{"id":185924,"date":"2017-01-12T07:24:39","date_gmt":"2017-01-12T06:24:39","guid":{"rendered":"http:\/\/www.borncity.com\/blog\/?p=185924"},"modified":"2024-10-04T20:25:11","modified_gmt":"2024-10-04T18:25:11","slug":"wordpress-4-7-1-freigegeben","status":"publish","type":"post","link":"https:\/\/borncity.com\/blog\/2017\/01\/12\/wordpress-4-7-1-freigegeben\/","title":{"rendered":"WordPress 4.7.1 freigegeben"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline;\" src=\"https:\/\/borncity.com\/blog\/wp-content\/uploads\/2014\/07\/wp_thumb.jpg\" alt=\"\" width=\"64\" height=\"64\" align=\"left\" \/>Die Entwickler haben am 11. Januar 2016 WordPress Version 4.7.1 allgemein freigegeben. Es handelt sich um ein Sicherheits-Update, welches einige Sicherheitsanf\u00e4lligkeiten schlie\u00dft und z\u00fcgig installiert werden sollte.<\/p>\n<p><!--more--><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/ssl-vg03.met.vgwort.de\/na\/eb3c6ce58e01468ab7d66aaaa17d9796\" alt=\"\" width=\"1\" height=\"1\" \/>Mir wurde dieses Update die Nacht im Blog angeboten und dann auch problemlos installiert. Es empfiehlt sich aber, vor der Installation ein Update der Datenbank anzufertigen. Blog-Inhalte kann man im Dashboard z.B. \u00fcber <em>Werkzeuge \u2013 Daten exportieren <\/em>lokal speichern lassen.<\/p>\n<h3>WordPress 4.7.1-Korrekturen<\/h3>\n<p>Hier im Blog hatte ich ja \u00fcber die Sicherheitsl\u00fccke im PHP-Mailer berichtet (<a href=\"https:\/\/borncity.com\/blog\/2016\/12\/27\/pwnscriptung-phpmailer-lcke-macht-wordpress-angreifbar\/\">PwnScriptung: PHPMailer-L\u00fccke macht WordPress angreifbar<\/a>). Die L\u00fccke hielt sich zwar in Grenzen und konnte hier im Blog nicht ausgenutzt werden. Aber es gab weitere unsch\u00f6ne Sachen, wie die M\u00f6glichkeit, Benutzerkontennamen \u00fcber die REST API zu sammeln. Das Thema hatte ich im Blog-Beitrag <a href=\"https:\/\/borncity.com\/blog\/2016\/12\/26\/wordpress-rest-api-ermglicht-konten-harvesting\/\">WordPress: REST API erm\u00f6glicht \"Konten-Harvesting\"<\/a> angerissen \u2013 hier im Blog verhindert eine Firewall diesen Angriff.<\/p>\n<p>Jedenfalls hat das WordPress-Entwicklerteam reagiert und mit der WordPress Version 4.7.1 folgende L\u00fccken geschlossen bzw. \u00c4nderungen durchgef\u00fchrt (<a href=\"https:\/\/codex.wordpress.org\/Version_4.7.1\" target=\"_blank\" rel=\"noopener\">siehe<\/a>).<\/p>\n<ol>\n<li>Remote code execution (RCE) in PHPMailer \u2013 <i>No specific issue appears to affect WordPress<\/i> or any of the major plugins we investigated but, out of an abundance of caution, we updated PHPMailer in this release.<\/li>\n<li>The REST API exposed user data for all users who had authored a post of a public post type. WordPress 4.7.1 limits this to only post types which have specified that they should be shown within the REST API.<\/li>\n<li>Cross-site scripting (XSS) via the plugin name or version header on <code>update-core.php<\/code>.<\/li>\n<li>Cross-site request forgery (CSRF) bypass via uploading a Flash file.<\/li>\n<li>Cross-site scripting (XSS) via theme name fallback.<\/li>\n<li>Post via email checks <code>mail.example.com<\/code> if default settings aren't changed. Reported by John Blackbourn of the WordPress Security Team.<\/li>\n<li>A cross-site request forgery (CSRF) was discovered in the accessibility mode of widget editing.<\/li>\n<li>Weak cryptographic security for multisite activation key.<\/li>\n<\/ol>\n<p>WordPress 4.7.1 also fixes 61 bugs from <a href=\"https:\/\/codex.wordpress.org\/Version_4.7\" target=\"_blank\" rel=\"noopener\">Version 4.7<\/a>, including:<\/p>\n<p>Bootstrap\/Load<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39132\">#39132<\/a> \u2013 WP 4.7, object-cache.php breaks the site if APC is not enabled in php<\/li>\n<\/ul>\n<p>Build\/Test Tools<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39327\">#39327<\/a> \u2013 Database connection errors in unit tests on 4.7<\/li>\n<\/ul>\n<p>Bundled Theme<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39138\">#39138<\/a> \u2013 wordpress 4.7 default theme does not get installed when upgrading<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39272\">#39272<\/a> \u2013 Twenty Seventeen: Incorrect $content_width<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39302\">#39302<\/a> \u2013 Twenty Seventeen: Featured image not displayed on single template<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39335\">#39335<\/a> \u2013 Twenty Seventeen: customize-controls.js incorrectly assumes theme_options section is always present<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39109\">#39109<\/a> \u2013 Twenty Seventeen: starter content array needs a filter<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39489\">#39489<\/a> \u2013 Twenty Seventeen: Bump version and update changelog<\/li>\n<\/ul>\n<p>Charset<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/37982\">#37982<\/a> \u2013 4.6.1 Breaks apostrophes in titles and utf-8 characters<\/li>\n<\/ul>\n<p>Comments<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39280\">#39280<\/a> \u2013 comment permalink wrong in WordPress 4.7<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39380\">#39380<\/a> \u2013 wp_update_comment can cause database error with new filter<\/li>\n<\/ul>\n<p>Customize<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39009\">#39009<\/a> \u2013 Customizer: the preview UI language should be the user language<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39098\">#39098<\/a> \u2013 Customize: Clicking on child elements of preview links fails to abort navigation to non-previewable links<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39100\">#39100<\/a> \u2013 Customize: Edit shortcuts do not work if page hasn't been saved and published<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39101\">#39101<\/a> \u2013 Customize: edit shortcuts for custom menu widgets do not work<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39102\">#39102<\/a> \u2013 Customize: Shift-click on placeholder nav menu items fails to focus on the nav menu item control<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39103\">#39103<\/a> \u2013 Customize: menus aren't deleted<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39104\">#39104<\/a> \u2013 Customize: starter content home menu item needs to be a link, not a page<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39125\">#39125<\/a> \u2013 Customize: Video Header YouTube field has issues when whitespace is inserted at beginning or end of URL<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39134\">#39134<\/a> \u2013 Customize: custom CSS textarea is scrolled to top when pressing tab<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39145\">#39145<\/a> \u2013 custom-background URL escaped<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39175\">#39175<\/a> \u2013 Customizer assumes url is passed with replaceState and pushState<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39194\">#39194<\/a> \u2013 Invalid parameters in Custom CSS and Changeset queries<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39198\">#39198<\/a> \u2013 Customize: Apostrophes in custom CSS cause false positives for validation errors<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39259\">#39259<\/a> \u2013 'custom_css_post_id' theme mod of `-1` doesn't prevent queries<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39270\">#39270<\/a> \u2013 Use a higher priority on wp_head for inline custom CSS<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39349\">#39349<\/a> \u2013 Customizer (mobile preview) site title extra padding<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39444\">#39444<\/a> \u2013 Text Decoration Underline removes on hover in Customizer<\/li>\n<\/ul>\n<p>Editor<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39276\">#39276<\/a> \u2013 Link Editor bug \u2013 target=\"_blank\" not removed<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39313\">#39313<\/a> \u2013 Add New button not disappearing in Distraction-free Writing mode<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39368\">#39368<\/a> \u2013 .page-template-default body class in editor doesn't appear in initial post\/page load.<\/li>\n<\/ul>\n<p>External Libraries<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/37210\">#37210<\/a> \u2013 Update PHPMailer to 5.2.21<\/li>\n<\/ul>\n<p>Feeds<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39066\">#39066<\/a> \u2013 `fetch_feed()` changes REST API response `Content-Type`<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39141\">#39141<\/a> \u2013 RSS feeds have incorrect lastBuildDate when using alternate languages<\/li>\n<\/ul>\n<p>General<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39148\">#39148<\/a> \u2013 Correct concatenated dynamic hooks<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39433\">#39433<\/a> \u2013 Update copyright year in license.txt<\/li>\n<\/ul>\n<p>HTTP API<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/37839\">#37839<\/a> \u2013 wp_remote_get sometimes mutilates the response body<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/37991\">#37991<\/a> \u2013 fsockopen logic bug<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/37992\">#37992<\/a> \u2013 fsockopen hard codes port 443 when http scheme used<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/38070\">#38070<\/a> \u2013 RegEx to remove double slashes affects query strings as well.<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/38226\">#38226<\/a> \u2013 \"cURL error 23: Failed writing body\" when updating plugins or themes<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/38232\">#38232<\/a> \u2013 Setting `sslverify` to false still validates the hostname<\/li>\n<\/ul>\n<p>Media<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39195\">#39195<\/a> \u2013 Undefined index: extension in class-wp-image-editor-imagick.php on line 152<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39231\">#39231<\/a> \u2013 Allow the pdf fallback_intermediate_image_sizes filter to process add_image_size() sizes.<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39250\">#39250<\/a> \u2013 Undefinded Variable in Media-Modal<\/li>\n<\/ul>\n<p>Posts, Post Types<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39211\">#39211<\/a> \u2013 is_page_template could return true on terms<\/li>\n<\/ul>\n<p>REST API<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/38700\">#38700<\/a> \u2013 REST API: Cannot send an empty or no-op comment update<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/38977\">#38977<\/a> \u2013 REST API: `password` is incorrectly included in arguments to get a media item<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39010\">#39010<\/a> \u2013 REST API: Treat null and other falsy values like `false` in 'rest_allow_anonymous_comments'<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39042\">#39042<\/a> \u2013 REST API: Allow sanitization_callback to be set to null to bypass `rest_parse_request_arg()`<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39070\">#39070<\/a> \u2013 WP-API JS client can't use getCategories for models returned by collections<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39092\">#39092<\/a> \u2013 REST API: Add support for filename search in media endpoint<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39150\">#39150<\/a> \u2013 Empty JSON Payload Causes rest_invalid_json<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39293\">#39293<\/a> \u2013 WordPress REST API warnings<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39300\">#39300<\/a> \u2013 REST API Terms Controller Dynamic Filter Bug<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39314\">#39314<\/a> \u2013 WP-API Backbone Client: buildModelGetter fails to reject deferred on fetch error<\/li>\n<\/ul>\n<p>Taxonomy<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39215\">#39215<\/a> \u2013 Support for string $args in wp_get_object_terms() broken in 4.7<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39328\">#39328<\/a> \u2013 Adding terms without AJAX strips \"taxonomy\" query arg<\/li>\n<\/ul>\n<p>Themes<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39246\">#39246<\/a> \u2013 Theme deletion has a JS error that prevents multiple themes from being deleted.<\/li>\n<\/ul>\n<p>Upgrade\/Install<\/p>\n<ul>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39047\">#39047<\/a> \u2013 Installer tries to create nonce before options table exists<\/li>\n<li><a href=\"https:\/\/core.trac.wordpress.org\/ticket\/39057\">#39057<\/a> \u2013 FTP credentials form doesn't display the SSH2 fields on the Updates screen<\/li>\n<\/ul>\n<p><strong>\u00c4hnliche Artikel:<\/strong><br \/>\nWordPress Version 4.7 verf\u00fcgbar<br \/>\n<a href=\"https:\/\/borncity.com\/blog\/2016\/11\/24\/wordpress-auto-update-als-sicherheitsrisiko\/\">WordPress-Auto-Update als Sicherheitsrisiko<br \/>\n<\/a><a href=\"https:\/\/borncity.com\/blog\/2016\/12\/27\/pwnscriptung-phpmailer-lcke-macht-wordpress-angreifbar\/\">PwnScriptung: PHPMailer-L\u00fccke macht WordPress angreifbar<\/a><br \/>\n<a href=\"https:\/\/borncity.com\/blog\/2016\/12\/26\/wordpress-rest-api-ermglicht-konten-harvesting\/\">WordPress: REST API erm\u00f6glicht \"Konten-Harvesting\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Die Entwickler haben am 11. Januar 2016 WordPress Version 4.7.1 allgemein freigegeben. Es handelt sich um ein Sicherheits-Update, welches einige Sicherheitsanf\u00e4lligkeiten schlie\u00dft und z\u00fcgig installiert werden sollte.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[426,185,1574],"tags":[4328,4315,5850],"class_list":["post-185924","post","type-post","status-publish","format-standard","hentry","category-sicherheit","category-update","category-wordpress","tag-sicherheit","tag-update","tag-wordpress-4-7-1"],"_links":{"self":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/185924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/comments?post=185924"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/posts\/185924\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/media?parent=185924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/categories?post=185924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/blog\/wp-json\/wp\/v2\/tags?post=185924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}