2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges. If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.

The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch. The second problem, discovered by Dawid Golunski, is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations. Thanks to Benjamin and Dawid for finding and reporting these.

Changelog: WordPress 2.8.6
Download: WordPress 2.8.6
Download: Modified files since WordPress 2.8.5

• A fix for the Trackback Denial-of-Service attack that is currently being seen.
• Removal of areas within the code where php code in variables was evaluated.
• Switched the file upload functionality to be whitelisted for all users including Admins.
• Retiring of the two importers of Tag data from old plugins.

Changelog: WordPress 2.8.5
Download: WordPress 2.8.5
Download: Modified files since WordPress 2.8.4

Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner. This doesn’t allow remote access, but it is very annoying.

Changelog: WordPress 2.8.4
Download: WordPress 2.8.4
Download: Modified files since WordPress 2.8.3

Unfortunately, I missed some places when fixing the privilege escalation issues for 2.8.1. Luckily, the entire WordPress community has our backs. Several folks in the community dug deeper and discovered areas that were overlooked. With their help, the remaining issues are fixed in 2.8.3. Since this is a security release, upgrading is highly recommended

Changelog: WordPress 2.8.3
Download: WordPress 2.8.3
Download: Modified files since WordPress 2.8.2

WordPress 2.8.2 fixes an XSS vulnerability. Comment author URLs were not fully sanitized when displayed in the admin. This could be exploited to redirect you away from the admin to another site.

Changelog: WordPress 2.8.2
Download: WordPress 2.8.2
Download: Modified files since WordPress 2.8.1

WordPress 2.8.1 fixes many bugs and tightens security for plugin administration pages. Core Security Technologies notified us that admin pages added by certain plugins could be viewed by unprivileged users, resulting in information being leaked. Not all plugins are vulnerable to this problem, but we advise upgrading to 2.8.1 to be safe.

Some of the fixes:

• Certain themes were calling get_categories() in such a way that it would fail in 2.8. 2.8.1 works around this so these themes won’t have to change.
• Dashboard memory usage is reduced. Some people were running out of memory when loading the dashboard, resulting in an incomplete page.
• The automatic upgrade no longer accidentally deletes files when cleaning up from a failed upgrade.
• A problem where the rich text editor wasn’t being loaded due to compression issues has been worked around.
• Extra security has been put in place to better protect you from plugins that do not do explicit permission checks.
• Translation of role names fixed.
• wp_page_menu() defaults to sorting by the user specified menu order rather than the page title.
• Upload error messages are now correctly reported.
• Autosave error experienced by some IE users is fixed.
• Styling glitch in the plugin editor fixed.
• SSH2 filesystem requirements updated.
• Switched back to curl as the default transport.
• Updated the translation library to avoid a problem with mbstring.func_overload.
• Stricter inline style sanitization.
• Stricter menu security.
• Disabled code highlighting due to browser incompatibilities.
• RTL layout fixes.

Full Changelog in WordPress 2.8.1

Download: WordPress 2.8.1

Now my plugins uses jQuery for AJAX instead of TW-Sack. I have also updated the widget code to make use of the new WordPress 2.8 new Widget class and that supports multi-instances widgets. The widget code has now been merge with the main plugin file so the standalone widget plugin file is no longer in use. Please delete the whole plugin folder and upload it again to avoid any error.

As WordPress 2.8 supports loading of JavaScript in the footer, all my plugins’ JavaScripts will be loaded in the footer. Be sure you have in your theme footer.php.

Be sure to read the readme.html and checkout the changelog for more information and most importantly NOTE THE TABS AT THE TOP

WP-Ban 1.50
» Readme/Changelog
» Download Mirror #1
» Support Forum

WP-CommentNavi 1.10
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-DBManager 2.50
» Readme/Changelog
» Download Mirror #1
» Support Forum

WP-DownloadManager 1.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-EMail 2.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-PageNavi 2.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-PluginsUsed 1.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-Polls 2.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-PostRatings 1.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-PostViews 1.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-Print 2.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-RelativeDate 1.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-ServerInfo 1.50
» Readme/Changelog
» Download Mirror #1
» Support Forum

WP-Stats 2.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-Sticky 1.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

WP-Useronline 2.50
» Readme/Changelog
» Demo
» Download Mirror #1
» Support Forum

If you like or love my plugins a lot, do consider making a donation to me. My Paypal email address is lesterchan AT gmail DOT com. Thank you =D

Here is the quote from Matt:

I’m very excited to announce to everyone that the latest and greatest version of WordPress, version 2.8 “Baker,” is immediately available for download. 2.8 represents a nice fit and finish release for WordPress with improvements to themes, widgets, taxonomies, and overall speed. We also fixed over 790 bugs. This release is named in honor of noted trumpeter and vocalist Chet Baker.

Major New Improvements
First and foremost, 2.8 is way faster to use. We’ve changed the way WordPress does style and scripting.

The core and plugin updaters in previous versions of WordPress have been such a success we decided to bring the same to themes. You can now browse the entire theme directory and install a theme with one click from the comfort of your WordPress dashboard.

If you make edits or tweaks to themes or plugins from your dashboard, you’ll appreciate the new CodePress editor which gives syntax highlighting to the previously-plain editor. Also there is now contextual documentation for the functions in the file you’re editing linked right below the editor.

If you were ever frustrated with widgets before, this release should be your savior. We’ve completely redesigned the widgets interface (which we didn’t have time to in 2.7) to allow you to do things like edit widgets on the fly, have multiple copies of the same widget, drag and drop widgets between sidebars, and save inactive widgets so you don’t lose all their settings. Developers now have access to a much cleaner and robust API for creating widgets as well.

Finally you should explore the new Screen Options on every page. It’s the tab in the top right. Now, for example, if you have a wide monitor you could set up your dashboard to have four columns of widgets instead of the two it has by default. On other pages you can change how many items show per page.

Download: WordPress 2.8

View: WordPress 2.8 Changelog

Download: WordPress 2.8 RC1

Download: WordPress 2.8 Beta 2

This site is running the development versions of all my plugins, so it should work with WordPress 2.8. Please let me know if you encounter any bug.

Download: WordPress 2.8 Beta 1

Below is a sample code taken from my WP-Polls that displays Polls Widget. It is tested and it works perfectly. Hope it is useful for plugin authors.

 __('Put a poll that you have added in WP-Polls on your sidebar', 'wp-polls'));
		$this->WP_Widget('polls', __('Polls'), $widget_ops);
	}

	// Display Widget
	function widget($args, $instance) {
		extract($args);
		$title = esc_attr($instance['title']);
		$poll_id = intval($instance['poll_id']);
		$display_pollarchive = intval($instance['display_pollarchive']);
		echo $before_widget.$before_title.$title.$after_title;
		get_poll($poll_id);
		if($display_pollarchive) {
			display_polls_archive_link();
		}
		echo $after_widget;
	}

	// When Widget Control Form Is Posted
	function update($new_instance, $old_instance) {
		if (!isset($new_instance['submit'])) {
			return false;
		}
		$instance = $old_instance;
		$instance['title'] = strip_tags($new_instance['title']);
		$instance['poll_id'] = intval($new_instance['poll_id']);
		$instance['display_pollarchive'] = intval($new_instance['display_pollarchive']);
		return $instance;
	}

	// DIsplay Widget Control Form
	function form($instance) {
		global $wpdb;
		$instance = wp_parse_args((array) $instance, array('title' => __('Polls', 'wp-polls'), 'poll_id' => 0, 'display_pollarchive' => 1));
		$title = esc_attr($instance['title']);
		$poll_id = intval($instance['poll_id']);
		$display_pollarchive = intval($instance['display_pollarchive']);
?>

			


			

>
>


			

			

>
>
>


			

This post shall be a tutorial post and I will demonstrate how to load JavaScript in the theme’s footer in WordPress 2.8 Nightly using my WP-Polls as an example.

### Function: Enqueue Polls JavaScripts/CSS
add_action('wp_enqueue_scripts', 'poll_scripts');
function poll_scripts() {
	wp_enqueue_style('wp-polls', plugins_url('wp-polls/polls-css.css'), false, '2.50', 'all');
	wp_enqueue_script('wp-polls', plugins_url('wp-polls/polls-js.js'), array('jquery'), '2.50', true);
	wp_localize_script('wp-polls', 'pollsL10n', array(
		'ajax_url' => plugins_url('wp-polls/wp-polls.php'),
		'text_wait' => __('Your last request is still being processed. Please wait a while ...', 'wp-polls'),
	));
}

The poll_scripts() function will hook onto the wp_enqueue_scripts function. This will allow you to enqueue JavaScripts as well as CSS Styles for your plugin.

As the name goes, wp_enqueue_style() will queue and then print out your plugin’s CSS link.

wp_enqueue_script() will queue and then print out the JavaScript link. The difference between WP2.7′s wp_enqueue_script() and WP2.8′s wp_enqueue_script() is the addition of the last argument which is whether to load the JavaScript in the footer. If set to true, it will load it in the footer, PROVIDED that your theme has the following code:

in the theme footer (refer to the default theme footer.php if unsure). Many themes especially self-created ones has failed to include wp_head() in the header.php as well as wp_footer() in the footer.php. The default value of the last argument is false, which means it will load it in the header by default.

wp_localize_script() will allow your to translate strings within your plugin JavaScript. To access the translated variable, you can use “pollsL10n.text_wait” (without the quotes).

This new hook:

do_action('admin_enqueue_scripts', $hook_suffix);

will allow you to enqueue your plugin JavaScript or CSS within the WP-Admin area easily rather than calling many times add_action() repeatedly depending on how many pages your plugin has in the WP-Admin area.

The sample code from WP-Polls to print JavaScripts as well as CSS in the WP-Admin area are as follows:

### Function: Enqueue Polls Stylesheets/JavaScripts In WP-Admin
add_action('admin_enqueue_scripts', 'poll_scripts_admin');
function poll_scripts_admin($hook_suffix) {
	$poll_admin_pages = array('wp-polls/polls-manager.php', 'wp-polls/polls-add.php', 'wp-polls/polls-options.php', 'wp-polls/polls-templates.php', 'wp-polls/polls-uninstall.php');
	if(in_array($hook_suffix, $poll_admin_pages)) {
		wp_enqueue_style('wp-polls-admin', plugins_url('wp-polls/polls-admin-css.css'), false, '2.50', 'all');
		wp_enqueue_script('wp-polls-admin', plugins_url('wp-polls/polls-admin-js.js'), array('jquery'), '2.50', true);
		wp_localize_script('wp-polls-admin', 'pollsAdminL10n', array(
			'admin_ajax_url' => plugins_url('wp-polls/polls-admin-ajax.php'),
			'text_delete_all_logs' => __('Delete All Logs', 'wp-polls'),
		));
	}
}

Firstly, I assigned all the pages of WP-Polls that has an admin page to an array. Next I check whether the current page is within the array. If it is in the array, it means that the user is accessing WP-Polls admin area and thus, I will proceed on to enqueue the JavaScript or CSS needed in the WP-Polls admin area.

Note 1: When you use wp_enqueue_script(), it will automatically register the script and then print it out, whereas if you use wp_register_script(), you will have to manually print it out by calling wp_print_scripts().

• WP-Polls and WP-PostRatings uses JavaScript on the frontend as well as the backend
• WP-Email and WP-UserOnline uses JavaScript on the frontend only
• WP-ServerInfo uses JavaScript on the backend only

Unfortunately the changes require at least WordPress 2.8 onwards to make use of the JavaScript enhancements in WordPress 2.8. I have updated this site to WordPress 2.8 Bleeding Edge aka WordPress 2.8 Nightly in order to test the JavaScript changes on a live site.

If you view the HTML source of this page, you will notice that only the CSS files get loaded in the header and the JavaScript gets loaded in the footer.

If you are running WordPress 2.8 bleeding edge, perhaps you can help me test out the plugins. Thanks in advanced