Skip to Content.
Sympa Menu

ibiblio-announce - [ibiblio-announce] important WordPress SECURITY upgrade

ibiblio-announce AT lists.ibiblio.org

Subject: ibiblio services/changes announcement list

List archive

Chronological Thread  
  • From: Cristóbal Palmer <cmpalmer AT metalab.unc.edu>
  • To: ibiblio-announce AT lists.ibiblio.org, webgroup AT lists.ibiblio.org
  • Subject: [ibiblio-announce] important WordPress SECURITY upgrade
  • Date: Tue, 11 Aug 2009 21:43:15 -0400

For those of you running WordPress, please log in promptly and upgrade
your sites to 2.8.4, the latest stable release. This upgrade fixes a
security vulnerability that exposed you to remote, unauthenticated
reset of your admin account.

Instructions for upgrading are here:

http://www.ibiblio.org/wordpress/

Copied below for your convenience:

== Upgrading WordPress on ibiblio ==

Note that lines starting with a "$" indicate commands issued from
login.ibiblio.org. The "$" is the command prompt and is not part of
the command you would enter. Similarly, items in ALL CAPS definitely
need to be replaced by values that match your site.

1. Use an SSH client to connect to login.ibiblio.org.

2. Back up your database tables. This only takes a minute and can
really save you some headaches:

$ mysqldump -h MYSQL.ibiblio.org -u MYSQLUSER
--password="SOMEPASSWORD" YOURDBNAME > WORDPRESS-YYYYMMDD.sql

Don't forget to subsitute the values above with yours. For
instance, your database server might be mysql2.ibiblio.org, and
YOURDBNAME will be the name of your mysql database, etc. If you don't
know these values but have a working Wordpress install, you can find
them in your wp-config.php file. Please NOTE that the backup process
will brieflly lock the database, making your site inaccessible. This
usually takes less than 30 seconds, but if you're worried about it, do
it during off-peak hours. To save space, please gzip your SQL backup
file:

$ gzip WORDPRESS-YYYYMMDD.sql

3. Disable all plugins. Wordpress upgrades can cause irreversible
damage in some cases if you fail to disable your plugins. You did make
a backup, right?

4. Change directories to the directory above your WordPress installation:

$ cd /public/html/YOURSITE

If your blog is a subdirectory named "wordpress" then you would
do the following:

$ wget http://wordpress.org/latest.tar.gz
$ tar xvfz FILE_JUST_SAVED_BY_WGET
$ rm FILE_JUST_SAVED_BY_WGET

WordPress may want to modify its database tables to accomodate
the new version. Browse to
http://www.ibiblio.org/YOURSITE/wp-admin/upgrade.php and follow the
instructions.

5. If your blog isn't a subdirectory named "wordpress" you'll want to do
something like:

$ mkdir ~/tmp
$ cd ~/tmp
$ wget http://wordpress.org/latest.tar.gz
$ tar xvfz FILE_JUST_SAVED_BY_WGET
$ rm FILE_JUST_SAVED_BY_WGET
$ rsync -av wordpress/ /public/html/YOURSITE/YOURWORDPRESSDIR/

Then proceed to the upgrade itself by browsing to
http://www.ibiblio.org/YOURSITE/YOURWORDPRESSDIR/wp-admin/upgrade.php
and following the instructions.

6. Re-enable your plugins, one by one. If you enable a plugin and
then can't get to your blog, use your SSH/SFTP client to go into your
wp-content/plugins directory, and remove the plugin that caused things
to break. You can simply rename the directory for the offending plugin
and it will be automatically disabled.

That should do it! Please do be sure to subscribe to ibiblio-announce
and webgroup, as the former is your way to stay informed of system
changes and outages, while the latter tends to pick up discussion
about web applications such as WordPress.

== What to do when you have problems running WordPress on ibiblio ==

* First thing, please do make sure you're running the most current
version of WordPress. They make releases to fix bugs and security
problems much more often than to add new features. The instructions
above can help you with this.
* The most common WordPress problems stem from buggy plugins. If
you get strange or inconsistent error messages, try disabling your
plugins, then re-enabling them one by one. This should help isolate if
a particular plugin is causing a problem for you.
* If you're comfortable at the command line, look in the
logs. You'll want to pull your site from one of the two contructs, the
first if you're on ibiblio.org proper, the second if your site is
virtually hosted:

http://www-dev.ibiblio.org/YOURSITE/wordpress/
http://www.YOURDOMAIN.ORG.test.ibiblio.org/wordpress/

Logs for the current day are available via login.ibiblio.org in

/public/var/log/www-dev/

* If these steps don't take care of things, please do drop us a
note via

http://www.ibiblio.org/help

and a member of the ibiblio team will be back in touch with you.

Cheers,
--
Cristóbal Palmer
ibiblio.org systems administrator
cdla.unc.edu research assistant



  • [ibiblio-announce] important WordPress SECURITY upgrade, Cristóbal Palmer, 08/11/2009

Archive powered by MHonArc 2.6.24.

Top of Page