Source: http://lesterchan.net/wordpress/?p=236 Wishing all my WordPress plugins users a Merry Christmas 2008! Hope you all got the Christmas presents you wanted!

Here are some of the features according to the blog post:

Next you’ll begin to notice the new features subtly sprinkled through the new interface: the new dashboard that you can arrange with drag and drop to put the things most important to you on top, QuickPress, comment threading, paging, and the ability to reply to comments from your dashboard, the ability to install any plugin directly from WordPress.org with a single click, and sticky posts.

Digging in further you might notice that every screen is customizable. Let’s say you never care about author on your post listings — just click “Screen Options” and uncheck it and it’s instantly gone from the page. The same for any module on the dashboard or write screen. If your screen is narrow and the menu is taking up too much horizontal room, click the arrow to minimize it to be icon-only, and then go to the write page and drag and drop everything from the right column into the main one, so your posting area is full-screen. (For example I like hiding everything except categories, tags, and publish. I put categories and tags on the right, and publish under the post box.)

WordPress 2.7 also introduce the Automatic Core upgrade which unfortunately do not work for me. I am still very skeptical after automating web script upgrades. I prefer to do it the manual way so that I can control what I want.

I will release the updates to my plugins shortly.

Download: WordPress 2.7

We feel this release is pretty much exactly what we’re going to ship as 2.7, barring any final bugs or polish tweaks that you report or we find.

I am guessing we can see WordPress 2.7 final either tomorrow or on Friday.

Download: WordPress 2.7 RC 2

280 commits since beta 3 have polished the new admin UI (including new menu icons created by the winners of our icon design contest) and fixed all known blocker bugs.

Download: WordPress 2.7 RC 1

During this period, http://forums.lesterchan.net will be in a read-only mode, meaning you can only search and read topics/replies. Registration of new account, replying to an existing topic and posting a new topic will be DISABLED.

I WILL NOT entertain any support questions that are sent to me via email during this period.

he security issue is an XSS exploit discovered by Jeremias Reith that fortunately only affects IP-based virtual servers running on Apache 2.x. If you are interested only in the security fix, copy wp-includes/feed.php and wp-includes/version.php from the 2.6.5 release package.

2.6.5 contains three other small fixes in addition to the XSS fix. The first prevents accidentally saving post meta information to a revision. The second prevents XML-RPC from fetching incorrect post types. The third adds some user ID sanitization during bulk delete requests. For a list of changed files, consult the full changeset between 2.6.3 and 2.6.5.

Note that we are skipping version 2.6.4 and jumping from 2.6.3 to 2.6.5 to avoid confusion with a fake 2.6.4 release that made the rounds. There is not and never will be a version 2.6.4.

5 files have been changed:

1. /wp-admin/users.php
2. /wp-includes/feed.php
3. /wp-includes/post.php
4. /wp-includes/version.php
5. xmlrpc.php

You can just download this 5 files and upload it to your server

• Numerous style improvements and refinements.
• All admin notices now go under the page title.
• PHP Notice fixes.
• Dashboard widget options now properly save.
• Menu fixes.
• New design for Quick Edit.
• Canonical feed URL fixes.
• Walker fixes.
• An update for Hello Dolly.
• Plugin installer updates.
• Numerous font updates.
• Updated login logo.
• Switch position of “Save Draft” and “Preview” buttons in publish module.
• File upload support for MS Office 2007+ file formats.
• Media upload buttons won’t show if the user doesn’t have the upload capability.
• Canonical redirects only do yes-www or no-www redirection for domains.
• Shift-click checkbox range selection improvement.
• Add New User page now separate.
• Tag suggest only suggests tags (not other taxonomy terms).
• QuickPress shows “Submit for Review” if user cannot publish.
• Private posts/pages, and password-protected posts/pages are rolled into new “Visibility” section of publish module.

I got a feeling beta 3 will be a last beta and an RC1 will hit us next week.

Download: WordPress 2.7 Beta 3

Here are the changelog since beta 1:

• The Upload button didn’t always show. Fixed.
• JS on the Dashboard broke for blogs with no comments, causing several UI elements to “freeze”. Fixed.
• Recent Drafts Dashboard module didn’t show correct times. Fixed.
• Various Autosave fixes.
• Redirect after deleting a page from the editor went back to the deleted page. Fixed.
• Fixed loading of translations for default TinyMCE plugins.
• Added avatars to the edit users list.
• Added some missing translations.
• Fixed some validation errors.
• Fixed some PHP warnings and notices.
• Handle inconsistent file permissions during auto upgrade
• Change Publish box layout to better accommodate internationalized text
• Fix quick editing of the last page in the Edit Pages list
• Fix Screen Options for IE
• Fixes for choose tag from tag cloud
• Rewrite rules fixes for certain hosts
• Don’t check for updates on every page load
• Easier post box dropping
• Preview fixes
• RTL fixes
• Fixed broken wp-mail
• Plugin update and install fixes
• First draft of contextual help tab

Download: WordPress 2.7 Beta 2

You can do the automatic upgrade via WP-Admin -> Tools -> Update.

PS: I would always recommend manually upgrade instead of automatic upgrade as it is more prone to errors.

Here is a demo of the plugin in action.

You can download it from here:

Do remember to read the readme.html

I have already applied for this plugin on the WordPress repository. Still waiting for a reply.

*UPDATE* Committed the plugin, SVN is at http://plugins.trac.wordpress.org/browser/wp-commentnavi/

My efforts had paid off when my plugins undergo major cosmetic changes back in WordPress 2.5 to accommodate the new WordPress 2.5 design. It is because for WordPress 2.7, I need not do anything and the design just fits right in. I just need to add in the icon for the admin menu for WP-DBManager, WP-DownloadManager, WP-Email, WP-Polls and WP-PostRatings.

Here are the fixes to get WP-Email 2.31 and WP-Print 2.31 to work with WordPress 2.7. I will not update WP-Email 2.31 and WP-Print 2.31 with this fix, instead I will just leave the fix to be downloadeded on this site. Do note that the fix will make WP-Email and WP-Print work for WordPress 2.7 ONLY.

Here is the fix for WP-Email 2.31:

In wp-email.php:

Find (Line 106, Line 120, Line 134 & Line 147):

1	$rewrite_rules = array_slice($rewrite_rules, 4, 1);

Replace:

1	$rewrite_rules = array_slice($rewrite_rules, 5, 1);

Find (Line 758):

1	add_action('template_redirect', 'wp_email');

Replace:

1	add_action('template_redirect', 'wp_email', 5);

Alternatively you can download the fixed wp-email.php:

Here is the fix for WP-Print 2.31:

In wp-print.php:

Find (Line 79 & Line 95):

1	$rewrite_rules = array_slice($rewrite_rules, 4, 1);

Replace:

1	$rewrite_rules = array_slice($rewrite_rules, 5, 1);

Find (Line 395):

1	add_action('template_redirect', 'wp_print');

Replace:

1	add_action('template_redirect', 'wp_print', 5);

Alternatively you can download the fixed wp-print.php:

After uploading the fix, you need to regenerate permalink. Go to (WP-Admin -> Settings -> Permalinks -> Save Changes)

I have already committed these changes to WP-Email 2.40 and WP-Print 2.40 to the SVN.

Tentatively WP-DBManager, WP-DownloadManager, WP-Email, WP-Polls and WP-PostRatings will work for Wordpress 2.7 only because of the new icon in the admin menu.

Also, the development of WordPress 2.7 is 2 weeks behind and hence 10th November will not be the release date for the final version, but rather a release candidate. The final version is expected to be at the end of November 2008.

Speaking of the final release, it will not be available on November 10th as originally scheduled. We are two weeks behind schedule at the moment. We need a little more time to finish the visual design, do a round of user testing against that finished design, and do a proper round of public beta testing. Our plan is to keep working as if Nov. 10 is still the release date. However, instead of releasing the final 2.7 on the 10th, we will make a release candidate available instead. The release candidate is intended to be a high-quality, almost-finished release that we are comfortable recommending for broad use. After Nov. 10, the focus will be on fixing high impact bugs turned up by those of you testing the release candidate. I suspect 2.7 will be ready for final release by the end of November. A specific date will be set as we progress through the public beta cycle and get a feel for how solid the release is.

A vulnerability in the Snoopy library was announced today. WordPress uses Snoopy to fetch the feeds shown in the Dashboard. Although this seems to be a low risk vulnerability for WordPress users, we wanted to get an update out immediately. 2.6.3 is available for download right now. If you don’t want to download the whole release to get the security fix, you can download the following two files and copy them over your 2.6.2 installation.

Replace these 2 files:

1. wp-includes/class-snoopy.php
2. wp-includes/version.php

Download full version:

• Download WordPress 2.6.3

Feel free to add on to the list by posting it in the comments.

I have not been developing at all besides committing those changes that Kambiz made since my school started on the 22nd August 2008. Hopefully I will have time to finished what I have planned for, for the next update in December 2008 where I will have only 1 month break.

Just to iterate once again, I decided to stopped developing WP-Sticky anymore as WordPress 2.7 will have that feature built-in and hence WP-Sticky 1.31 is the last version.

WordPress 2.7 will also feature comment threading and paging. Comment paging is the feature I have been waiting for!

• New admin UI based on the crazyhorse experimental UI branch with new menus and navigation
• New edit post page that allows dragging and dropping of meta boxes. Boxes can be expanded and collapsed as before and now also completely hidden.
• Ability to hide columns on the content index pages
• Inline editing of posts and pages on the content index pages
• Comments XMLRPC API (Who wants comment moderation on the iPhone? Me.)
• Reply to comments from the admin
• Keyboard hot keys for managing comments
• Threaded Comments and new wp_list_comments() API
• Sticky Posts
• Automatic plugin install and integrated plugin browser
• Automatic upgrade of WordPress
• HTTPOnly auth cookies
• New HTTP request API
• A new SSH2 filesystem abstraction for updates and installs over sftp

Theme update, install, and browsing may also get done in time for 2.7.

Stefan Esser recently warned developers of the dangers of SQL Column Truncation and the weakness of mt_rand(). With his help we worked around these problems and are now releasing WordPress 2.6.2. If you allow open registration on your blog, you should definitely upgrade. With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another user’s password to a randomly generated password. The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit. However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password. Stefan Esser will release details of the complete attack shortly. The attack is difficult to accomplish, but its mere possibility means we recommend upgrading to 2.6.2.

Here is a list of bugs fixed:

• Can’t control where a user redirects to when they log in
• Bug in textpattern import
• include mysql version in version check query string
• RSS widget shouldn’t link if there isn’t a link
• get_post_meta fails to unserialize when $single=false
• typing error in wp-settings.php
• comment_max_links causes confusion when zero
• get_posts not working properly
• Insert image into post always inserts full size
• Filter news on templates cant work
• Typo in post revisions

Here is a list of changed files:

• wp-login.php
• wp-settings.php
• /wp-includes/formatting.php
• /wp-includes/pluggable.php
• /wp-includes/post.php
• /wp-includes/query.php
• /wp-includes/version.php
• /wp-includes/widgets.php
• /wp-admin/css/press-this-ie.css
• /wp-admin/import/textpattern.php
• /wp-admin/includes/image.php
• /wp-admin/includes/template.php

Download WordPress 2.6.2