ClassicPress 2.7.4 Release Notes

Announcements Release Notes
1

We’re happy to announce the release of ClassicPress 2.7.4.

This is a security release.

Security Fixes

  • Fixed password validation in wp_validate_user_request_key()
  • Media library: only show titles of private posts the viewer can read
  • Added capability check on profile page for user taxonomies
  • REST API: Require both capabilities to change a post’s sticky status.
  • Query: Prevent exposure of comments on unviewable posts.
  • Posts, Post Types: Fire dynamic status transition hooks only for registered statuses and post types.
  • Administration: Treat contextual help tab links as selectors.
  • Embeds: Remove support for Imgur oEmbeds.
  • HTTP: Improve relative path resolution in WP_Http::make_absolute_url().

The ClassicPress core team would like to thank d3do-23 and Hunter-Sploit for responsibly reporting vulnerabilities and assisting in creating fixes for this release.

Contributors

In no particular order the following people have contributed to this ClassicPress release:

ClassicPress props

Matt Robinson, Simone Fioravanti, Tim Kaye, d3do-23, Hunter-Sploit.

ClassicPress committers (in random order)

Matt Robinson.

WordPress props

xknown, jeremyfelt, jorbin, peterwilsoncc, ehtis, westonruter, lancewillett, jonsurrell, marcs0h, rfaile313, johnbillion, vortfu.

Download this release

New sites Download
ClassicPress-release-2.7.3.zip
and follow the installation instructions.
Existing WordPress sites Download the migration plugin and follow the migration instructions.
Existing ClassicPress sites Use the built-in update mechanism (more info).

Full changelog

The full changelog is available on GitHub.

3 Likes