WordPress MU is a multi user or multi blog version of WordPress that is used to run sites like WordPress.com.
Today’s WordPress MU release is 2.8.4, a security release that fixes an annoying bug that allowed any user to reset the admin password. Your password was never at risk however so it’s more an annoyance than anything else.
Oh, thanks to everyone who tested the exploit on my blog. See? You didn’t get my password! 😛
Upgrade automatically from within your dashboard (first fix the upgrader if you haven’t updated to 2.8.3 yet), or download the new release from the download page and upgrade manually, overwriting your current install with the new files.
Edit: James Collins noticed that line 164 of wp-login.php wasn’t merged properly. If you downloaded 2.8.4, please grab 2.8.4a. Thanks James for the prompt feedback!
28 replies on “WordPress MU 2.8.4”
It’s done! Thanks!
[…] Entwickler-Statement […]
Minor bug. 😀
Thanks for the quick 2.8.4a. I saw the announcement last night, but I’ve learned to wait a little bit to see if it was a clean merge or not.
Well done, my blog has not been attacked anyway 😉
[…] discusses this “Oops!” on his blog entry about the WPMU 2.8.4 release: http://ocaoimh.ie/wordpress-mu-2-8-4/ […]
Hmmm … you know, I was joking in the 2.8.3 comments when I said “I look forward to next week’s release of 2.8.4”
Oh well, roll on 2.8.5 🙂
I give it two days. 😉
And the merge wordpress in wordpress mu?
Some news?
[…] Via | WordPress Blog | Ocaoimh.ie […]
@wordskill.. I saw that and I think you might have jinxed it, and @donncha – thks
Donncha, Thanks for the quick update. I received an email from one of my blogs (not MU) asking for a password reset. I ignored it. The bug is harmless, but it is annoying. Thanks.
[…] Read the full post on Donncha’s blog. […]
[…] fecha de 13 de agosto de 2009, la plataforma Multiblog del PNTE ha sido actualizada a la versión 2.8.4a de WordPress MU, que corrige algunos fallos de seguridad observados en las versiones de la serie […]
Thanks for the update.
When I log into my admin area, at the bottom of the page, on the left hand side it says: Thank you for creating with WordPress MU 2.8.4a.
However, on the same line, on the right hand side, it says:
You are using a development version (2.8.4). Cool! Please stay updated and links to download the latest version.
Curious.
In the actual blog the generator is:
What gives? Do I or do I not have 2.8.4a?
Vikram
Vikram – you’re using 2.8.4a, sorry for the confusion. The “You are using a development version” message should disappear next time your site checks the version number today.
Unfortunately the footer will say 2.8.4 on the right but that’s incorrect. The version number on the left is correct.
Hi, I have an upgrade question that’s been bothering me, as a mere mortal in the world of software installation.
My website is currently running WordPress MU 2.6.5. I would like to upgrade to 2.8.4a. Can I just do a single upgrade, or do I have to upgrade to 2.7, then 2.8.1, etc.?
Your instructions are generally very clear, thanks so much, and I hope you can help me out with figuring this one out.
[…] hot on the heels of last week, WPMU 2.8.4a is out with a security fix. If you are stuck at 2.8.1 and have trouble with the auto-upgrade, you have to apply the edits […]
When I try to auto-upgrade from 2.8.4 to 2.8.4a I get this error:
Downloading update from http://mu.wordpress.org/nightly-builds/wordpress-mu-latest.zip.
Download failed.: Not Found
Installation failed
Hi Donnacha,
Quick question, is there a simple mailing list one can subscribe to, so I can get an email when a new version/update of WP or WPMU appears? (I’ve looked. I dont have a wordpress account.) I was hoping of a nice quite mailing list I can join.
Thanks,
Stephen
There’s no mailing list, but you can subscribe to the rss feed for the WordPress category on this blog. There’s the occasional post about other plugins but it’s low noise and on-topic.
what are the chances that WordPress MU will be scrapped, Matt has been speaking of some sort of merger of wordpress standard and MU?
Technically speaking, it’s not being scrapped at all. In one sense, it means MU is becoming the standard, as of the merger.
What I’d like to know is what they plan on doing with mu.wordpress.org, and more importantly the forums. Are they going to be merged? Are we going to have to mingle with all those old-time stand-aloners? Must we bump elbows now? *shudder* I heard they make their martini’s with vodka instead of gin.
well done its work thank especial security release
Hey NICE WORK keep it up..Learning tits and bits of WordPress hope to contribute in this amazing work soon.
I have a question regarding timthumb.Usually when we use tithumb it points the themes folder in the blog directory.
But as in WPMU the blog directory is different how can we use the timthumb script situated at the themes folder.
It is the basic consideration for pulling the post thumbnails.
Thanks
I also ran into this problem, here is my workaround:
<img src="/wp-content/themes/themename/thumb.php?src=http://example.com/wp-content/blogs.dir//ID, “image”, $single = true); ?>&h=57&w=100&zc=1&q=95″ alt=”” />
-Robert
Pastebinlink: http://pastebin.ca/1537472 since WP striped out the php tags in my post.. Should have seen that one coming…
Donncha,
Does this attack that is going round at the moment affect earlier versions of WordPress MU? Since keeping MU totally up to date can be a bit tricky I’m wondering if this affects 2.7 users etc.
[…] I didn’t have to! Googled and found this and it worked […]