The Cricket Log

I have just officially released Cricket Moods 3.0. Major improvements include multi-user support and error reporting. The plugin also has several important bugfixes, one of which lets it play more nicely with other metadata-based plugins.

In the process of fixing bugs, I believe I noticed a bug within WordPress itself. One of the new functions in WordPress 2.0, update_usermeta(), doesn’t escape any data before trying to cram it into the database. If the data isn’t escaped, then things fall apart when it contains an apostrophe. If a plugin is poorly written, I think a malicious user could theoretically modify data he shouldn’t have access to—however, I don’t have any testcases to back up my claim. I’ve already created a ticket in WordPress Trac if you’d like to follow along.