Unfortunately, I missed some places when fixing the privilege escalation issues for 2.8.1.  Luckily, the entire WordPress community has our backs.  Several folks in the community dug deeper and discovered areas that were overlooked.  With their help, the remaining issues are fixed in 2.8.3.  Since this is a security release, upgrading is highly recommended.  Download 2.8.3, or upgrade automatically from your admin.

Technorati Tags: 2.8.3, release, Wordpress, wordpress release

Earlier this month, over 3500 of you responded to our survey asking you to help us prioritize some of the media features that had been suggested for the 2.9 release. While the exact features for 2.9 have not been hammered out yet, as we continue to match up developers with features, we wanted to share the survey results and let you know what we’re thinking in terms of approach.

First, the results. The first question, and the only one that was mandatory, asked what single media feature you would choose to include in version 2.9. The top vote-getter was standalone editable photo albums (as opposed to the current per-post gallery) at 17.5%, followed closely by easier embeds for videos and other third-party content at 16.5%. Next came basic image editing (such as rotating, cropping and resizing) at 13.7%, and post thumbnails (image teasers for posts featured on the home page) at 12.9%. The rest of the features each took less than ten percent of the vote. The full list came in like this:

The second question was optional (3406 people answered it), and asked you to rate each feature on a scale going from top priority down to definitely not for implementation priority. Results here were in line with the results from the first question, with most features rated as nice to have more often than anything else. The features that scored the highest in question 1 were more likely to have earned higher votes in the Top Priority column, but no feature was ranked as a Top Priority more often than it was ranked as a Nice to Have (though Media Albums, Easier Embeds and Post Thumbnails came close). The complete tabulations are shown in the chart below.

Question three was getting at the same thing, but in a more granular fashion, asking you to rank the eleven features in order of priority to you. As only one feature could be assigned to each position, this prevented people from assigning the same priority to multiple features, and we wondered if it would alter the results. Though some features got more recognition in this question, the overall rankings were still in line with the results from question 1. Here are the exact votes per feature/per position:

The fourth question asked for your preferences regarding including new media features in core, bundling them as plugins with the core download, or developing them as plugins but not bundling them with the core download. This vote was more interesting to watch. As the notice for the voting went first to the development community, then to the user community, it was possible to see a shift in the voting. Earlier in the voting cycle, there were more votes for bundling ‘core plugins’ for the advanced media features, while later votes skewed heavily toward just putting the features in core. This vote shows, I think, one of the differences between developer and user perspectives. While developers are heavily interested in keeping the core code lean and relying on plugins for advanced functionality, many users would prefer features they want to be included in core rather than being a separate plugin. The final tally on this question was 56.2% for including features in core, 38.1% for bundled plugins, and 5.7% for non-bundled plugins. The actual numbers:

Clearly this issue deserves more discussion, and the concept of how we move toward a system of canonical plugins and/or core “packages” intended for different use cases (CMS, photoblog, portfolio, etc) will be a big topic in the months ahead.

So where does that leave us regarding features coming down the road? When the vote closed, the results were discussed in the #wordpress-dev IRC chat to divvy up feature development.

The top-voted feature, standalone photo albums, is being worked on as a Google Summer of Code project by Rudolf Lai, under the mentorship of WordPress Lead Developer Mark Jaquith. The “pencils down” date for GSOC is in less than two weeks, at which point we’ll be assessing the state of Rudolf’s project. Hopefully, we’ll be able to incorporate it with 2.9 development, do some testing, amend the code and/or UI as needed, and have this launch with the 2.9 release (in core or as plugin TBD). Undoubtedly, additional functionality will be contributed by core contributors who have also been working on media plugins.

Easier embeds, the second most popular feature, is being looked at in a couple of ways. One, more shortcodes for third-party services. Work on this has already begun. In addition, Viper007Bond, of Viper’s Video Quicktags plugin fame, has taken on the task of working on a way to improve the embed experience in core. We’re not sure quite how this will work yet, but stay tuned.

Adding some basic editing functions like 90-degree rotation, cropping and resizing was considered an obvious winner in the dev chat, and as several plugins handle this functionality, we’re hopeful it will be included soon.

Post thumbnails are being handled by Mark Jaquith, who has created this functionality before, with an assist from Scribu, who has a similar plugin in the repository.

Lower ranked features aren’t off the radar, but may take lower priority than some other (non-media) features we have in the works. One of my favorite 2.9 features is in trunk now, and changes the way we delete content. Goodbye, annoying popup asking me if I’m sure I want to delete a comment/post/etc. Hello, fast and quiet removal into a trash can, from which the content can be retrieved if it was deleted by accident. Think Gmail style. We’re also hoping to work on improving page management, though that has a number of technical issues that may cause it to be a 3.0 feature instead.

As always, you can keep track of development progress in a number of ways:
1. Keep track of Trac. Contribute a patch, test a patch, just read through tickets if you have some time to kill, whatever. There are over 500 tickets against the 2.9 milestone currently. Patches and testing can help us get that number down.

2. Follow Trac commits on Twitter. Don’t want to get involved in the nitty gritty, just want to see what’s getting committed? Follow wpdevel on Twitter and you’ll get core commit updates in your stream.

3. See what’s on the dev agenda. Each week for the IRC dev chat, there’s an agenda, created based on developer suggestions posted at wpdevel.wordpress.com. This blog also contains discussions about specific development issues.

4. Join the dev chat. The day changed this week, to accommodate European schedules. Chats are now held for one hour each week on Thursday at 21:00 UTC. That’s 5pm NYC, 2pm in California, etc. Chats are in the #wordpress-dev room at irc.freenode.com.

5. Watch this blog. If you’re not a developer and prefer to stick to major announcements, the occasional survey to help decide a feature, and security notices, just keep doing what you’re doing. Reading this blog will get you all of these things.

Thanks again for your help in prioritizing features for version 2.9, hopefully coming toward the end of the year to a server near you!

Technorati Tags: 2.9, release, Wordpress, wordpress release

WordPress 2.8.2 fixes an XSS vulnerability. Comment author URLs were not fully sanitized when displayed in the admin. This could be exploited to redirect you away from the admin to another site.

Download 2.8.2 or automatically upgrade from the Admin page:

Tools > Upgrade page of your blog’s admin.

Technorati Tags: 2.8.2, release, Wordpress, wordpress release

WordPress 2.8.1 fixes many bugs and tightens security for plugin administration pages. Core Security Technologies notified us that admin pages added by certain plugins could be viewed by unprivileged users, resulting in information being leaked. Not all plugins are vulnerable to this problem, but we advise upgrading to 2.8.1 to be safe.

What else is new since 2.8?

Read through the highlights below, or  view all changes since 2.8

• Certain themes were calling get_categories() in such a way that it would fail in 2.8. 2.8.1 works around this so these themes won’t have to change.
• Dashboard memory usage is reduced.  Some people were running out of memory when loading the dashboard, resulting in an incomplete page.
• The automatic upgrade no longer accidentally deletes files when cleaning up from a failed upgrade.
• A problem where the rich text editor wasn’t being loaded due to compression issues has been worked around.
• Extra security has been put in place to better protect you from plugins that do not do explicit permission checks.
• Translation of role names fixed.
• wp_page_menu() defaults to sorting by the user specified menu order rather than the page title.
• Upload error messages are now correctly reported.
• Autosave error experienced by some IE users is fixed.
• Styling glitch in the plugin editor fixed.
• SSH2 filesystem requirements updated.
• Switched back to curl as the default transport.
• Updated the translation library to avoid a problem with mbstring.func_overload.
• Stricter inline style sanitization.
• Stricter menu security.
• Disabled code highlighting due to browser incompatibilities.

RTL layout fixes.

Technorati Tags: 2.8.1, bug fix, release, Wordpress, wordpress release

I’m very excited to announce to everyone that the latest and greatest version of WordPress, version 2.8 “Baker,” is immediately available for download. 2.8 represents a nice fit and finish release for WordPress with improvements to themes, widgets, taxonomies, and overall speed. We also fixed over 790 bugs. This release is named in honor of noted trumpeter and vocalist Chet Baker. Here’s a quick video overview of everything in the new release:

The first thing you’ll notice is that visually 2.8 feels a lot like 2.7, just with some minor tweaks here and there. However once you’ll dig in you’ll begin to appreciate the changes.

Major New Improvements

First and foremost, 2.8 is way faster to use. We’ve changed the way WordPress does style and scripting.

The core and plugin updaters in previous versions of WordPress have been such a success we decided to bring the same to themes. You can now browse the entire theme directory and install a theme with one click from the comfort of your WordPress dashboard.

If you make edits or tweaks to themes or plugins from your dashboard, you’ll appreciate the new CodePress editor which gives syntax highlighting to the previously-plain editor. Also there is now contextual documentation for the functions in the file you’re editing linked right below the editor.

If you were ever frustrated with widgets before, this release should be your savior. We’ve completely redesigned the widgets interface (which we didn’t have time to in 2.7) to allow you to do things like edit widgets on the fly, have multiple copies of the same widget, drag and drop widgets between sidebars, and save inactive widgets so you don’t lose all their settings. Developers now have access to a much cleaner and robust API for creating widgets as well.

Finally you should explore the new Screen Options on every page. It’s the tab in the top right. Now, for example, if you have a wide monitor you could set up your dashboard to have four columns of widgets instead of the two it has by default. On other pages you can change how many items show per page.

And Even More

You can read the full list of over 180 new features, changes, upgrades, and improvements on the Codex. The list is exhausting!

The Future

We’re already thinking hard about the next versions, 2.9 and 3.0. Keep an eye out for improved media handling, better dependency checking, versioning of templates and themes, and of course the fabled merging of WordPress and MU announced at WordCamp San Francisco two weeks ago.

Technorati Tags: 2.8, bug fix, release, Wordpress, wordpress release

What if there was software with the elegance and extensibility of WordPress but all the features you’ve come to expect from social networks like Facebook? Now there is: check out BuddyPress.

BuddyPress is an official sister project of WordPress. The idea behind it was to see what would happen to the web if it was as easy for anyone to create a social network as it is to create a blog today. There’s been an explosion of social activity on the web, it’s probably the most important trend of the past few years, but there’s been a dearth of Open Source tools that enable the social web.

In WordPress we have a robust and extensible base that can scale to many millions of users, and BuddyPress is essentially a set of plugins on top of WordPress that add private messaging, profiles, friends, groups, activity streams, and everything else you’ve come to expect from your favorite social network, like a Facebook-in-a-box.

I don’t think BuddyPress will be something you use instead of your existing social networks, I mean all your friends are already on Myspace, but if you wanted to start something new maybe with more control, friendlier terms of service, or just something customized and tweaked to fit exactly into your existing site, then BuddyPress is a great framework to use. Maybe even someday you’ll be able to connect your BuddyPresses to each other and to the existing monolithic social networks.

This is just a 1.0 release and it’s not for everybody yet, for example it currently requires using MU which is a bit trickier to get set up than regular WordPress, but regardless I’d recommend diving into the community at BuddyPress.org, which is great example of the software in action.

• Here’s Andy’s official announcement post.

Technorati Tags: BuddyPress, release, Wordpress, wordpress release

One of the biggest problems and most frequent complaints we’ve had with the WordPress.org Plugins Directory is the horrible, horrible search results.

No longer.  We’re now using Sphinx (a “free open-source SQL full-text search engine”) to power search on the Plugins Directory both from the website and from within your blog’s admin (Plugins → Add New).

It works much better. There are a few oddities floating around (our fault not sphinx’s) that we’ll be cleaning up shortly, but we’re happy enough with it on the whole to start letting everyone else use it.

Currently, the search only indexes the plugin’s title and description/installation/FAQ/etc. (from the plugin’s readme.txt file), but we’ll be adding things like authors and tags soon.

Technorati Tags: plugins, release, Wordpress

2.7.1, the first 2.7 maintenance release, is now available.  2.7.1 fixes 68 tickets.  You can automatically upgrade from 2.7 to 2.7.1 via the Tools → Upgrade menu, or you can download the package and upgrade manually.

You may have noticed that we went much longer than usual to release this .1 update. We’re very proud of this fact because it’s a testament to the testing all of you contributed prior to the release of 2.7 which helped make it the most bug-free release we’ve had.

Consult the list of fixed tickets and the  full set of changes between 2.7 and 2.7.1 for details.

Finally partly due to the stability of the 2.7 we’ve decided to push back 2.8 a few more weeks so we can bring in a few more speed optimizations, taxonomy enhancements, and new theme features. We also need to figure out which jazz musician to name the release after.

Technorati Tags: 2.7.1, release, Wordpress, wordpress release