Time to upgrade your WordPress installation.    An exploit has been discovered with the version of Suhosin that is used in the previous versions of WordPress.  

Stefan Esser recently warned developers of the dangers of SQL Column Truncation and the weakness of mt_rand().  With his help we worked around these problems and are now releasing WordPress 2.6.2.  If you allow open registration on your blog, you should definitely upgrade.  With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another user’s password to a randomly generated password.  The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit.  However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password.  Stefan Esser will release details of the complete attack shortly.  The attack is difficult to accomplish,  but its mere possibility means we recommend upgrading to 2.6.2.

In the unlikely event that you have already updated your version of Suhosin, you are protected.   I would still upgrade to take advantage of the many bug fixes that have been released.

Download the latest version of WordPress.

If you have been waiting for a “dot one” version release before upgrading WordPress, now is your time. WordPress has made version 2.6.1 available for download. With 2.6.1, WordPress continues their trend of releasing a maintenance update shortly after a major release in order to fix bugs that always follow a “dot zero” release. This is not a security release so you don’t have to upgrade if you are already running 2.6.0 and are happy with it.

Check out the full list of over 60 fixes to see if 2.6.1 has something to offer you.   If you’re still using WordPress 2.5 because you were waiting for the dot one release of 2.6, then now is the time to upgrade.

Download WordPress 2.6.1

The creators of WordPress has released a very important security update for their blogging platform. Anyone running WordPress 2.5 must upgrade to this latest release.

Version 2.5.1 of WordPress is now available. It includes a number of bug fixes, performance enhancements, and one very important security fix. We recommend everyone update immediately, particularly if your blog has open registration. The vulnerability is not public but it will be shortly.

In addition to the security fix, WordPress 2.5.1 contains over 70 bug fixes. Here are some highlights.

• Performance improvements for the Dashboard, Write Post, and Edit Comments pages.
• Better performance for those who have many categories
• Media Uploader fixes
• An upgrade to TinyMCE 3.0.7
• Widget Administration fixes
• Various usability improvements
• Layout fixes for IE
  
Download the latest version of WordPress

So, you have a domain name that you are planning on doing something with.   You are all excited when you register it.  Then you realize you have to do something with it.   It seems like most registrars will graciously let you park the domain and present all sorts of advertising on the page.  You have already paid money for your domain, and now they get to benefit of advertisements on your site.

Enter the LaunchPad theme for WordPress by ThemeShaper.   With this theme you are able to turn a useless advertising page into a visually appealing parking page to announce your new service.   It integrates feedburner for RSS feeds and allows visitors to subscribe via e-mail. 

I have personally used this to park a few domains I am working on.   It is a simple visually appealing theme.

A security fix for WordPress has been released.  This fix addresses a flaw in the XML-RPC implementation that effects users with registration enabled.   Using a specially crafted URL would enable a user to edit posts of other users.  

You can either download and install the upgrade using the update procedures on the WordPress site or by using the WordPress Automatic Upgrade WordPress plug-in.   This plug-in has to be one of my favorite plug-ins I have used because it takes the pain out of upgrading.   It can also be a great time saver when you are responsible for updating multiple WordPress installations.  Either way you choose, it is time to upgrade.

In an earlier post I showed you how to use Feedburner with the Wordpress theme WP Bliss.  But that is not the only thing that I knew I needed to change when I chose to use this theme for TRF.  I needed to update the 3 100×100 Ad boxes on the right sidebar. The author has done a wonderful job leaving space but to take advantage of it you will need to make some minor edits to the theme.

Don’t worry, this change is easy, and only requires one changes to one file.   This single file is named "sidebar_featured.php".     Once you have the file loaded in your text editor, you should see the following 3 lines.

<a href="#"><img src="&lt;?php bloginfo('template_url'); ?>/images/thumb1.gif"></img></a>

<a href="#"><img src="&lt;?php bloginfo('template_url'); ?>/images/thumb2.gif"></a>

<a href="#"><img src="&lt;?php bloginfo('template_url'); ?>/images/thumb3.gif"></img></a>

These 3 lines represent the 3 100×100 boxes that are made available for ads.  Since I only wanted to show a single ad, I deleted the placeholder content.  As a note, the second line is missing a "</img>" tag.    In my example, I don’t use any of this code, but if you choose to use all 3 boxes you will want to correct the HTML code and properly close the tag.  

I use Google adsense to monetize this blog and for the space in question I chose to use a referral ad.  I made my selections in Adsense and copied provided HTML script code to the file.   After saving it and uploading it up to my theme’s directory on the server, my ads soon started to appear.

As I stated earlier, this customization is an easy one.  Replace the placeholder HTML code with your ad network code and you are off to the races, just make sure to close your tags and don’t make it wider than the column.

In a previous post,  I found my new theme.    I am still very pleased with it but when I was "kicking the tires", I realized the RSS e-mail subscriptions form was not working.   When digging into the code I noticed that I needed to make a change to get it to work.

In order to make the changes we need to edit the WP Bliss header.php file.  Near the bottom, you will find the "subscribeform" div (see below).

<div class="subscribeform">

 <p>Subscribe via Email </p>

   <form action="enter your feed address here" method="get">          

     <input type="text" value="" class="input" />  

     <input type="button" class="sbutton" value="Subscribe" />

   </form>

 </div>

This is the only place we will need to make edits.   First you need to replace the "enter your feed address here"  with the Feedburner address http://www.feedburner.com/fb/a/emailverify and change the method from "get" to "post".

On the first input line, we need to add name="email"  before the class="input" .  We also need to change the input type on the 2nd input line.   Change the type="button" to type="submit" .

But we aren’t done yet, we also need to add 2 hidden input lines to this html form.   One needs to be named "title" with of a value of your blog’s name.   For this blog it should look like:

<input type="hidden" value="Tree Rat Fishing" name="title"/> 

The second hidden input needs to be named "url" with a value of "http://feeds.feedburner.com/~e?ffid=YOUR_FEED_BURNER_ID".   You can find this Feedburner ID in the code presented in the Publicize / Email subscriptions of your feedburner control panel.  For this blog it should look like:

<input type="hidden" value="http://feeds.feedburner.com/~e?ffid=452013" name="url"/>

<div class="subscribeform"> 

  <p>Subscribe via Email </p> 

  <form action="http://www.feedburner.com/fb/a/emailverify" method="post" target="popupwindow" onsubmit="window.open('http://www.feedburner.com', 'popupwindow', 'scrollbars=yes,width=550,height=520');return true">           

    <input type="text" value="" name="email" class="input" />  

    <input type="submit" class="sbutton" value="Subscribe" /> 

    <input type="hidden" value="http://feeds.feedburner.com/~e?ffid=452013" name="url"/> 

    <input type="hidden" value="Tree Rat Fishing" name="title"/> 

  </form> 

</div>

In my example, I also added some code to the form action line that opens this subscription page to a new browser windows.   This way the user never leaves my site.  To see it in action, put your e-mail address in the subscription form above and put your name in the hat for a subscription to TRF.

Feel free to leave a comment if you are having any problems with getting this working on your blog.

 Do you have the answer?   Pingdom does with their new “full page test” tool.   With this tool, you enter you website URL it loads up your page including all images, and JavaScript as if a user went to your site.   It then presents you with your individual file load times, in the order that they would be downloaded. 

How fast is your site?