VIP Platform Changelog

We’ve added two new filters to our login limiting functionality, which gives you the ability to tweak the thresholds for our application-level brute force protections. For example, you may want to lower them during situations with high security sensitivity.

• wpcom_vip_ip_username_login_threshold : how many failed attempts to allow for an IP address and username combination
• wpcom_vip_ip_login_threshold : how many failed attempts to allow for an IP address

For example, if you wanted to only allow one attempt for a group of usernames per IP:

add_filter( 'wpcom_vip_ip_username_login_threshold', function( $threshold, $ip, $username ) {
	if ( 'adminuser' === $username || 'otheradminuser' === $username ) {
		$threshold = 1;
	}

	return $threshold;
}, 10, 3 );

https://github.com/Automattic/vip-go-mu-plugins/pull/1782

When using the Cache Personalization API library, any Vary headers sent before the library was initialized would be overridden. This is no longer the case and all supported Vary headers are now properly supported.

https://github.com/Automattic/vip-go-mu-plugins/pull/1740

We’ve upgraded the Query Monitor plugin to 3.6.4 (previously 3.1.1).

As we’re jumping up a few releases, there are quite a few changes. A few notable ones:

• Dark mode
• Stack trace support for fatal errors
• wp_die() support
• Related Hooks for various panels
• Block debugging support for sites using the Block Editor

Not using Query Monitor yet? Learn how to enable Query Monitor on your environments.

https://github.com/Automattic/vip-go-mu-plugins/pull/1775

We updated the Two Factor plugin to 0.7 (previously 0.6). This version includes numerous bug fixes including better compatibility with password managers like 1Password and fixing an annoying notice about incorrectly registered scripts. Learn more about the changes in the Release Notes.

https://github.com/Automattic/vip-go-mu-plugins/pull/1737

We now set the default $end_date param using the site’s local date (rather than UTC time). Previously, the function could return incorrect data due to the mismatch in timezones.

https://github.com/Automattic/vip-go-mu-plugins/pull/1756

Starting today, any applications created with new GitHub repos will have Content Distribution disabled by default in their non-production environments.

The change was introduced in our VIP Skeleton repo here:

https://github.com/Automattic/vip-go-skeleton/pull/55

If you would like to tweak this behavior, you can remove or adjust the lines in the vip-config.php file in your repo.

Note: This will not impact existing applications or new applications/environments created that use existing GitHub repos.

Learn more about Content Distribution.

#skeleton #jetpack

We’ve pushed a fix to properly clear an internal stats cache for uploaded files. This was causing an incorrect filesize value to be returned after an upload (if done within the same request).

wp> $file = wp_upload_bits( 'hello.txt', 'world' )['file'];
int(5)
wp> filesize( $file );
int(5) <= this would previously return 0

The fix was pushed in our mu-plugins repo here:

https://github.com/Automattic/vip-go-mu-plugins/pull/1741

#mu-plugins