Today I released wp-SwimTeam v1.45 which fixes a possible security problem I was alerted to as well as addresses a number of bugs. The CSV roster export bug was the primary issue holding up getting this release out, I fixed the security problem last week.
It turns out I had implemented a method in both a parent class and (redundantly) in a child class as well. The RE1, SDIF, and HY3 exports all (properly) used the method from the parent class but the CSV export was using the child class version. It took me a while to sort it out as I was staring at the wrong code trying to determine what was wrong. It turns out, nothing was wrong, I was just looking in the wrong place. Once I removed the redundant method declaration, everything resumed working as it should.
I think I have resolved all of the multi-site issues, please let me know if you run into any more.
Earlier today I received a report of a security bug in wp-SwimTeam. While the security flaw is true, I believe the ability to take advantage of the exploit is pretty hard is it would require knowing the value of a WordPress site’s ABSPATH value. It is certainly possible to guess the value in some cases but without knowing the proper value, the exploit simply fails.
Swim Team season must be approaching because I’ve had a couple more bugs reports and found two more myself while looking into other issues. A couple these are limited to running under WordPress Multi-Site so most people / teams won’t run into them but there are some issues with report generation as well. I am looking into these and will issue an update as quickly as I can.
This morning I released a minor update to wp-SwimTeam. Unless you are running under WordPress multi-site, you will not see a difference. Under Multi-Site there was a bug in the database query that pulls the list of users from the WordPress database. Because not all users stored in the user table should be visible to a particular site, the list of users needs to be filtered and limited to just those who have access to the site. It was this filter portion of the query which was wrong.
Today I learned of a bug with wp-SwimTeam where the list of Users associated with the site doesn’t get populated when running under WordPress multi-site. This problem does not happen on standard installations of WordPress.
I am looking into the problem but it isn’t a simple solution as the query references the explicit users table which isn’t the same under WordPress multi-site.
I thought I had a quick solution but it didn’t work so I will need to sit down for an hour or two and sort this out over the next couple of days.
Yesterday I finally released Swim Team v1.42. With almost 50 downloads of the beta and no problems reported, I figured it was as tested as it was going to get! Some of the fixes and enhancements include:
Added checking and error messages for creation of temporary files used during export (CSV, HY3, SD3, RE1).
Added support for Event Number suffixes.
Added support for Transients as temporary storage when exporting data or generating reports.
Major change to how files are included to better support newer versions of PHP. The PHP include_path is no longer modified nor assumed.
Fixed bug in MyJobs which appears when no active season is designated.
Functionally this release is identical to v1.42-beta-8. You can find the update in the WordPress plugin repository or as an update on your Dashboard.
This morning I posted beta-8 of Swim Team v1.42. I hope to formally release it in the next day or two barring no reported issues. This update addresses a few more areas where I missed the changes to how files are included. This manifested itself mostly through usage of shortcodes but there were a few other spots too (e.g. event management).
This evening I posted beta-7 of Swim Team v1.42. This build addresses a problem reported earlier today. This bug manifested itself when there isn’t an active season which would be the case when the plugin is first installed. It is also possible to set all seasons inactive in which case, the same problem was present.
This morning I have posted a new build, v1.42 beta-6 of the Swim Team plugin. This beta release makes a major change to how the plugin includes the various files the plugin uses. Historically, Swim Team modified the PHP include_path as part of the initialization to include the paths where included files are expected. In newer versions of PHP this seems to cause some problems for some users.
I have changed the plugin to eliminate the need to modify the PHP include_path however the process of doing so required touching almost 100 files within the plugin. I have been through all of the menus and tabs and believe I found accounted for every file which included but there is always a chance I have missed something.
Please report any problems and I will do my best to fix it quickly.
This morning I released a very minor update to Google Forms. In the process of verifying that I fixed the form submission log I found a typo in one of the internationalization strings and some debug code which was still enabled. Neither issue would cause the plugin to fail but I went ahead and fixed both and released an update.