Building themes, plugins, and applications in WordPress requires a variety of tools that help with development. In this article, we take a look at the best tools available for devs. They’re broken up by category for easier navigation. WordPress 4.6.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.
WordPress versions 4.6 and earlier are affected by two security issues: a cross-site scripting vulnerability via image filename, reported by SumOfPwn researcher Cengiz Han Sahin; and a path traversal vulnerability in the upgrade package uploader, reported by Dominik Schilling from the WordPress security team. Thank you to the reporters for practicing responsible disclosure. In addition to the security issues above, WordPress 4.6.1 fixes 15 bugs from 4.6. For more information, see the release notes or consult the list of changes.
Download WordPress 4.6.1 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.6.1.
Sticky Posts
After much debate, there is now a path forward for handling sticky posts as well. Following this open pull request, sticky posts are included in the /WP/v2/posts collection, but are not given special treatment in terms of ordering—a sticky post will, by default, be displayed ordered by date or whatever order by has been set for the request. The parameter? Sticky=true may be passed to return only sticky posts; ?sticky=false may be passed to exclude sticky posts from the response. There is ongoing discussion around how the API could surface posts in the “normal loop order,” with stickies on top, followed by non-sticky posts. @jorbin will propose a follow-up enhancement that could be added to the API in a later cycle. See GH issue #2210 and associated slack discussion for more commentary.
Password-Protected Posts
As noted in last week’s dev chat, password-protected posts will be included in collections with their content set to ”, and the content can be viewed by passing ?password=XXXXX as a query or GET parameter when querying for a specific post. GET is not an ideal solution Authorization headers are out because you can’t have multiple authorization schemes in one request; cookies don’t afford enough control to browser clients, and custom headers aren’t respected by cache. See GH issue #2701 for more background, and check out the open pull request to review the specifics of the implementation.
Go to the original source: http://www.creativethoughtsinfo.com/wordpress-development-services-making-websites-remarkable/
Comments
Post a Comment