Suggest Agenda Items for Apr 15th 2010 D…

Welcome!

The WordPress coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. development team builds WordPress! Follow this site for general updates, status reports, and the occasional code debate. There’s lots of ways to contribute:

Found a bugbug A bug is an error or unexpected result. Performance improvements, code optimization, and are considered enhancements, not defects. After feature freeze, only bugs are dealt with, with regressions (adverse changes from the previous version) being the highest priority.? Create a ticket in the bug tracker.
Want to contribute? Get started quickly with tickets marked as good first bugs for new contributors or join a bug scrub. There’s more on the reports page, like patches needing testing, and on feature projects page.
Other questions? Here is a detailed handbook for contributors, complete with tutorials.

dyerware 4:01 pm on April 10, 2010

Can you folks talk about this:
https://wordpress.org/support/topic/386304?replies=1

A security vulnerability is being exploited in 2.9.2 that can be closed with some wp installation changes. It would be nice if a 2.9.3 or 3.0 would address these. This hack goes oafter the SQL account, and does not attack the site (so clean installs do nothing)
- Peter Westwood 9:19 pm on April 11, 2010
  
  Reading through the posts there it looks like the issue is once people already have access to the server.
  
  If you have evidence of a secruity issue with 2.9.2 then please report using the normal channels – https://codex.wordpress.org/Security_FAQ
  - Alex M. 11:54 pm on April 11, 2010
    
    Yes, this isn’t a WordPress issue from everything I’ve heard on the matter.
- Joseph Scott 6:20 pm on April 12, 2010
  
  Just to follow up, this was an issue with file permissions of wp-config.php – http://blog.networksolutions.com/2010/alert-wordpress-blog-network-solutions/
- miqrogroove 7:24 pm on April 12, 2010
  
  I agree with Westi. I’ve been following that thread and there has been no mention of a WordPress vulnerability. The reports so far indicate a poorly-managed server environment or incorrect file system defaults. If some genius thinks of a way to test for that env/conf issue, I will fully support including such a test in the installer or health check pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party.
  - Peter Westwood 8:08 pm on April 12, 2010
    
    I’ve been thinking about what kind of check we could put into health check.
    Maybe a permissions check on wp-config.php to make sure it isn’t too lose
    Of course that doesn’t handle a poorly-managed server environment though.
  - Ron 2:20 pm on April 13, 2010
    
    Peter, I couldn’t reply to your comment due to the threading limit. That’s a fantastic suggestion.
  - miqrogroove 4:14 pm on April 14, 2010
    
    I’m just not aware of any interface to check for public read/script source access from PHPPHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 5.6.20 or higher. My intuition tells me this is a hostmaster responsibility, and that any method of making a database connection without knowing the webmaster credentials is beyond the control of any PHP script.
  - Andrew Nacin 6:13 pm on April 14, 2010
    
    fileperms() can be used. I think that’s fine for the health check to throw a flag for certain permissions. Of course, this is 100% a hosting configuration issue that is highly dependent on the setup.
dyerware 7:39 pm on April 12, 2010

Well groove, Im no genius, but the recommendation was to just have the wp-config.php file set to 640 and be done with it (nothign fancy). I was not aware this would stop some wordpress installations from working. It seemed a lightweight, simple change.

I would suggest though that during an upgrade, make sure the script preserves the file permissions of wp-config.php (probably that way now)

Otherwise forget it, I was just trying to help out because a lot of folks were hit and clean installs did not work. A lot of frustration from the users (Im just a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party dev, so I don’t see things from the host/provider view like you folks do).

Anyway, keep up the good work , we still love you 🙂
- miqrogroove 1:05 pm on April 16, 2010
  
  Just to help paint this into a corner: It’s unlikely that chmodChmod Chmod stands for “CHange MODe” and it is a command for Unix systems (Linux, Mac, ...) to manage permission/authorization over files and folders of a user.(640) would prevent malicious access to a file much more than chmod(644). A server so poorly configured could just as easily offer Group access to whoever is logged in. There’s also very little chance that chmod would work on non-linux servers. As I pointed out in my last comment, there’s also no way to test the effect of permissions for anyone other than the current user of PHPPHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 5.6.20 or higher.
Marko Heijnen 9:26 am on April 15, 2010
I do have some questions about the custom menu:
- The new template is using the function: wp_nav_menu. Is it possible to add an list item trough the function for like an home button. Or do you still need to use wp_list_pages for that or create an custom menu.
- When you create an new page or even post is there going to be a possibility to add it to the menu directly

Comments are closed.

Welcome!

Communication

Share this: