WordPress News Roundup December 2010: WordPress 3.0.4 Critical Fix and the 3.1 Release Candidate

December 2010 ended the year with two security releases and a release candidate. WordPress 3.0.3 fixed remote publishing permission problems on December 8, and on December 29 WordPress 3.0.4 patched a flaw in the KSES HTML sanitisation library that the team rated critical. In between, WordPress 3.1 moved through its second beta to a first release candidate on Christmas Day.

The year closed with WordPress in a very different position from where it began. Multisite, menus and custom post types had shipped in 3.0, the trademark sat with a non-profit foundation, and WordPress.com had absorbed Microsoft’s blogging users. The project marked the moment with a new series explaining how its decisions are made.

WordPress Core Updates

• WordPress 3.0.3: Released on December 8, 3.0.3 fixed issues in the remote publishing interface that could let Author- and Contributor-level users improperly edit, publish or delete posts. Only sites with remote publishing enabled, which was off by default, were affected.
• WordPress 3.1 Beta 2: Released on December 15 for testing on non-production sites. The announcement was introduced with a haiku from Jane Wells, written on her birthday.
• WordPress 3.1 RC1: On December 25 the first release candidate arrived after the beta period. The team reported no known issues but cautioned that the sheer number of plugins and setups meant problems could still appear.
• WordPress 3.0.4: Released on December 29, 3.0.4 fixed a core security bug in KSES, the library WordPress uses to filter HTML. Users were told to update immediately from the dashboard.
• 3.1 timing: The September plan had targeted a December 15 release. Instead the cycle ran into the new year, with the RC process continuing in January.

Other WordPress News

• Meet the Makers: On December 27 WordPress.org announced a series introducing the people behind the project, explaining that WordPress works as a meritocracy in which the quality of contributions and time committed determine a person’s influence.
• WP Tavern changes: Jeff Chandler used WordPress Weekly in early December to discuss planned changes to WPTavern.com and the news of the 3.0.2 release.

Security Alerts and Plugin Vulnerabilities

December brought two core security releases in three weeks, following 3.0.2 at the end of November.

• Remote publishing (3.0.3): The flaws were in the remote publishing interface used by desktop and mobile clients, letting lower-level users overstep their permissions. Because remote publishing was disabled by default, most sites were not exposed.
• KSES sanitisation (3.0.4): Rated critical, this bug was in the code that strips unsafe HTML from user-submitted content. A weakness there could allow malicious markup to slip through filters, so the update was strongly recommended for every site.
• Update fatigue: Three security releases in about a month tested the community’s patience, but the dashboard updater made each one a single click for most users.

Industry Trends and Insights

2010 was the year WordPress became a content management system in the eyes of the wider web. Custom post types and menus made it practical for business sites, multisite brought networks into core, and the departure of competitors such as Windows Live Spaces and Vox left WordPress the default for blogging.

• Competitors regroup: Drupal 7 was nearing release after a long development cycle, setting up a renewed comparison with WordPress in 2011.
• PHP 5 future: With 3.1 set to be the last version supporting PHP 4, developers were preparing for a modern baseline in 2011.
• Commercial ecosystem: Managed hosts, premium plugins, backup services and theme businesses had all grown substantially over the year, laying the foundations of the WordPress economy.

Theme of the Month: Genesis

Genesis ended its first year as one of the most successful premium frameworks. Launched in February, it gained users switching from Thesis over the summer and became part of Copyblogger Media in September, giving StudioPress a much larger audience going into 2011.

Plugin of the Month: WPtouch

BraveNewCode’s WPtouch automatically served a mobile-friendly theme to visitors on smartphones. As WordPress’s own apps passed a million users and more readers arrived on phones, it was a simple way to make a site usable on small screens before responsive design became common.

Host of the Month: Page.ly

With three core security releases between late November and the end of December, Page.ly’s managed approach, in which the host applies updates for its customers, showed its value. The service had grown through 2010 as more site owners decided they would rather pay someone else to keep WordPress current.

Founder of the Month: Matt Mullenweg

Matt Mullenweg closed a landmark year in which WordPress shipped 3.0, Automattic gave the trademark to the WordPress Foundation, and WordPress.com took on Windows Live Spaces users. December’s “Meet the Makers” series reflected his long-standing view of WordPress as a meritocratic community project.

Looking Ahead to January 2011

January was expected to bring further 3.1 release candidates and, if testing went smoothly, the final release, which in the end arrived in late February 2011. Drupal 7 was also expected early in the new year.