Slashdot Mirror
WordPress To Show Warnings on Servers Running Outdated PHP Versions (zdnet.com)
The WordPress open-source content management system (CMS) will show warnings in its backend admin panel if the site runs on top of an outdated PHP version. From a report: The current plan is to have the warnings appear for sites using a PHP version prior to the 5.6.x branch (5.6 or lower). The warnings will contain a link to a WordPress support page with information on how site owners can update their server's underlying PHP version. In instances where site owners are running their WordPress portals on top of tightly-controlled web hosting environments, the web host has the option to change this link with a custom URL pointing at its own support site. [...] Around 66.7 percent of all Internet sites run an unsupported PHP version, according to W3Techs. Almost a quarter of all internet sites run on top of a WordPress CMS.
Wordpress and PHP are a cancer on the Internet. Just stop this shit already.
other similar software already does this on the backend, and have for years. color me impressed with the wordpress team.
And if that doesn't work we'll start posting warnings to the front end!
"Proudly Powered by an pwnable package of PHP"
... and it already complains about PHP 7.0 being outdated, although that's still the default on current long-time support systems like Debian Stretch or Ubuntu Server 16.04...
The number of sites I host is not huge, but I've run into problems with some current software like MyBB while in the process of switching as many sites as possible to at least PHP 7.2.
If many PHP sites still run on outdated PHP versions, it's not necessarily just because the admins were lazy and irresponsible...
I bet the typical "solution" to this problem will be not to update WordPress.
Hating on PHP is a litmus test for who not to hire.
PHP lets you write code as good or bad as you are as a developer.
Work Safe Porn
7.0 is current on most every stable release. Running Raspian Stretch, 7.0 is my best version. Loading a Buster image is costing too much space, and I'm not ready to put the 32GB chip in there just to satisfy some nerdy desire to align with the most current PHP version. This isn't the 90s, and PHP-Nuke isn't a thing so much. Let it go. And forcing me to third-party repos isn't necessarily an improvement to security.
Buster seems ready to freeze in a few months. WordPress should kindly let this go, also. There are greater threats. It's interesting that PHP updates and everyone loses their mind UPGRADE ALL THE PHP NOW!
deleting the extra space after periods so i can stay relevant, yeah.
Doesn't that cover all of them?
Since WP's initial release in 2004, PHP has improved a lot, WordPress has not. WP is the textbook for writing terrible PHP.
Now WP thinks they can shame hosting providers into upgrading PHP, while their own product is insecure by design? Good luck with that.
What about redhat / centos php?? will it flag it?
Joomla has been doing this for awhile.
It's a nice help for getting clients to see the need for upgrading the PHP version.
... is to hold a printout of it's Datamodell in front of your webcam when logged in to the Dashboard. WordPress then usually just blushes ashamed, wordlessly crawls into a corner and doesn't bug you for the rest of the day.
Works every time.
We suffer more in our imagination than in reality. - Seneca
What do you recommend for a CMS? I'd love to point my clients in a better direction.
Website Just Down For Me? Find out
One of the things that pops up in regular security audits is that the version of PHP or SQL we use "has bugs", and we should update immediately. When pressed to tell us which bugs make it insecure, we get a list... which does not include any features we use. And when they try to exploit the vulnerability, they find that it doesn't work... since they can't trigger something that isn't there.
It doesn't mean we do not move forward - just that, if you write good code to begin with, the bugs are not a factor.
It also means that we do not use ANY outside libraries, because we cannot control how well THEY were written. Hence, no Wordpress on any of our servers!
Wordpress itself is bad. It allows people who don't know a single thing about security operate a website that inevitably becomes a spam magnet and malware/phishing site once the user doesn't monitor it for a few days.
In all seriousness, people who hate on PHP are very likely racist jackasses in real life and we would be better off without them developing anything. If a specific language is popular for a specific reason, it's because it's the most practical use case for that language. Hence PHP is the ideal language for server-sided scripting. Not NPM. Not Java. Not Python or Ruby. Most of the shit developed with Python or Ruby is even easier broken just by updating the OS.
Javascript remains the de-facto language used by the web-clients. It's a pity that during the development of the two (PHP and Javascript) that something like JSON was part of the core spec, and instead both embraced XML which was overtly convoluted, yet worked if both ends knew what they were doing.
What we have today are piles of shitty frameworks (eg Symphony) and javascript libraries (eg jQuery being the most notorious) that hide the security issues from the end developer, and instead require duplicating efforts 4 or more times, once in PHP, one in Javascript, once in YML, a second time in the javascript helper tool. And for what? Big, Ugly, Bloated "responsive" websites that break if you if so much as breathe on them.
I don't appreciate all the updates to PHP, because they have this shitty habit of depreciating things that do not need to be depreciated. They just arbitrarily change things and don't put in any translation layers. Take for example Wordpress was still using the MySQL functions instead of MySQLi or any other DBAL as recently as 2017, and sure enough broke a shit-tonne of shitty wordpress plugins. They only made the switch after PHP deferred removal of MySQL to 7.0, which they were going to remove it in 5.6.
Yet, there is no reason to remove that function series at all, they want to remove it keep the OOP nerds happy. Another thing that changed for no damn reason was all the functions that involve regex. I won't even get into it, but in converting sites from 5.4 and earlier to 7.0 compatible, the mysql functions and the regex functions are the biggest issues. Another one is how php access system functions, completely broken, but that's a good thing.
You should not have php accessing system functions unless it's a system script. Accessing them from the web is plain stupid.
That is useful information. Thank you.
You can't spell "oneiromancy" without "roman".