[wp-testers] Flash uploader broken in latest beta 1

[Austin Matzko]

On Sat, Nov 1, 2008 at 12:03 PM, Kirk M <kmb42vt at gmail.com> wrote:
> True enough although I can't pinpoint the wp-testers message that states it.
> But for what it's worth, the makers of the Flash based uploader are supposed
> to come out with a new version of the SWF Uploader before 2.7 is released.
> The current version is supposedly not compatible.

The problem is that Flash 10 had security changes that invalidated the
way WordPress used to employ the Flash uploader.  It used to be that
you would click the upload button, and then a script would call Flash
to work in the background to open up the file browser so that you
could select multiple files, etc.  You can't do that in Flash 10[1],
because it no longer lets a separate script initiate browsing and
uploading functions.  (The reason is that malicious sites could use
such scripts to trick users into doing things they didn't want to do.)

So the Flash uploader that WordPress uses, SWFUpload, has been updated
to address this issue in the (currently beta) 2.2.0 release, and
WordPress 2.7 (also in beta) is using SWFUpload 2.2.0.

[1] http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes_02.html#head3