common in many php scripts and Wordpress isn't the only effected blogging tool. LiveJournal and Blogger are also vulnerable.

Athlough this is a somewhat large security issue wordpress users shouldn't be too worried, all scripts have bugs.

The Wordpress team are working on a 1.2.1 release to fix these issues. So look out for it.

Related links:
http://wordpress.org/support/4/13818
http://wordpress.org/support/7/13856
http://news.netcraft.com/archives/2004/09/30/security_holes_in_wordpress_blogging_tool.html
http://secunia.com/advisories/12683/

Wordpress now has a bit of dale in it.

Michael Dale

I'm one for gloating, so I thought I'd try and raise ye old ego a bit more (as you do ;)). Anyway as you may (or probably may not) know I hacked apart wordpress to leach some of its sending trackback function and found a very small bug. The bug being if you ran wordpress on a non standard port (i.e anything other than 80) then people would be unable to send a trackback to that site. Wordpress ignored the fact that someone may have enter a port number into the trackback url. Only a small bug.
So I emailed the good matt ( http://www.photomatt.net ) about the problem and included a fix for it. Less than 24 hours later wordpress is patched and the latest nightly build includes this small fix.

It's just cool that anyone can help add/fix things to open source software. So praise open source (and wordpress for being so).

w00t

/end ego boosting post ;)

no I'll never like wordpress, shutup! :S

Complete backend update

Michael Dale

I've done a complete update of the backend of my website today. Every piece of text you now see on this website is coming
to you live from my database! ;) It's very cool. Something I've been wanting to do for a while. Currently I haven't rewritten an admin panel
although it is in the works as we speak. Very cool. Also got some maths done today. hehe nice.