Serendipity 1.2 released

The Serendipity Team is proud to present the final release and immediate availability of Serendipity 1.2.

This release is a feature consolidation release and focuses on small usability improvements, a shiny new template (bulletproof) as well as backend templating and backend login mechanisms as well as some tighter security restrictions.

Some more changes in depth are:

  • Templates: The new bulletproof template is an awesome example to show off Serendipity's cool template options. This template allows you to easily configure the look of your Serendipity site: Place navigation links, choose sidebar layouts, indicate if you want to use/show trackbacks and comments, pick your custom header image or even custom colorsets. Don Chambers, Matthias Mees and David Cummins as well as other contributors have worked very hard on this template that provides an awesome, unified template structure. Go to their site at http://s9y-bulletproof.com to check out the details!
  • Templates: The admin backend (overview page and entry editor) can now be styled via Smarty and gives you the full flexibility to make a custom look of the backend. Plus, more CSS classes have been added to the default admin theme that make CSS-only changes much easier. Templates now also can have large preview images by clicking on their thumbnail.
  • Usability: Moved the problematic option to withdraw your own privileges from personal configuration to the user configuration panel.
  • Feature: Added SQLite3 and PDO:PostgreSQL support.
  • Feature: Allow to configure whether article overviews for a certain category should include articles of subcategories or not.
  • Performance: Improved SQL performance for archive overview generation and permalink lookups.
  • Plugins: Plugins can now hook in much earlier to make external authentication easier (like trough the OpenID plugin).
  • Spam: Enhanced the spamblock plugin with captcha previews, .htaccess generation and some more options.
  • Security: Stronger autologin cookie encryption and template option handling, thanks (once again) to Stefan Esser. Proper session fixation prevention, thanks to David Vieira-Kurz.
  • Bugfix: Sending pingbacks now properly works.
  • Bugfix: The Track-Exits plugin now properly tracks links in conjunction with the caching of the entryproperties plugin.

The full list of changes can be found in the NEWS-file of the release.

You can download the new release as always on the Serendipity homepage at http://www.s9y.org/3.html. Updating is easy: Just upload the new files, visit your Serendipity installation and let the upgrader do the rest.

After the upgrade you might want to purge your browser's cookies (due to the new authentication mechanism of Serendipity 1.2) to prevent login problems. Detailed upgrade instructions can be found in the FAQ on our website.

Enjoy Serendipity, and thanks to everyone who participated in the release process!

For the team,
Garvin.

Serendipity 1.1.4 released, security bug in entryproperties plugin

Thanks to Erich Schubert, we were made aware of a bug and security issue in the Plugin Extended properties for entries. Since this plugin is delivered with the core release, we have created a new Serendipity release for both the current stable 1.1 version tree, as well as a new 1.2 beta version.

Serendipity Users that are using the mentioned plugin do not need to upgrade the full release, they can just fetch the updated version of the plugin through this direct link. Put that updated file into your plugins/ serendipity_event_entryproperties/ serendipity_event_entryproperties.php file.

The actual bug was, that people were able to deliver custom entryproperties settings to the Serendipity Frontend via a HTTP-Request, which made them able to bypass a possibly used passwort protection. Any other restriction of viewability of entries done via category read-privileges were not affected, though.

Bottom line is: If you are using password protection for entries, this security update is mandatory for you. Also if you were generally using the entryproperties plugin (which is not installed by default in Serendipity), you are urged to update your plugin. Only people not using this plugin need not care about this issue.

You can download the new full releases as always on the Serendipity download page.