Rebecca, our genius Web Project Manager at illuminea, did a search and discovered on the WordPress Codex that a bunch of new styles are needed in your style.php file in order to get the images to do what you want from WordPress version 2.5 and up. If you are using an older theme, you may not have these styles in your style sheet. The same classes are used to align images that have a caption (as of WordPress 2.6).

Here are the styles – you can just copy and paste them into your style.css file or wherever your CSS styles are located:

.aligncenter,
div.aligncenter {
   display: block;
   margin-left: auto;
   margin-right: auto;
}

.alignleft {
   float: left;
}

.alignright {
   float: right;
}

.wp-caption {
   border: 1px solid #ddd;
   text-align: center;
   background-color: #f3f3f3;
   padding-top: 4px;
   margin: 10px;
   /* optional rounded corners for browsers that support it */
   -moz-border-radius: 3px;
   -khtml-border-radius: 3px;
   -webkit-border-radius: 3px;
   border-radius: 3px;
}

.wp-caption img {
   margin: 0;
   padding: 0;
   border: 0 none;
}

.wp-caption p.wp-caption-text {
   font-size: 11px;
   line-height: 17px;
   padding: 0 4px 5px;
   margin: 0;
}

I had mixed feelings about this: on the one hand, these plugin authors had enough vision to see a need and fill it with some plugins that became standards for experienced WordPress blog developers. If WordPress makes these features part of the core, than these plugins become legacy and are no longer needed, and all the developers will no longer get recognition for their innovation and leadership in the WordPress community.

On the other hand, these types of developments are par for the course in an open source community, and is what makes the WordPress software so fantastic. The people at Automattic give free rein to the community to develop new features, and then these features are tested by thousands around the world over many years, and “survival of the fittest” helps the community identify the best and most important features to be added to the WordPress core.

The result: one of the best pieces of open source software around, and a celebration of the culture of open source.

What do you think?

First of all, kudos to all involved for getting out a new release ahead of time. And secondly, they’ve done a great job adding some really useful features and security fixes to this version. But the apple of my eye is the reinstatement of the Press This bookmarklet.

I know they’ve added all sorts of cool features like post revisions for multi-author blogs, easy insertion of image captions, and more user-friendly management of plugins; but I really liked the Press This bookmarklet, and kind of mourned its loss when it was removed from WordPress 2.5. The Press This bookmarklet makes it much easier to post about other web content on your own blog, in a way that’s similar to the Tumblr bookmarklet. Aaron Brazell describes the Press This bookmarklet as follows:

…it allows the user to be on any website, click the bookmarklet and get a miniaturized version of WordPress admin with options to snip text, photos from the page, quotes or video embeds.

I still haven’t upgraded (see below to find out why), so I wonder if the Link This bookmarklet has been reinstated too…

It’s not all rosy

Some bloggers have had problems after upgrading to 2.6. Joost de Valk warns WordPress bloggers using Windows hosting that the upgrade may mess up your permalinks. Upstart Blogger upgraded only to find that all of his categories and category permalinks had been messed up, despite the fact that he took all the necessary precautions like deactivating plugins, etc. Apparently he’s not the only one, either. He says that that there’s a solution, but it involves messing with your database, which is not for the fainthearted. Being a seasoned member of the fainthearted club, and having just moved all my blogs and sites from one host to another, I think I’ll wait a bit before upgrading, as usual.

More about WordPress 2.6

10 Things You Need to Know About WordPress 2.6 from Technosailer

WordPress 2.6 from WordPress.org

What You Need To Know About WordPress 2.6 from Weblog Tools Collection

New admin design

I like the new design for the WordPress admin (and for the WordPress.org site). The colors are ok, but what’s great is that everything seems to be a bit tighter so it’s easier to get an overview of a page quickly, like which plugins you’re using, or the categories.

Smarter layout of admin navigation bar

I think that the new setup of the navigation bar in the admin section is much more user friendly. It separates the features that you use regularly while blogging, like writing and managing posts and comments, from the features that you only need to deal with once in a while, like Plugins, Settings (used to be called Options) and Users.

The only drawback that still exists is that in order to get to anything on a submenu, you have to click on the top of the menu, like Write for example, and only once the page has reloaded can you click on Post. So I’ve installed the Admin Drop Down Menu by Ozh to overcome that, but unfortunately it regroups all of the links into one long navigation bar like in previous versions of WP, which means that I don’t benefit from the new grouping.

More flexible Dashboard

The new Dashboard is a huge improvement over the old one, since it gives you a quick view of the things you need to know about your blog: how many posts, Pages, categories and tags. However, I rarely take more than a quick look at the Dashboard while I’m blogging, so although I can now add my own RSS feeds there, I probably won’t.

Write Post/Page page changes

The new layout of the Write Post/Page page is tighter and smarter in most respects. The important information is at the top, and the new expandable text editor is a pleasure, although the very useful shortcut for adding links – Ctrl+K -does not work in the new text editor. But apparently the text editor no longer messes with your code, which I guess makes up for it. The main drawback to the new layout that I’ve found is that the Post Author drop-down box is all the way at the bottom. When I’m working on multi-author blogs I keep forgetting to change the author to the correct one.

Another annoying thing, but maybe this is a problem with my installation, is that when I first start writing a post and I click on Save, it often goes out of the admin into the front end of the site to show me the page. Also, it creates another version which is saved as a draft, so I end up with two versions of every post I’m working on, and I have to go back and delete the second draft.

Media manager

Managing images, video and any other type of media in previous versions of WordPress was pretty lame. The new image manager is very handy, and allows you to easily upload and insert images, and align them however you want within the text. You can add titles, descriptions, and other information to the images as well.

The video manager has not worked for me at all. When I insert a video URL into the form, it just inserts a link to the video as opposed to embedding it. So I’m still using a plugin for video management. I haven’t tried adding audio or other media yet.

Auto-suggest for tags

Now, when you add tags to a WordPress post, it suggests tags that have already been used on the blog. This is great because it ensures that you do not create multiple tags that are really the same, like “blogs,” “blog,” and “blogging.” However, be aware that it takes a few seconds for the suggestions to pop up. I didn’t realize this in the beginning, and I ended up with multiple related tags.

This new features also means that I can now use one less plugin, which I’m always happy about. Simple Tags (and its predecessor Simple Tagging), you were the best and thanks for everything. No wait – I just checked out Simple Tags and I realized I still can’t live without it.

Automatic plugin updates!!!

Now if one of your plugins needs updating, you get a message that says something like “This plugin needs updating. Click here to download, or click here to upgrade automatically.” Um let’s see – either I can download the new plugin, unzip it, delete the current plugin files from my server to make sure it’s all gone, upload the new plugin and reactivate, or I can click on one link. I’m clicking on the link baby!

No more Category IDs

If you go to Manage > Pages or Manage > Categories, the ID numbers no longer appear. That is annoying for theme editors who want to hard code inclusion or exclusion of pages or categories in menus or in The Loop. You can still find out what the Page or Category ID is by mousing over the title and looking at the link in the bottom of your browser to find the number, but that’s not very intuitive, is it?

No more WordPress bookmarklet

WordPress used to have a bookmarklet and Link bookmarklet that you could drag to your browser toolbar, where it would become a button that you could click to post about a page you are visiting, or to add a link from a page you are visiting. These bookmarklets have disappeared in WordPress 2.5.

That’s it for now. If I discover anything else that is new and interesting, I’ll be sure to let y’all know.

Here are some more good articles on what users can expect from WordPress 2.5:

Wordpress 2.5 – nice security improvements

Themes for WordPress 2.5 and Web 3.0 Design and Functionality – good overview of WP’s new features

Weblogtools: FAQ on WordPress 2.5 and FAQ On WordPress 2.5 Version 2

The WordPress Blog: WordPress 2.5

Here are some of the points that I found most interesting:

• The dashboard is fully editable. I mean fully. Fabulous.
• One little click and the text editor becomes full screen. Usability heaven.
• The interface has all sorts of Ajaxy stuff, which seems to make uploading and interacting with dialogue boxes a lot smoother…and prettier.
• A built-in photo gallery which looks great. This gallery allows you to add groups of photos right from the text editor and create albums and galleries. You can see examples on Matt’s blog
• The new tagging interface is way more user friendly, with the ability to easily add and remove tags, and my favorite new feature: auto-suggest. This ensures that you don’t end up with duplicate tags within your blog, like “blog,” “Blog,” and “Blogs” by suggesting existing tags to you as you type. This is really great because it means I can knock one more plugin off of my “always use” plugin list – this time it’s Simple Tags, which is a great plugin, but I’m always happy to use less plugins.
• Matt had five wisdom teeth pulled, and he sounds like it. Poor Matt. I know how that feels, and all I can say is that I hope you have a really speedy recovery, and “Refuah Sheleimah” (right Raanan?).

Matt also points out that the community has started a list of which plugins work with WordPress 2.5, and which don’t, and from what I can see most of the plugins I use on a regular basis are compatible. Phew.

Here’s the screencast, but I suggest you visit Matt’s original post on this subject at the WP developer’s blog since the quality is much better there:

But I have to admit that I just took a look at Matt’s post on what lies in store in WordPress 2.5, and I’m actually excited about the new version. People like the team behind Automattic always amaze me with their ability to think outside of the box, and innovate beyond what has been expected and accepted.

Those of us who have been using WordPress for a while are used to the WordPress admin, to the point where we probably don’t feel like much is lacking. It seems that new users find the admin confusing and cumbersome, and therefore Automattic has streamlined it in a way that is smart and intuitive.

So here’s an overview of what’s in store as reported by Matt, with my commentary:

The Dashboard

I barely glance at the Dashboard when I enter the admin of my blogs. Most of it is useless, with the incoming links section being the only thing that grabs my attention. In 2.5, the WordPress dashboard will focus on the most relevant tasks at hand for the blogger: a quick summary of what’s published and scheduled for publication, the latest comments and incoming links, blog stats, and WordPress updates and news.

A really exciting addition is the ability to add our own RSS feeds to the Dashboard. That means that users can set their Dashboard to present them with information related to their blog topic, for example, or a project management blog can pull in RSS feeds related to their project. Cool.

Navigation

As I mentioned above, as a longish-time user of WordPress, the navigation in the admin doesn’t bother me. I know where I need to go to get things done, but apparently the navigation can be confusing, and could be improved. So they’ve improved it by separating the main tasks that we do, like writing, managing posts and pages, editing the blog’s design, and managing comments, from the tasks that are used less often.

The only thing I would have done differently is move the blog design editing section to the secondary section. I don’t know about you, but I NEVER edit my theme files from the admin. That just seems too risky. I prefer to make all changes offline using a good editor so that all of the most current theme files are on my hard drive, and if I make a mistake, I can easily undo it.

Write Post/Page

The new Write Post/Page page loses a lot of the clutter of the current layout. Matt says that the new write screen “only displays the information that you’ll use most often.” This concerns me a bit, because I actually use a lot of the stuff that is there, and if I don’t use it all the time, I like to know that it’s there. Hopefully the new layout gives users easy access to everything, even the stuff used infrequently.

What is cool is that the Write page remembers how you left it the last time, and what’s even cooler is that the visual editor now has a full-screen mode!! Although I rarely write posts within WordPress anymore (I use and love Windows Live Writer), the full screen mode will make writing posts within WordPress a heck of a lot more enjoyable than scrolling within the current tiny editor. Matt says this is his favorite new feature, and I have a feeling I’m going to agree.

Manage Posts/Pages

The changes to the management pages seem to be in terms of removing clutter and making useful information more accessible. It’s hard to judge this one without seeing it, but I imagine it will be an improvement in usability.

Colors

The most visible change to the WordPress admin is, of course, its style. The fonts have changed a bit, and the colors consist of lightish blue and lightish orange. While I am a sucker for change when it comes to web apps and the like, these colors seem kind of washed out and hospital-like. But no worries! If you like the old look you can restore them by selecting “classic” under Options.

Even better – you can now have a per-user Admin color scheme! That means that every user on a blog can use their own stylesheet in the admin. PlanetOzh has a little tutorial explaining how.

Testing it out before release

I don’t know if Automattic has ever done this before, but Matt has asked people to test out the latest release and report back with bugs. This is a smart move, since generally new versions of WordPress almost always need to be upgraded immediately to fix bugs and security issues. Hopefully this strategy will mean that we can enjoy our new version of WordPress for a while before having to upgrade.

Summary

What’s amazing about WordPress is that they manage to continually add more features while decreasing clutter. The addition of features does not translate into a weighed-down, clunky interface, which is more than a lot of web applications can claim. I can’t wait to try it out!

It’s an urgent security release because if you allow registration on your WordPress blog, users can edit other users’ drafts. WordPress development also mentions the vulnerability in the WP-Forum plugin that I mentioned recently. This is the first time that I’ve seen WordPress themselves mention a plugin security problem. It must be really serious.

Can we discuss WordPress’ security for a sec?

I know that WP fans say that the reason there are so many security breaches is because WordPress is so popular and widespread, more people try to hack it.

WordPress detractors say that there is no excuse: WP gets hacked too much, has too much spam, and too many security problems.

So which is it? Let’s take a look at what a pretty objective group of people have to say about WordPress security: BlogSecurity.net.

BlogSecurity.net is a great blog that reports on social networking and web blog security. A large percentage of their posts are dedicated to WordPress issues. This could be because WordPress is so popular so they’ve decided to dedicate most of their energies to covering it, or it could be because WordPress has more security issues to report about.

It seems to be the latter, and BlogSecurity.net addressed the general issue of WordPress security recently:

We have seen alot of critical vulnerabilities being discovered in WordPress core and its plugins of late, who’s to blame?…

One of the major problems I see with WordPress is that it provides little (if any) protection against input validation attacks. So where does the problem lie?

One of the main problem lies in the way WordPress sanitises user input….

If WordPress is going to get serious about security, we need to come up with hardcore secure functions, that the WordPress core, and its plugin developers can use. These functions should take the security considerations out of the plugin developers hands and secured from within the WordPress core!…

This is one area, where I think blogging platforms like Drupal do a far better job! (my bold)

So is WordPress insecure by design? The answer seems to be yes!

Ramifications? I don’t know. I’m not jumping ship any time soon because no other blogging or CMS platform offers what WP does: flexibility, ease of use, extensibility, and great community support.

I’m no software developer, but I would say that it’s probably in Automattic’s interest to concentrate all their efforts in tightening up security issues now, and only once that’s done to add any new features they planned on implementing in the next release.

——————————

Here are some other plugin vulnerabilities that were recently discovered, in case you missed them:

WordPress WassUp Plugin “to_date” SQL Injection Vulnerability

WordPress AdServe Plugin “id” SQL Injection

WordPress WP-Footnotes Plugin “admin_panel.php” Cross-Site Scripting

dmsguestbook, st_newsletter, Wordspew, wp-footnotes vulnerabilities

wp-calc & wp adserv plugin vulnerabilities

I have a site that was running on WordPress version 2.2. I hadn’t bothered to upgrade since we had stopped publishing on it in November for various reasons, but a recent link to one of the posts on that site from TechCrunch inspired me to get that site going again.

The site was running really slowly, which was another reason to try to fix it up. So the upgrade began.

Once the upgrade was finished and all plugins were reactivated, all the posts disappeared. I could see that they were there somewhere, since we have a section in the sidebar where random post titles show up, and titles were displaying there, but the home page was blank, and if I went to Manage > Posts, nothing showed up there.

So I backed up everything (or so I thought), uninstalled and reinstalled the whole site. Still no luck, plus I realized that I hadn’t backed up all of the site’s images in the Uploads folder – they were now gone for good. Horror number 1.

I hacked around for a few hours, and then I got into even more trouble: by mistake I imported the other site’s database into WordPress Garage via PHPmyAdmin (don’t ask). Horror number 2. That’s not great, I thought, but I’ll just restore the WordPress Garage database backup that I get emailed to me automatically with the WP-DB-Backup plugin. Or so I thought.

For some reason I has set the plugin to send backups only once a week, and the backup files were not being attached and were coming out as a big jumble within the body of the email. Horror number 3.

In short: I had no backup of WordPressGarage. I thought all was lost, and was planning my final post for this site telling people that the whole site was gone and I was giving up.

How I mostly got out of this ridiculous mess

Then I remembered that I had upgraded WordPressGarage recently, and like a good girl I had backed it up before upgrading. I found the backup file in my Recycle Bin, and imported it into the database. That fixed everything, but I was still missing a few posts. I found them via Google’s Cache, and re-entered them one by one.

So the only information missing here are a few comments. I apologize to the commenters – if you want to resubmit, please do.

The situation on the other site

It turns out that a plugin was causing the posts to disappear. I use the Sideblog plugin there (as I do here for the Shorties category that appears in the sidebar), and the older version that I was using for WordPress 2.2 was making the posts disappear for some reason. Once I upgraded the plugin, the posts reappeared.

As a result of this whole balagan (a very useful Hebrew word that means chaos and mess, and is one of the two Hebrew words that Lorelle knows, as she told us at WordCamp Israel), I was left with the following collateral damage: I lost all of the other site’s images, which is pretty blatant since every post there has a thumbnail image. In additional, all the tags have disappeared, and I can’t get them back. Plus I lost a few comments here on WordPress Garage.

Lessons learned

This whole experience aged me a few years, but I’d like to help you live a bit longer, so here’s some advice when it comes to messing around with WordPress upgrades and databases:

1. Don’t get complacent about upgrades. We do it so often, and most of the time it works, that we can get lazy. It’s understandable, especially for people running multiple WordPress blogs, since backing everything up every time and going through the whole process for every site can be really time consuming. But if you value the content you’ve produced, it’s worth taking the time to protect yourself against any possible mishaps.
2. If you are using the WP-DB Backup plugin, check to make sure you’re getting the backups often enough, and that they actually work.
3. Do yourself a favor and set your WordPress blog to save all images in your theme folder. You can do this by going to Options > Miscellaneous, and changing the file path to wp-content/themes/yourtheme/blogimages. That way you have everything together in one place. One of my mistakes here was that I backed up the theme files, but not the images. Or at least just remember to back up your images, wherever they are.
4. Be very very careful when messing around in PHPmyAdmin. There is no undo button or option. If you make a mistake, you have to live with it.
5. If you upgrade and then find that something is wrong, deactivate all your plugins and then reactivate them one by one to see if any of them are the cause of the problem. Also, make sure you’re running the latest versions of the plugins. If I had known this, I could have saved myself a lot of heartache.
6. Don’t do sensitive work like this in the middle of the night. You’re brain just isn’t as clear as it is in daylight. Get a good night’s sleep, and then upgrade. This could save you from making some really stupid mistakes.

Here’s to more infrequent WordPress upgrades!

[youtube]http://www.youtube.com/watch?v=X0BTz-hTvOg[/youtube]

David Peralty has responded with his own video on BloggingPro arguing that WordPress doesn’t suck. And here it is:

[youtube]http://www.youtube.com/watch?v=7fyuvzWtTgI[/youtube]

So does it or doesn’t it? Suck, I mean.

Let’s do a comparison between the two videos and their messages to try to figure this one out:

In my opinion, Mark wins this round – he gets his points across in seconds flat, so he keeps our attention, plus his arguments are legitimate. But I still really like WordPress, despite its faults, because it does have a lot of benefits. The biggest benefit, I think, is that it puts flexible publishing in the hands of the people. You don’t have to be a programming guru to put together a stylish, user-friendly, optimized, and feature-filled site. And of course, the price is right.

What do you think?

Yes folks, despite the goal of not releasing any new versions until 2.3, we now are faced with WordPress version 2.3.2, which fixes the draft vulnerability we wrote about recently, as well as “suppress[ing] some error messages that can give away information about your database table structure and limits and stops some information leaks in the XML-RPC and APP implementations” (from the WordPress blog).

An added bonus in this upgrade is the ability to create a custom template page that will display when users encounter database errors. Instead of some WordPress page filled with database mumbo jumbo, you can have a user-friendly page appear at times of database troubles with a message explaining the problem. This page is called db-error.php, and should be placed in your wp-content folder.

So let’s go upgrade everybody…Fantastico users will have to wait, since Fantastico hasn’t upgraded their WordPress installation yet.