Samuel Wood (Otto)

Do you have a setting in the wp-config file called alternate WP Cron?

When it renames a page on you to contain a number, that’s usually because you already have a page named that. It may be in the trash and not actually deleted, or it may be being used for the name of a photograph in your media library. The names/slugs in WordPress need to be unique. So look around for something else named about-us.

Note, we have changed www.ads-software.com responses to work with the problem. So, for the updates to www.ads-software.com, they will work. A comprehensive fix will be deployed shortly, correcting the issue for everybody.

@doffine Generally, security releases like this are rare.

However, actually explaining this to the user requires more than one or two sentences. There’s a lot of background information to know here. And you can’t encapsulate that information into a short text in a random email, and if you try to make it even longer then it gets ignored, or worse, marked as spam.

Balancing security with privacy is tricky, but communicating that information with the end user is way trickier.

An explanation would be nice when a piece of software is obviously force pushed into our installation.

@doffine

@doffine There is no such thing as a “force push” of a plugin from our systems. To understand why this is, you need to understand how the update system works.

WordPress checks for plugin updates on a roughly 12 hour basis. There are three options for when an update is available. It can not update, it can automatically update, or the default setting, which is to do whatever the server suggests.

The server response has a field called, appropriately, “autoupdate”, and that field is usually “false”. However, when there is a security update with a plugin, that plugin author can coordinate with the plugins team, and they can set it to true, for some set of circumstances. In this case, everybody who is running a version with the issue was updated to the latest release that didn’t have the issue for them. So somebody running 7.4 would have been updated to 7.4.3, instead of being updated to the latest version 7.6.1. Releases like this are made so as to minimize the impact of the security fix.

The version does exist. And yes, it was a security release.

When security releases happen, there is usually backporting of the fix to older versions. So 7.6 got a release to 7.6.1. However, the other versions got releases of their own, which all updated them to have the security fix.

You can find a list of the versions that were released here: https://plugins.trac.www.ads-software.com/changeset/2980245/woocommerce-gateway-stripe/

More to the point, nonces should only be used for logged in users. For anonymous users, the nonce will be the same.

Because you already had one with that name, so it added the -2 to differentiate.

I thought that was what I was doing here, commenting but maybe this is just not the right forum to do so.

Correct, this is not the right forum. This is the general requests and feedback forum.

If you visit the page of the plugin in question, you will notice a “support” link to the support forum for that plugin, as well as you can leave reviews by rating the plugin.

If I see a Site Health warning on one of my sites I expect it to be an important issue that requires my attention and not an option to upgrade a plugin that has no importance or value.

Perhaps, but that is a comment on the plugin doing the thing. Plugins have wide ranging powers, including the ability to add things to site health. Are you suggesting that nothing be allowed to add anything to site health, or that plugins cannot be created that do additional checks there?

There are 100,000 plugins in the directory. Not every addition every one of those makes can be checked.

that one of my concerns is that if WP are going to allow this (using site health as a sales/promotion/upgrade option) where will it end and how many other plugins will do the same.

So if you keep using these plugins that do things you don’t like, then how would other plugins know that that is a bad thing?

The fun thing about open source is that it’s open, and that we can all see the code, and anybody can comment on the code. If you don’t comment on it, then you are not a participant. And you get what you get, based on your lack of comments and choices.

Well, you could consider voting with your feet and uninstalling that plugin. Possibly even leaving them a bad review?

Not judging, just saying that if a plugin does something you don’t want it to do, then maybe you should find an alternative plugin.

What plugin do you use from monster insights already?

There is a documentation article about that: https://www.ads-software.com/documentation/article/changing-file-permissions/

That is an active support forum, because the theme is only like three days old.

Also, the call to get the thumbnail is right here in the parent theme: https://themes.svn.www.ads-software.com/adventure-trekking-camp/1.7/template-parts/post/single-page.php

 However with this new theme, Trekking Sports, (which has no active support forum)

https://www.ads-software.com/support/theme/trekking-sports/