[wp-testers] About DB Backup

[Robert Deaton]

On 9/25/06, Lloyd D Budd <lloydomattic at gmail.com> wrote:
> On 9/25/06, Robert Deaton <false.hopes at gmail.com> wrote:
> > While this is all great, and I do like the idea of XML import and
> > output,  I don't think the DB backup plugin should be dropped from the
> > core at this point. Why? Because of the security issues. People
> > upgrading from 2.0.4 or previous directly to 2.1 still have the old,
> > vulnerable backup plugin. Most people won't know its even been dropped
> > because you are instructed not to delete anything in your wp-content
> > folder on upgrade. And no, I do not think that instructing users to
> > get rid of the backup plugin is enough, it adds more complexity to the
> > upgrade docs and nobody would listen anyways.
>
> Hi Robert,
>
> There is a 2.0.5 release planned that I understand addresses the known
> issues at this time.
>
> How does leaving what sounds to be a mostly unmaintained plugin in 2.1
> solve any problems either?

If you don't upgrade to 2.0.5, you have the vulnerable plugin in your
plugins directory. There are still many 2.0.2 blogs out in the wild at
this point, and for those who won't upgrade to 2.1, they may still use
and still have a vulnerable plugin. Mark it deprecated and recommend
the XML export on the plugins panel and on upgrade for all I care, but
deleting the plugin from wp-content doesn't make it go away for people
who already have it from their last WP upgrade or their most recent
install.

In retrospect, had I known that this would happen when the db backup
plugin was added, I would've pushed and helped get the XML export done
for 2.0, so that the plugin would've never been added to core. Imho, a
plugin of this nature, once added in the core, needs to stay in the
core, because as another vulnerability for it may be published,
upgrades to WP won't address the problem, and many will assume it will
because it came bundled when they installed WP.

-- 
--Robert Deaton