WordPress MU 2.8.6

WordPress MU 2.8.6 has just been released and may be downloaded immediately.

This is a security release with the same fixes as WordPress 2.8.6 plus quite a few MU specific bug fixes too.

Please upgrade as soon as you can.


WordPress MU

Update! WordPress MU has a tiny fix for a post publish bug. You can download it from the usual place.

WordPress MU has just been released and may be downloaded immediately.

This is a security and bugfix release and a recommended upgrade for every WordPress MU site. What happened to 2.8.5? I had it tagged and ready for release when Luke reported a little problem. It wasn’t possible to edit blogs! It was an easy bug to fix but code had been tagged and zip/tarball archives created so I had to create new ones. Thanks Luke! Saved the day. 🙂

Thanks to everyone else who contributed and helped in any way during the making of this release. Your help is invaluable.

This release also fixes a problem with slashes in blog and site options. You’ll be prompted to run the site upgrader. Please run it on all your blogs. For a more comprehensive look at what has changed recently, take a look at the Trac Timeline.


WordPress MU 2.8.4

WordPress MU is a multi user or multi blog version of WordPress that is used to run sites like

Today’s WordPress MU release is 2.8.4, a security release that fixes an annoying bug that allowed any user to reset the admin password. Your password was never at risk however so it’s more an annoyance than anything else.

Oh, thanks to everyone who tested the exploit on my blog. See? You didn’t get my password! 😛

Upgrade automatically from within your dashboard (first fix the upgrader if you haven’t updated to 2.8.3 yet), or download the new release from the download page and upgrade manually, overwriting your current install with the new files.

Edit: James Collins noticed that line 164 of wp-login.php wasn’t merged properly. If you downloaded 2.8.4, please grab 2.8.4a. Thanks James for the prompt feedback!


WordPress MU 2.8.3

WordPress MU is a multi user or multi blog version of WordPress that is used to run sites like

WordPress MU 2.8.3 is a security and bugfix release based on the fixes in WordPress 2.8.3 but also contains many other changes.

It’s a required upgrade for security reasons but also fixes a number of annoying bugs, especially #1067 and #1076.

Unfortunately the automatic upgrader in MU 2.8.2 is broken but it’s simple to fix:

  • Before upgrading, edit wp-admin/includes/class-wp-upgrader.php and look for line 697.

    if ( !$wp_filesystem->copy($working_dir . ‘/wordpress/wp-admin/includes/update-core.php’, $wp_dir . ‘wp-admin/includes/update-core.php’, true) ) {

  • See the “/wordpress/wp-admin/includes” bit? Change that to “/wordpress-mu/wp-admin/includes”:

    if ( !$wp_filesystem->copy($working_dir . ‘/wordpress-mu/wp-admin/includes/update-core.php’, $wp_dir . ‘wp-admin/includes/update-core.php’, true) ) {

  • Save the file and auto upgrade. I upgraded this afternoon without a hitch after making that change. It’s fixed in 2.8.3 so it’s the last time you’ll have to do it.

Do not copy and paste the line above as WordPress will have changed the quotes to “smart quotes”. Actually go in and type “-mu” after “wordpress”. No copy and pasting please!

If auto upgrading still doesn’t work, don’t sweat it. Download the new release from the download page and upgrade manually, overwriting your current install with the new files.


WordPress MU 2.8.2

WordPress MU 2.8.2 has just been released. This is a security release with the same fix as the standalone WordPress.

WordPress 2.8.2 fixes an XSS vulnerability. Comment author URLs were not fully sanitized when displayed in the admin. This could be exploited to redirect you away from the admin to another site.

This release also fixes a number of other bugs, most notably the upgrade notice, but also fixes a number of other problems. See the timeline for a record of the latest activity.

Grab the new release from the download page or upgrade automatically from within WordPress MU.


Worldwide Photowalk on MU

For all you photographers out there, did you know the Worldwide Photowalk takes place next Saturday? It’s a good chance to meet other photographers in your area. It was a pleasant surprise when I realised their website runs on WordPress MU! I’m leading the Cork City Walk (still a few places left!) on Saturday and it was nice when I recognised what it was running on.

So, if you’re free on Saturday, check out the listings page. There might be a photowalk near you!

PS. If you’re running WordPress MU, check out the alpha release of the new version. It fixes a number of bugs in the original 2.8.1 release. It’s very stable but try it out on a test server first.


WordPress MU 2.8.1

WordPress MU is a multi user or multi blog version of WordPress that is used to run sites like

Just a day after WordPress 2.8.1 came out and here’s WordPress MU 2.8.1. The original WordPress announcement has plenty to say about this release, but what you need to know is this is a security update and a required upgrade.

This is the first MU 2.8.x release because of course there wasn’t a 2.8 one. Make sure you upgrade to stay up to date. The handy auto upgrade facility built in to the software should kick in but if not, go to the download page and grab the new zip file. Unzip over your current install and any database upgrades will take care of themselves when people login.

The WPMU Timeline is a good place to look to keep track of what has changed. Many bugs were squashed and features added.


WordPress MU 2.8.1 beta

Autumn Trees WordPress MU is a multi user or multi blog version of WordPress that can be used to run sites like

MU Admins! Please download and test on a test server! This is a beta release that is this <—> close to being final but it needs testing by the community.

It works fine on my test server but I haven’t been able to test every last thing to death. That’s where you come in. Download it, install it, login, look around. Notice anything broken? That’s what Trac is for. Verify you can repeat the problem, open a ticket and describe how the problem can be reproduced. Well done. You’ve just contributed to a Free Software project. 🙂

PS. I know there are two “My Blogs” links in the beta. That was fixed 2 days ago. Grab the zip file from the end of this page to get the most up to date code.


WordPress MU Catchup: big merge, wpmudev goes gpl and MU support

Exciting times in the world of WordPress and WordPress MU. Last weekend’s announcement by Matt that WordPress MU would merge into WordPress caused a flurry of activity and questions on twitter and on blogs, most notably with speculation that would run on MU and by jeffr0 who asked me on IRC what was happening.

Basically, the thin layer of code that allows WordPress MU to host multiple WordPress blogs will be merged into WordPress. I expect the WordPress MU project itself will come to an end because it won’t be needed any more (which saddens me), but on the other hand many more people will be working on that very same MU code which means more features and more bugfixes and faster too. It also means no more marathon code merging sessions. I certainly won’t miss that.

Meanwhile in the real world, there’s more merging to be done. WordPress 2.8 is expected next Wednesday and it has introduced fancy new stuff I haven’t finished fixing yet in WordPress MU. Expect an MU 2.8 beta sometime next week I hope.

In what I first thought was fabulous news, James Farmer has announced that WPMU DEV Premium has been relaunched. The site offered premium support for WordPress MU for a very long time. It also sold proprietary plugins which I’ve never agreed with (because of the conflict with WordPress) but now all plugins are GPL licensed.
Then I found out that you need to signup and pay a subscription fee to download them. I’m conflicted about it, because if I’m honest, while they’re sticking to the letter of the GPL, the spirit may be lacking.
So, should you signup there for a month, download all their plugins and upload them to It’s tempting isn’t it? But no, you shouldn’t. This is real income for James, Andrew and company. If their plugins are uploaded elsewhere will they be updated? Will you signup for another month and grab them all again and upload each and every one to separate Subversion repositories? Will you provide support when things go wrong? I didn’t think so.
If it really bothers you that GPLed plugins are not available “free as in beer” then write your own and support it. It’s not something to be done lightly.

When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things.

(GNU GPL v2.0)

Of course, WPMU DEV aren’t the only MU support people in town. Check out Ron & Andrea’s and of course I recommend the Automattic Support Network where you’ll find me and the rest of Automattic.

WordPress Development

Looking at a WPMU Object Cache

In the good ol’ days WordPress came with a filesystem object cache but it was removed some time ago because it was a pain to maintain, and caused problems for some users, especially those using NFS. Nowadays there is an object cache built in, but the cache only survives for as long as a page is being served.
Other developers have taken up the challenge and produced object cache plugins to fill in the gap. There are the neosmart ones including a filesystem object cache and a memcached one (Read Andy’s notes before installing).

The neosmart filesystem object cache (and the others according to #988) don’t work correctly with WordPress MU so I dug up a patched version of the filesystem object cache I worked on a year ago to look for testers.

Download object-cache.txt, rename to .php and copy into wp-content/. It should start working automatically but if you don’t see files and directories in wp-content/cache/, make sure that directory is writeable by the webserver.

The neosmart version on which this one is based doesn’t handle switching blogs at all. Cache collisions occur with data from one blog’s options polluting the options in others. The version linked above should fix that but I’d appreciate some testing by others.

Oh, check out WordPress MU trunk now. I merged WP 2.8 beta1 and I’m fixing bugs. Please install and try it out on a test server! The get_option() and related code is using the same code as which is one of the main reasons I went digging into the object cache. It leans a lot more on the cache than previously. Please test!