Category: WordPress

THIS ARTICLE IS OUT DATED. Please see: http://www.TheCodeCave.com/EasyWPUpdate for the current release.

Well I’ve upgraded the 35 Second upgrade script significantly for this release.

Here’s a summary of the new features:

1. Customizable options at the top of the script
2. Works for unlimited numbers of blogs with just updating the header
3. Optionally performs Web update steps as well
4. Optionally performs backups of all WP related files
5. DISABLED: Performs a Database Backup
6. Backups are to a directory of your choosing suffixed with “today’s” date
7. Can now upgrade blogs in a WordPress directory or any other
8. Respects the tmp directory on your server
9. Can be modified to perform nightly refresh of all blogs from a local tarball
10. Can be customized to retrieve beta releases
11. Can be customized to retrieve from WP.org’s archive folder

This hasn’t had a lot of testing yet outside of my blogs, but it has worked BEAUTIFULLY for me and as you can see I am running Version 2.0.6 thanks to spending 5 seconds this morning to update all of my blogs.

Here is the text to download: (link)

Perhaps the easiest way to get the file is to telnet into your account and run this line:
wget http://www.thecodecave.com/downloads/tcc_wp_upgrade

Then give yourself execute permissions on the script, choose your own or run this:
chmod +x tcc_wp_upgrade

If you get errors, remember that you might be dealing with passing the script through Windows and may have tacked on an extra CR at then end of each line… You should be able to fix that by using an SED command something like this
tr -d ‘\r’ tcc_wp_upgrade > xx && mv -f xx tcc_wp_upgrade
(Thanks to Prec on FreeNode #SED)

Then edit the file to your specifications using VI or whatever. I use NetDrive to make my website Drive X on all of my machines and then use Notepad2.exe to edit it and enforce the Unix line endings.

Right now I REALLY would like to have only proficient people run this script. It has only been tested on my sites.
This script messes with your files. If something really horrible goes wrong, you could lose information. I’ve done my best to ensure this doesn’t happen, but literally everything I know about bash I learned in the last month writing this script. A good programmer can go from any language to any language with relative ease (and bash IS a language), but we can’t know everything about how it works on all systems. That only comes with experience.

So I’ve got a bigggg scary message at the front of the script. It’s scarier than it needs to be, or I wouldn’t have the confidence to release the script at all. But it spells out in no uncertain terms the risks of running ANY unfamiliar script (not just mine) on your active site :

# Indemnity –
# Use this file at your own risk. I’m not going to deliberately hack
# your server, but others might. This is a shell script. Very bad
# things can happen. I am relatively new to *nix scripts. So
# I’ve had others review this script. But NONE of this guarantees
# things won’t go wrong or that this script is unchanged. Only
# use this script IF you’ve gotten it from TheCodeCave.com or another
# site you trust.
#
# THIS SCRIPT SHOULD BE USED AT YOUR OWN RISK. It can erase hours of
# hard work put into your site. Before using this script it is
# required that you review and understand every line and vouch for
# its safety. If you are not comfortable with this, don’t run this
# script. I have one host that I can test this on. Only you can say
# that this script will not do irreparable harm to your host if you
# use it.
#
# YOU are responsible for YOUR site. Learn how to protected it and
# understand what every line of code does before you call it.

When you run this script, please come back here and report your results.

Thanks!

Here’s the source for those that want to see it online:
Continue reading Upgrade your WordPress sites in 5 Seconds

WordPress 2.0.6 has been officially released (link) and you definately need to get this one. 2.0.6 was originally just a bunch of minor updates, but now includes several critical security patches. In fact, one of the core “make this information safe” filters that protects you from malicious abuse through the address used to reach your site has been replaced. More detail follows.

I’ve not yet finalized my list of 2.0.6 features, but for now you can review the 2.0.6 RC1 features listed here: (link)

Also, I’ve upgraded my “Update WP in 35 seconds” script. It was 6 lines, it’s now well over 300. And instead up upgrading in 35 seconds, I was able to upgrade 3 WP blogs in <5 seconds without a single browser seeing the site down. The script also will do a full file backup of your WP site into a dated directory (though not in 5 seconds). Pretty nifty. You can see it here: Upgrade your WordPress sites in 5 Seconds(link)

Mark Jaquith, who I will probably forever call Mark Jarquith in my mind because that’s how I first read his name, has announced the Release Candidate version of 2.0.6 on the WP-Testers list. I’ve detailed the contents 2.0.6 in this post. Chances are this release will be come before Christmas. So get your blogs ready for the update. Make sure your files and databases are backed up and you are ready to go… And be sure you are sporting your limited edition WordPress shirt as you do it! (Order now! Operators are standing by!)

digg story

THEN you need to get ready for the 2.1 release… and it’s a biggy. That will have to wait until after the holidays. If I had to wager, I would say it will be out in early January. When 2.0 was released at Christmas time last year, everyone had to scramble to get their translations and converted and since they had time off from work, the spent the holidays tweaking their sites. And that’s not nearly as much fun as doing it on company time! (JOKING!) So, I’ll include more on that later.

You can download the 2.0.6 RC if you want to take an early look at the release:
http://wordpress.org/beta/wordpress-2.0.6-RC1.zip

However, you should know that RC1 will NOT be the same as the final 2.0.6 release. There is a security fix that has been completely under wraps till now. It has only been reported to Security@wordpress.org and has not been reported by the security sites. Because of this, the security fix has not been added to the public betas. It is running on several private sites. Automattic did not want to give the bad boys of the web to attack sites that haven’t upgraded.

All-in-All, 2.0.6 is largely a stability release. The WordPress 2.0 series is now officially on its way to becoming part of the Debian Stable product and as a result, and as discussed in October, patches will continue to be released in 2.0 series for the next 3-5 years.

In this version, the fixes include (priority from highest to lowest):

Ticket	Summary
3215	Login & Update functions everything is broken
2987	+/- for bottom boxes on write page acts weird in FF
3267	PHP Error in template-functions-links.php
2681	Error on Inline Uploading after deleting page with attached file
3112	Upload bugs
3367	Single quote around double quote mysql string breaks on OpenVMS HP-PHP
3051	QuickTags now work in Safari browser
3391	Can’t click Labels for Radio Buttons in Moderation Queue
3438	Internationalization by mistake
1540	Date format returned by wp_get_archives is not localizable

Here are some finer details:

Continue reading WordPress 2.0.6 Content Summary – Release in days, WordPress 2.1 due Jan 2007

Summary

As the security risks in legacy versions of WordPress become more widely known, the hacking of sites that haven’t updated will become a more common event. Your site about pet rocks or the joys of train spotting may not be at the top of the attack lists, but you probably don’t want to loose everything you’ve ever written either.

Google searches can identify you as a vulnerable site and as simple defacements become boring, the deletion of posts and comments will become an east way to wrack up points on the hacker bragging lists and punish those “stupid enough” not to upgrade.

The danger of having your name on the “Vulnerable Sites” list will only increase.

The general WordPress user may not get a sense of urgency from the release announcements. So, this article will attempt to describe the danger in continuing to rely on old software and trusting it to keep your website safe.

Conclusion

I know… I know!

The conclusion is supposed to come at the end of the article. Yeah, but this message it too important to be at the end!

Here it is: If you are not running WordPress 2.0.5: upgrade today! Based on exploits already publish, available and used on the web, all of the work you’ve put into your blog could be lost.

Right now a large number of people have the knowledge to:
1. Erase any/all of your posts or comments.
2. Replace your admin password with one of their own choosing.
3. Replace files on your system including index.php.
4. Run commands against your database.
5. Grab any file with a known file name from your directory – even php files – even those with your database password.

In short, they have the ability to use your site to do whatever they want WITHOUT you having to click on anything. Now, most of these holes were closed with WordPress 2.0.3, but it still leaves some LARGE holes open even in 2.0.4. There is no reason not to upgrade to a more recent version right now.

If your convinced, great. Go out and download 2.0.5. If your not convinced, read on and these pages will hopefully scare the willies out of you and get you to upgrade!

[edit] Sep. 12 2006: 4pm EST: Updated with changes from discussion with Mark Jarquith. Four of these eleven were removed, but I think I will wait for a response from him before taking them off this list.[/edit]

You can download it here…
http://wordpress.org/beta/wordpress-2.0.6-beta1.zip

There aren’t too many changes for this release:

Ticket	Summary
1540	Date format returned by wp_get_archives is not localizable
3419	Multiple Authors for 1 article
3377	Atom feed contradicts itself
3391	Can’t click Labels for Radio Buttons in Moderation Queue
2681	Error on Inline Uploading after deleting page with attached file
3112	Upload bugs
3367	Single quote around double quote mysql string breaks on OpenVMS HP-PHP
3375	delay between ping
3390	Better get_page_uri
3415	Update “no wp-config.php” help link
3267	PHP Error in template-functions-links.php
3215	Login & Update functions everything is broken

Here are the details:
Ticket #3215 Login & Update functions everything is broken – PHP can talk to the server in different languages. On servers using the “Fast CGI” language, an error 500 was received when reaching administration pages. The code was rewritten to have special handling for Fast CGI servers.
Ticket #3267 – PHP Error in template-functions-links.php – The error “PHP Fatal error: Call to a member function get_feed_permastruct() on a non-object ” would crop up in server logs. Correcting the order in which parts of memory were freed has solved the problem.
Ticket #3415 Update “no wp-config.php” help link – The page this error linked to no longer existed on WordPress.Org. The link has been fixed.
Ticket #3390 Better get_page_uri – This is mainly an optimization for pages that display complete page heirarchies / navigation menus. The DB is accessed once rather than many times.
Ticket #3375 delay between ping – NO CHANGE MADE. IGNORE.
Ticket #3367 Single quote around double quote mysql string breaks on OpenVMS HP-PHP – When programing in PHP some systems allow strings like this: ‘This is a quote “Yahoo”.’ However that will not run on some implementations. This ticked essentially changed the format to something like this “This is a quote ‘Yahoo’.”
Ticket #3112 Upload bugs – If you uploaded an image to an empty post, an error would be generated. This fix enables empty post to accept uploads.
Ticket #2681 Error on Inline Uploading after deleting page with attached file – If an attachment existed that referred to a page that was deleted, an error occured when uploading the next attachment. This has been fixed.
Ticket #3391 Can’t click Labels for Radio Buttons in Moderation Queue – You had to click on the buttons instead of the labels for the buttons. This is non-standard behaviour and has been corrected.
Ticket #3377 Atom feed contradicts itself – NO CHANGE WAS MADE. IGNORE THIS.
Ticket #1540 Date format returned by wp_get_archives is not localizable – The format of the date returned in the text of this funciton was hard coded to “Month Year”. Now it depends upon your localized configuration.
(Check here for the latest updates http://trac.wordpress.org/milestone/2.0.6)

There are two tickets that remain open that may or may not be included with this release. These are:
#3370 was reported by one user, and we haven’t been able to recreate
the bug or diagnose what’s causing it on his install. That’s still
2.0.6 Milestone in case someone stumbles on the cause… and a fix in
the next day or two. But since it’s just one person, it’s low priority.

#2987 was added to the 2.0.6 Milestone after 2.0.6 Beta 1 went out,
by a Trac user. I’ll test the patch now and see if it works as
intended for 2.0.6 and will either put it in, or push it off for 2.0.7

A final security fix will be implemented in this release. It is a reportedly “minor” security issue. I have no further details at this point.

All in all, these fixes make WordPress compatible with a wider range of hosts. Basicaly, this is a VITAL release if you are having errors with your current version of WordPress. If you aren’t receiving errors, you will not consider this release quite as vital.

Well, you can monitor it yourself. There’s no date yet, but there are some 600+ “tickets” to change involved. You can see that here: http://trac.wordpress.org/milestone/2.1

Now, once the process gets a bit further along, you can check the status at that site. Here, take a look at how it was done for 2.0.5: http://trac.wordpress.org/milestone/2.0.5

Notice that http://trac.wordpress.org/milestone/2.0.6 does not exist! 2.0.5 SHOULD be the last release for the 2.0 line. I suspect that whether that is true or not will depend upon if a security issue is found.

So, what does 2.1 look like? Well, I’ve got it running on a testing site. You can do the same as it’s available to those who are testers:
http://wordpress.org/download/beta/

And those hackers who want to check out the nightly builds of the product:
http://wordpress.org/download/nightly/

There’s no quiz you must take to join. As no support is offered for any of the pre-release products, the only test is how fast you can dig yourself out of a hole when a feature you rely on doesn’t work in the current build. It’s sort of a pass fail thing….

WordPress 2.0.5 includes some 60 bugfixes and improvements that I link to here. That should be reason enough for any geek to switch to the latest version. If you are not a geek, and perhaps you haven’t upgraded even to version 2.0.3 yet. You need to. It is VERY important to the safety of your blog. If you started your blog on version 2.0 or higher, you will also get a marked speed improvement out of your site.

Top 5 Reasons to upgrade
1. Integrity: If you aren’t running version 2.0.4 or higher, there are easy methods to delete posts and comments from your blog that are not traceable back to the person that did it. All your work could be easily if someone got the whim to do so.
2. Speed: If you are running versions 2.0-2.0.4 and always were, than you are missing a key index. This missing index tells your blog where to find posts and pages. As you can guess, it is good for that to work quickly. Read more here in the ticket I logged when I found the issue.
3. Security: Improved security in wp-db-backup plugin. Sneaky people could use older versions of the get to places that they shouldn’t be
4. Privacy: User info snooping was possible. Any user could see any other users contact info, private not. Spammers must love that “feature”.
5. All of the above and much more: You choose…. I’ll leave this one up to you… You might wish to choose from one of Mark Jarquith‘s favorites. He seems to be a pretty good guy and has listed his top choices here. Or you could choose from any of the items listed on the official tracking site, here. That link will list the most important fixes first.

If you’re still not convinced, you should read this article (not yet published).

If you think that it takes too long to upgrade, consider using my Upgrade your sites to the latest WordPress in 35 seconds. method and you’ll never have to worry about a lengthy update again! That’s how I updated The CodeCave.

And “Why is it called Ronan?” you ask… Well, it’s named after the very first WordPress Baby! Ryan Boren is Ronan’s proud father. Pictures are available on Ryan’s site.

Update: Mark has posted a list of just the files that have changed. If you don’t use the script I mentioned above, you could look into his file which gives you a smaller set of files to update. You can find that here: http://markjaquith.wordpress.com/2006/10/28/wordpress-205-upgrade-changed-files-zip-changes-diff-changed-files-list

Update2: IF you are one of the few with the 302/500 error please visit this site:

Some WordPress 2.0.5 users reporting Server 500 error

If you have no idea what I am talking about, you are in the VAST majority and can thank your lucky stars 🙂