edik

So the developers decide the question, whether they should backport a security fix, spontaneously?

Security updates are backported to older version branches sometimes. For example the fixes from 3.8.2 was backported to the 3.7 branch: 3.7.2.

I don’t think that 4.1.1 loses the support immediately right after the release of 4.2.

I wrote a separate plugin for that problem. ??

Yeah, thanks! Sometimes I wonder whether there exist people who use my plugins.. ??

Line 27 is namespace login_redirection_link;. To use this plugin you have to use PHP 5.3 or later which support namespaces. I recommend an upgrade to at least version 5.4 because PHP 5.3 is also outdated even if some distributions like Ubuntu 12.04 LTS still support 5.3.

Is your login link hard coded?

The plugin hooks into login_url and logout_url. You have to call functions which make use of that filters. For example wp_loginout.

It doesn’t look to me that xmlrpc isn’t secured by the plugin. The plugin hooks to filters which are directly or indirectly called by wp_authenticate. The xmlrpc code uses this function too.

I think the problem is from somewhere else. One question: are the affected systems multisite installations?

Same problem here. I wrote a post and it was visible. Then I went to sleep. After wake up the post was lost.

That was more than 36h ago.

Update: I think I don’t go wrong using the modlook tag?

I wrote an alternative version of the plugin with some differences.

Now there also exists a mini plugin for my alternative which adds notifications for private posts .

Ah okay, I didn’t distinguished between trackbacks and pingbacks. But it seems that with your plugin pingbacks are checked for backlink twice. Only trackbacks need the check.

I have the same problem. It affects many subblogs. New blogs and old blogs. Some of them use the global keys, others don’t use the global keys. I don’t know why.

If I check the ‘use global keys’ check box of a blog which isn’t using global keys and press enter, it has no effect. The blog still doesn’t use the global keys.

The permission ‘Administer Groups plugin options’ is superfluous because you can use it to gain the permission ‘Administer Groups’. Vice versa owning the ‘Administer Groups’ permission you can get the ‘groups_admin_options’ capability aka ‘Administer Groups plugin options’. There is no security-related reason to distinguish between these permissions. You should merge them.

Okay, if so, I found a bug. ??
Notifly send emails for comments on private posts. But they are also private.

Besides a suggestion: what about a filter to allow notifications for private content? I’m sure that there are more users who need such a feature and it would prevent me from forking your plugin. And forks are evil. ??

Currently I replaced the code above by:

$public_statuses = array( 'publish', 'private' );
$only_updated = in_array( $old, $public_statuses );
$public = in_array( $new, $public_statuses );
if ( $only_updated || ! $own_public ) return;

Look at the ticket. You can use my patch to fix the bug for 3.8.1. But it only works with ‘published’ and private status. Look into my ticket comments before using it.

P.S: we’re developing also an ePortfolio. ??

Okay, it works now. Thank you very much!