Hi. I developed aicf.org with Newspaper. At the time the version of the theme was 6. For a while we tried updating the theme but the site’s design got heavily compromised even though our work was clean with a properly configured with a child theme. We had to make a decision with our client and we said we’ll keep it at version 6. Yesterday we got hit with malware due to vulnerability in your theme. I know you fixed it in subsequent versions, but we can’t really upgrade. Is there a solution you can think of to help us out here? Maybe a patch to fix this vulnerability and block the code from working?
Hello,
Sorry but there were many security fixes since version 6 unfortunately so we cannot think of the exact issue that was present on such an old version of the theme. The breach was only discovered after it was fixed in our updates so it was of no immediate concern. People who updated properly never had any issues. Sorry but there is no patch or fix I can provide. We can only recommend updating the theme. I’m not sure what design got heavily compromised as the exact same elements can still be used in the current version of the theme. Maybe you can create a staging environment and try to update there and maybe find a solution to the compromised elements. Security is always much more important than the design choice.
Thanks.
Security is important, but at the time (2015-2016) – we did not know of your theme’s security vulnerabilities. The site (which is big and used daily by thousands of people) cannot look different or compromised, and every time we tried to update Newspaper on a staging environment, the design got corrupted.
Our web hosting company (Flywheel) security team did a check and found that the vulnerability came from this specific issue in your theme (at the time):
https://wpvulndb.com/vulnerabilities/8852
Is it possible to help us out by providing a patch for this issue as a first step?
We just paid to renew support with you and we were hoping that this could help resolve this issue.
Thanks,
Nadav
For your reference, here is just a little bit of what’s going on when updating to 8. Child theme is loading properly, I checked. https://we.tl/ViwfDIvcQX
Main issue is you can’t use old child theme (v6) with new theme (v8) as too much has changed. Ideally you’d migrate child theme from v6 to v8, then test that with the current theme version.
Almost everything from WordPress had security issues back then, as many XSS security issues were found that impacted themes, plugins, WordPress core — basically any verison of WordPress prior to 2018 isn’t secure either, so folks not updating their core WP would also be subject to possible injections/etc.
I don’t work here, just some feedback. We went through that in going from newsmag 1.6/7 to NM3. Now looking to move to v4 (and hoping v5 doesn’t come out while we’re doing that!) 🙂
Thanks Chris. What do you specifically mean by *migrate* the child theme?
Well, you need to take the child theme from v8, then apply any customizations you did with v6 to the v8 child theme. So, let’s say you put a custom footer in your v6 child theme, you’d move that over to the v8 child theme.
So, you might use file comparison software and compare the v6 theme with the v6 child to see what you changed; then move over any edits to the v8 child theme. Only reason to use child theme is if you made changes to the files (I personally just hack the main files, and keep track of that; stuff like removing the pingback in header, or removing comment count from the author block page element for author index, etc.).
Basically if you use v6 child theme to “over ride” the v8 theme, then of course stuff will be broken as the CSS, various functions, etc. are different. So, it’s like over-riding one theme with totally different theme — won’t work.
and of course, my ‘classic’ thread here good read:
https://forum.tagdiv.com/topic/tutorial-good-basic-security-practices/
Thanks Chris. TagDiv team: when Newspaper 9 comes out, will Newspaper 8 child themes stop working? What are developers expected to do when you release a new major version? Isn’t this supposed to be seamless?
Hello,
Please check this topic about the functionality of a child theme: https://forum.tagdiv.com/topic/setting-up-child-theme/
There is no update proof way of altering the theme files unfortunately. Code gets changed. You cannot keep old code around and as the new theme version will not work with the old code. This is just the way things work on any other theme as well.
Sorry but unfortunately holding on to older versions can have consequences. Especially when updating WordPress and plugins and everything else around the theme but not the theme itself. There will come a point where the theme will no longer be compatible with most plugins or even WordPress itself as WP keeps changing as well (if you update WP that is).
The best course of action would be to make the change and update your theme and keep it updated. This way we can guarantee proper functionality, compatibility and proper security for your website.
Thank you!
