WordPress News Roundup October 2004: WordPress 1.2.1 Security Release and Matt Mullenweg Joins CNET

October 2004 began with a security scramble and ended with a cross-country move. A vulnerability advisory published without warning to the WordPress team led to WordPress 1.2.1 on October 6. The release also brought the friendlier login system from the 1.3 code. Development on 1.3 kept up its pace with page templates and a list-pages function. At the end of the month, Matt Mullenweg drove from Houston to San Francisco to start a job at CNET Networks.

Mergers, Acquisitions, and Investments

No deals involved WordPress. Its main commercial rival raised money. On October 7, Six Apart announced a $10 million Series B round led by August Capital, with two August Capital partners joining its board.

WordPress Core Updates

• WordPress 1.2.1 (October 6): A bug-fix and security release for 1.2. Upgrading meant overwriting the core files, and existing templates and plugins kept working. It included the new login system from 1.3, aimed at the cookie and login problems many users had reported.
• A new login system (October 4): Mullenweg rebuilt authentication in the development code, with automatic login fixes and a wp_login() function following within days.
• Page templates (October 6): Boren added custom templates for Pages, along with a switch_theme action for plugins. A first draft of wp_list_pages() followed on October 9.
• Themes and plugins grow up: Plugins and themes gained their own translation support, plugins could add their own admin pages, template and stylesheet filters arrived, and the theme screen began listing broken themes with suggested fixes.
• Automatic database upgrades: WordPress started running database upgrades automatically when needed.

Other WordPress News

• Mullenweg joins CNET: Mullenweg announced on October 24 that he was driving across the country to settle in San Francisco. Four days later he explained why: he had taken a job with CNET Networks. By October 30 he was writing from his new apartment.
• Donncha’s busy month: Donncha Ó Caoimh, who would later build WordPress MU, made more commits than in any other month of 2004, including fixes to email handling and permalinks.

Security Alerts and Plugin Vulnerabilities

• Public advisory: A few days before 1.2.1, an advisory about WordPress appeared on security lists. The team said the author had not contacted it first, and that the advisory was partly inaccurate and overhyped in later articles. It rated the issue low risk and said no one was known to have been affected. The team also noted that the previous WordPress advisory had been more than a year earlier.
• HTTP response splitting: A related problem was reported privately by a researcher calling himself “Chaotic Evil,” whom the team thanked for responsible disclosure. Fixing both issues properly was why 1.2.1 took a few days.
• Input cleanup: Dougal Campbell committed changes on October 2 that cleaned user input before it was used.

Industry Trends and Insights

October showed how much the field had changed in eighteen months. Six Apart had venture backing and two products. WordPress’s lead developer was taking a job at a large media company, with the project still run by volunteers. The 1.2.1 episode also showed WordPress facing the security scrutiny that comes with popularity, and it handled the episode by asking researchers publicly to report problems privately first.

Plugin of the Month: Staticize Reloaded

After Mullenweg opened Staticize to other developers in August, an updated Staticize Reloaded appeared. By October core had a switch_theme hook, which Boren used to clear Staticize Reloaded’s cache whenever a blog changed themes. It was an early example of core adding hooks so a popular plugin could work properly, and of the caching work that led to WP-Cache.

Founder of the Month: Matt Mullenweg

Mullenweg left Houston for San Francisco and a job at CNET, where he would spend about a year before leaving to work on WordPress full time and found Automattic in 2005. The move put WordPress’s lead developer in the middle of the Bay Area web industry just as the “Web 2.0” wave was starting.

Looking Ahead to November 2004

Mullenweg was settling into his new job at CNET, and work on 1.3 continued on themes, Pages and the expanded plugin API. No release date had been announced.