WordPress Release: 4.1.19

TL;DR

WordPress 4.1.19 is a security and maintenance release that addresses several important security vulnerabilities and includes improvements to the database handling, editor, and filesystem API. This update focuses on hardening WordPress against potential security issues, particularly in URL handling, database preparation, and file extraction processes.

Highlight of the Release

• Security hardening for wpdb::prepare() to prevent potential SQL injection vulnerabilities
• Prevention of javascript: and data: URLs in the inline link dialog
• Improved validation of file paths during extraction to prevent path traversal attacks
• Enhanced URL encoding and hardening for plugin and template names in admin areas
• Improved shortcode previews in the TinyMCE editor

Migration Guide

No specific migration steps are required for this update. This is a maintenance and security release that should be applied as a standard update without breaking existing functionality.

However, developers who use wpdb::prepare() should note that the function now more strictly follows its documentation. The function only supports %s, %d, and %F as placeholders, and any other non-escaped % characters will be escaped. Additionally, when passing arrays of values for placeholders, any additional values will now be ignored.

Upgrade Recommendations

This release contains important security fixes that address multiple vulnerabilities. Immediate upgrade is strongly recommended for all WordPress 4.1.x installations.

While WordPress 4.1 is no longer receiving active development or feature updates, these security patches have been backported to ensure continued protection for sites still running this version. However, for the best security, performance, and feature set, users should consider upgrading to the latest major version of WordPress.

Bug Fixes

• Fixed an issue with incorrect HTTP referrers by providing a fallback mechanism
• Addressed handling of null values in wpdb::prepare() to prevent unnecessary _doing_it_wrong() warnings
• Corrected URL escaping function usage for user-related URLs

New Features

No significant new features were added in this release. WordPress 4.1.19 is primarily a security and maintenance release focused on addressing security vulnerabilities and improving existing functionality.

Security Updates

• Editor Security: Prevented adding potentially malicious javascript: and data: URLs through the inline link dialog
• Filesystem API: Enhanced validation of filenames before unzipping to prevent path traversal attacks
• Database Security: Multiple hardening improvements to wpdb::prepare():
  • Ensuring additional values passed in arrays are properly ignored
  • Bringing implementation in line with documentation by properly escaping non-placeholder percentage signs
  • Stricter handling of placeholders (%s, %d, and %F)
• Admin Security: Added missing URL-encoding and extra hardening to plugin and template names when displayed in admin areas
• User Management: Improved URL handling with correct escaping functions

Performance Improvements

This release does not contain any significant performance improvements. The changes are primarily focused on security enhancements and bug fixes rather than performance optimizations.

Impact Summary

WordPress 4.1.19 is a critical security release that addresses multiple vulnerabilities that could potentially be exploited by malicious actors. The update focuses on hardening the core WordPress system against SQL injection attempts, path traversal attacks, and XSS vulnerabilities.

The most significant changes involve improvements to database query preparation, URL handling, and file extraction validation. These changes help protect WordPress sites from common attack vectors without impacting normal site functionality.

For developers, the stricter enforcement of wpdb::prepare() documentation may require attention if custom code uses this function in ways that don't align with the official documentation.

This release demonstrates WordPress's ongoing commitment to security for all supported versions, even those in long-term maintenance mode.