This is a security update since last WordPress release 3 weeks ago. WordPress 3.1.2 comes with couple of bug fixes and no database changes. Fixes stated are:

  • Fix a vulnerability that allowed Contributor-level users to improperly publish posts.
  • Fix user queries ordered by post count.
  • Fix multiple tag queries.
  • Prevent over-escaping of post titles when using Quick Edit for pages.

 

In a Nutshell

  • WordPress uncompressed folder size remains relatively unchanged at 8.23 Mb
  • 8 files are modified. Within the wp-admin folder 3 files are modified

 

The Full Length

This will cover only the logical changes. Texture and style changes will be overlooked. Minor code refactoring may also be ignored if the changes are for standardisation. A complete diff’ing coverage is available on WordPress trac.

 

/wp-admin

  • /includes/class-wp-posts-list-table.php
    • Tweak position of HTML escape on post title in display_rows() function.
  • /press-this.php
    • Validate user authority when setting post status in press_it() function.

/wp-include

  • /query.php
    • Logic tweak on query parsing in parse_query() function.

 

Summary

This is a technical blog post covering implementation changes of latest WordPress, version 3.1.2 from its pervious version 3.1.1. I will line out code changes to help enthusiast PHP developer understanding the techniques and security concerns.