WordPress News Roundup July 2009: WordPress 2.8.2 Release, “Themes Are GPL, Too” and Two Security Releases for WordPress 2.8

July 2009 opened with the clearest statement yet on one of the community’s most heated questions. On July 2, Matt Mullenweg published “Themes are GPL, too,” sharing a legal opinion from the Software Freedom Law Center that the PHP in WordPress themes is a derivative of WordPress and must carry the GPL, while CSS and images can be licensed separately.

The rest of the month was dominated by maintenance. WordPress 2.8.1 and 2.8.2 both shipped with security fixes, the long-lived 2.0 legacy branch was retired early, and more than 3,500 people helped prioritise media features for WordPress 2.9.

WordPress Core Updates

• WordPress 2.8.1: Released on July 9, 2.8.1 fixed a long list of bugs from the 2.8 launch, including theme compatibility problems with get_categories(), high dashboard memory use and an upgrader issue that could delete files after a failed update. It also added protection against plugins that skipped permission checks.
• WordPress 2.8.2: Released on July 20, 2.8.2 fixed a cross-site scripting issue in which comment author URLs were not fully sanitised in the admin.
• 2.9 feature vote: After a developer meeting on July 7 to discuss what 2.9 should contain, WordPress.org asked users to vote on proposed media features. Results posted on July 31 showed more than 3,500 responses.
• 2.0 branch deprecated: On July 30 the project retired the 2.0.x legacy branch, which it had originally planned to support until 2010, noting that recent security improvements had not been backported to it.
• Better plugin changelogs: WordPress.org made changes on July 21 to help plugin authors communicate what changed in each version, arguing that every piece of software should have a readable changelog.

Other WordPress News

• Themes are GPL, too: The July 2 post published an opinion signed by James Vasile of the Software Freedom Law Center. It concluded that theme PHP files must be GPL because they work hand in hand with WordPress functions, while stylesheets and images are separate works. WordPress.org restated that it would only promote and host themes that were fully GPL-compatible.
• WordPress.com refresh: WordPress.com rolled out a redesigned homepage at the end of the month.
• bbPress.org redesign: Screenshots of a refreshed bbPress.org circulated, keeping the forum software’s colour scheme with a cleaner look.
• Hello Dolly debate: A poll on the Digging Into WordPress blog found most voters wanted the bundled Hello Dolly plugin removed from core, reigniting a perennial argument.
• Virtual WordCamp falters: The planned online-only WordCamp drew criticism for charging more than many in-person events.
• WordCamp videos: Recordings from WordCamp San Francisco and WordCamp Dallas continued to appear on WordPress.tv.

Security Alerts and Plugin Vulnerabilities

Both July releases carried security fixes, and together they showed WordPress responding faster to outside researchers.

• Plugin admin pages exposed (2.8.1): Core Security Technologies reported that some plugins’ admin pages could be viewed by users without the right permissions, leaking information. Not every plugin was affected, but users were urged to upgrade.
• Comment URL XSS (2.8.2): An attacker could craft a comment author URL that, if not fully sanitised, could redirect an administrator to another site.
• Legacy branch risk: Retiring 2.0.x meant sites still on that line would get no further fixes, adding pressure to move to the current release.

Industry Trends and Insights

The GPL opinion reshaped the premium theme market. Sellers who wanted promotion on WordPress.org, or simply to stay on good terms with the project, increasingly adopted GPL or split licenses for their themes. The question of whether every commercial seller would follow remained open, and it would come to a head a year later with Thesis.

• Security as a selling point: Lists of WordPress security plugins were circulating widely, and readers were sharing stories of compromised sites as the community began to treat hardening as routine.
• Media as the next frontier: Focusing the 2.9 vote on media features showed WordPress responding to the rise of photo and video blogging.

Theme of the Month: Thematic

Ian Stewart’s Thematic was a free, GPL-licensed framework with a large library of hooks, and an ecosystem of child themes had grown around it, some of them sold commercially. In the month WordPress spelled out its position on theme licensing, Thematic showed how a business could be built on top of fully open code.

Plugin of the Month: Hello Dolly

Matt Mullenweg’s tiny Hello Dolly plugin, bundled with every copy of WordPress, displays a random lyric in the admin and doubles as the simplest possible example of how a plugin works. July’s poll calling for its removal was a reminder of how much attention even the smallest piece of core attracted. It stayed.

Host of the Month: SiteGround

SiteGround, founded in Bulgaria in 2004, offered shared hosting with WordPress-oriented support at a time when two security releases in a month made fast upgrades essential. Hosts that helped customers keep core current were becoming a practical line of defence for less technical site owners.

Founder of the Month: Cory Miller

Cory Miller had founded iThemes in 2008 and built it into one of the best-known premium theme businesses. In the month WordPress clarified that theme PHP must be GPL, companies like his were showing that commercial theme shops could thrive by selling support, updates and convenience rather than restricting code.

Looking Ahead to August 2009

August was expected to bring development work on 2.9 now that its media priorities were set, and the core team was ready to issue further 2.8 point releases if more security problems surfaced. WordPress.org was also preparing an updated list of upcoming WordCamps.