WordPress News Roundup June 2003: WordPress 0.71 Promises a 300% Speedup, Then 0.711 Patches an XSS Hole

Two weeks after its first release, WordPress shipped again. Version 0.71 arrived on June 9 with a claimed threefold speed increase, a proper post-status system and a security fix. Later in the month the team took two bigger steps: it moved configuration out of PHP files and into the database, and it shipped an emergency 0.711 release to fix a cross-site scripting bug in comments.

June was the busiest month in the young repository so far. Matt Mullenweg and Mike Little shared the work almost evenly.

WordPress Core Updates

• Betas (June 6–9): A .71 beta went out on June 6, followed by a third and final beta on release day.
• WordPress 0.71 (June 9): The headline claim was a speedup of about 300% over earlier WordPress and b2 releases. Posts gained three states (published, draft and private), and comments and pings could be switched on or off for each post. Trackbacks, pingbacks and comments were merged into one list. Other changes included OPML import for the links manager, the ezSQL database layer, a cleaner admin, easier upgrades from b2 and more than twenty bug fixes.
• Goodbye b2config.php (June 12–13): Little replaced b2’s configuration file with a small wp-config.php and moved everything else into new options screens stored in the database. That model, with database settings and only connection details in a file, is still how WordPress works.
• WordPress 0.711 (June 25): A security release fixed a cross-site scripting hole in post comments. Little hosted it on his zed1.com site because it was not available from the usual download locations.
• Movable Type import: A contributor reported that the data models of Movable Type 2.64 and WordPress 0.71 had been mapped and that an importer was close. Movable Type import would finally ship in WordPress 1.0.

Other WordPress News

• A real About section: On June 6 the site’s About pages were rewritten to explain the project and its goals, and a testimonials page was added.
• Buttons: A “Powered by WordPress” button page went live on June 12, and Mullenweg invited designers to submit alternatives to the Antipixel-style badges.
• TrackBack debate: Mullenweg disagreed with John Gruber’s criticism of TrackBack. He argued that WordPress’s support for both TrackBack and Pingback gave bloggers better ways to see who was linking to them than plain referrer logs.

Security Alerts and Plugin Vulnerabilities

• SQL injection fix in 0.71: The release closed a hole that could allow SQL injection on MySQL 4 and above. It also removed a vulnerable file, links.all.php, which upgraders were told to delete by hand.
• Comment XSS in 0.711: All users were advised to upgrade to 0.711, which filtered dangerous tags out of comments. The fix page on zed1.com also listed other ways to deal with the bug.

Industry Trends and Insights

Moving settings into the database was a turning point. b2 had expected users to edit PHP files to change basic options, which put off anyone who was not a developer. A browser-based options screen was one step toward the easy setup Mullenweg had admired in Blogger, and one more reason Movable Type users would later find WordPress easy to switch to.

Founder of the Month: Justin Vincent

Justin Vincent wrote ezSQL, the small PHP database class adopted in 0.71. The team said it made the code cleaner and slightly faster and would make it easier to support other databases later. Its descendant, the wpdb class, is still how WordPress talks to its database.

Looking Ahead to July 2003

The new options system needed a reliable upgrade script before most users could move to it. Changes to the links manager and the Movable Type importer were next in the queue, ahead of the next point release.