4 ms·

Wordpress 3.0.2 security update ...

26 points by epo 16y ago

patio11 16y ago
You can craft a SQL injection by linking to a blog with the right URL, thus causing Wordpress to attempt to ping them and, in doing so, directly execute your SQL statement of choice against the DB. http://core.trac.wordpress.org/changeset/16625 http://core.trac.wordpress.org/changeset/16625
simonsarris 16y ago
Thanks muchly for the notice.
lsb 16y ago
Wordpress has had lots of security issues; see tptacek's comment: http://news.ycombinator.com/item?id=1328261 http://news.ycombinator.com/item?id=1328261 Given their prioritization of ease-of-use over security, why would anyone want to run your own WP install, instead of wordpress.com or jekyll (static site) + disqus?
- wwortiz 16y ago
  Because of the ease of use.
- bradleyland 16y ago
  Those are two separate arguments. Why run my own? Control, customization, cost. Why not use something like Jekyll? Because the people who I collaborate with do not use tools like the command line, textile, and markdown.
- patio11 16y ago
  The code is a steaming pile, but the ecosystem is amazingly good, and the user experience is heads-and-tails above most CMS systems. You can have a Wordpress-backed site up in minutes, and (for very little money) it will look fabulous and you'll be able to change stuff on it without having to call your nephew who knows lots of stuff about computers. (I use Wordpress all over the place, including for the marketing site for my new product. It saved at least a week versus having the marketing site also served out of Rails, and decoupling them made my designer's life much easier.)
- Poiesis 16y ago
  On this note, are there any other recommended platforms?
- tptacek 16y ago
  A reasonable way to get the best of both worlds is to mirror WP content as static files on a webserver, keeping all of Wordpress --- all of it --- behind a firewall. Most of WP, besides search and commenting, is amenable to scraping.
  - quicksilver03 16y ago
    How would you do that? Would a simple 'wget --recursive' suffice or you're after something more sophisticated?
    - euroclydon 16y ago
      Turn on Super Cache which uses the file system. Spider the site to populate the cache files. Copy them to a public web directory. The internal links might not work right out of the box, but I'm sure you could massage them into shape.
tibbon 16y ago
Remember that you can easily use SVN to update your wordpress installations with a single line. I've yet to have a problem with doing it this way. I wish they'd move to git officially (I know there are some mirrors), but this does the trick for the most part. Someday.
aschobel 16y ago
Can anybody recommend a good 3rd party WP hosting service that lets you run your own custom plugins? I'm tired of spending engineering resources managing our own WP instance.

26 points by epo 16y ago

You can craft a SQL injection by linking to a blog with the right URL, thus causing Wordpress to attempt to ping them and, in doing so, directly execute your SQL statement of choice against the DB. http://core.trac.wordpress.org/changeset/16625 http://core.trac.wordpress.org/changeset/16625

simonsarris 16y ago

Thanks muchly for the notice.

lsb 16y ago

Wordpress has had lots of security issues; see tptacek's comment: http://news.ycombinator.com/item?id=1328261 http://news.ycombinator.com/item?id=1328261 Given their prioritization of ease-of-use over security, why would anyone want to run your own WP install, instead of wordpress.com or jekyll (static site) + disqus?

wwortiz 16y ago
Because of the ease of use.
bradleyland 16y ago
Those are two separate arguments. Why run my own? Control, customization, cost. Why not use something like Jekyll? Because the people who I collaborate with do not use tools like the command line, textile, and markdown.
patio11 16y ago
The code is a steaming pile, but the ecosystem is amazingly good, and the user experience is heads-and-tails above most CMS systems. You can have a Wordpress-backed site up in minutes, and (for very little money) it will look fabulous and you'll be able to change stuff on it without having to call your nephew who knows lots of stuff about computers. (I use Wordpress all over the place, including for the marketing site for my new product. It saved at least a week versus having the marketing site also served out of Rails, and decoupling them made my designer's life much easier.)
Poiesis 16y ago
On this note, are there any other recommended platforms?
tptacek 16y ago
A reasonable way to get the best of both worlds is to mirror WP content as static files on a webserver, keeping all of Wordpress --- all of it --- behind a firewall. Most of WP, besides search and commenting, is amenable to scraping.
- quicksilver03 16y ago
  How would you do that? Would a simple 'wget --recursive' suffice or you're after something more sophisticated?
  - euroclydon 16y ago
    Turn on Super Cache which uses the file system. Spider the site to populate the cache files. Copy them to a public web directory. The internal links might not work right out of the box, but I'm sure you could massage them into shape.

tibbon 16y ago

Remember that you can easily use SVN to update your wordpress installations with a single line. I've yet to have a problem with doing it this way. I wish they'd move to git officially (I know there are some mirrors), but this does the trick for the most part. Someday.

aschobel 16y ago

Can anybody recommend a good 3rd party WP hosting service that lets you run your own custom plugins? I'm tired of spending engineering resources managing our own WP instance.