Fear and panic!

This article explicitly mentions WordPress as being vulnerable to a newly discovered security hole in the underlying PHP XML-RPC libraries.

This WordPress support article outlines a couple of fixes.

• Uprade to WordPress 1.5.1.3
• Or, if you own the server (as I do):
  • pear clear-cache
  • pear upgrade XML_RPC

And all is now right with the world.

via: Daring Fireball

I’ve fixed the problem I was having with my comments. This post pointed me at the User list for my blog. Yup, there’s a blank entry (no name, email, or password). I don’t know how the heck that got there but it’s gone now. I’ve reverted all my hacks and comments are working correctly.

After the upgrade my comments stopped working correctly. The comment form didn’t showing the Name, Email, and Website fields and would accept a comment without enforcing the mandatory Name and Email entries.

It seems that the $User_ID constant is always returning a value, even when there is no one logged in. I’ve applied a temporary hack to work around the problem (see below), but I’m going to have to look deeper to identify what is causing it.

Temporary hack follows:

File: /WP-HOME/wp-content/themes/YourTheme/comments.php
(assuming it’s based on the default theme)

Change line 74 from: <?php if ( $user_ID ) : ?>
to: <?php if ( FALSE ) : ?>

File: /WP-HOME/wp-comments-post.php

Change line 26 from: if ( $user_ID ) :
to: if ( FALSE ) :

Change line 37 from:
if ( get_settings('require_name_email') && !$user_ID ) {
to: if ( get_settings('require_name_email') && TRUE ) {

As I said, this just masks the fact that WP thinks that there is a user logged in when there isn’t. I’ll have to look deeper to identify the root cause… don’t wait up.

I’ve been running WordPress 1.2 for a while now, and was beginning to get annoyed by an increase in comment/trackback spam so I’ve upgraded to version 1.5.1.2.

This gives me access to some bug fixes, and more importantly, more powerful anti-spam tools. I won’t be able to get anyone to check comment posting until tomorrow, so I’ll apologize now in case you encounter any problems.