FlishFun.com

Updated to WordPress 2.6.2… seems there’s a big issue with previous versions:

Stefan Esser recently warned developers of the dangers of SQL Column Truncation and the weakness of mt_rand().  With his help we worked around these problems and are now releasing WordPress 2.6.2.  If you allow open registration on your blog, you should definitely upgrade.  With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another user’s password to a randomly generated password.  The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit.  However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password.  Stefan Esser will release details of the complete attack shortly.  The attack is difficult to accomplish,  but its mere possibility means we recommend upgrading to 2.6.2.

Other PHP apps are susceptible to this class of attack.  To protect all of your apps, grab the latest version of Suhosin.  If you’ve already updated Suhosin, your existing WordPress install is already protected from the full exploit.  You should still upgrade to 2.6.2 if you allow open user registration so as to prevent the possibility of passwords being randomized.

Go download now!

Better late than never!  WordPress 2.6.1 came out two weeks ago, but it wasn’t a major release (more of a “if you’re having issues, upgrade, otherwise you don’t have to” release).

So far, so good as always!  I can’t wait for WordPress 2.7 (there seem to be some major changes in the works)… if they’re shooting for a November release, we can start expecting Betas soon!

WordPress 2.6 “Tyner” is now available… read here.  I’ve had nothing but goodness from the betas and release candidate, so great job to those who worked on this release!!

Here’s a quick look at the changes between v2.5 and 2.6:

• Word count! Never guess how many words are in your post anymore.
• Image captions, so you can add sweet captions like Political Ticker does under your images.
• Bulk management of plugins.
• A completely revamped image control to allow for easier inserting, floating, and resizing. It’s now fully integrated with the WYSIWYG.
• Drag-and-drop reordering of Galleries.
• Plugin update notification bubble.
• Customizable default avatars.
• You can now upload media when in full-screen mode.
• Remote publishing via XML-RPC and APP is now secure (off) by default, but you can turn it on easily through the options screen.
• Full SSL support in the core, and the ability to force SSL for security.
• You can now have many thousands of pages or categories with no interface issues.
• Ability to move your wp-config file and wp-content directories to a custom location, for “clean” SVN checkouts.
• Select a range of checkboxes with “shift-click.”
• You can toggle between the Flash uploader and the classic one.
• A number of proactive security enhancements, including cookies and database interactions.
• Stronger better faster versions of TinyMCE, jQuery, and jQuery UI.
• Version 2.6 fixes approximately 194 bugs.

Awesome!  I’ve already updated and all looks good!

I’ve just updated my blog to WordPress 2.6 RC1… getting close to final now (according to them, it may be out today, actually)!  I missed the update over the weekend, but that’s just as well as my site was being transferred to a new server.  Can you see any difference?  It’s all shiny and new!  Anyway, for those wanting details on the new WordPress, check it:

WordPress 2.6 Release Candidate 1 is now available. We think this is ready for release on Monday.  Try out RC1 and tell us if you agree.  New since Beta 3:

• Media uploader and gallery improvements
• Image caption and image editing fixes
• Press This fixes
• Ability to toggle between the flash uploader and a regular browser uploader
• Notification bubble on the Plugins menu when plugin updates are available

See the full list of changes since Beta 3.

Get RC1.

The other updates to the site is my addition of a plugin to show my current Twitter posts (see it on the sidebar).  I may tweak the design somewhat to make it look better, but it’s okay for now.

That’s it regarding my site for today… I know I haven’t been updating it as much as I’d like, but I’ve been busy lately.  You can always check my Swurl account for other things I’ve been up to on the web!