Serendipity - Development

Serendipity Snapshot: New login hashing

mail@garv.in (Garvin Hicking) — Tue, 17 Feb 2009 14:04:00 +0100

Since quite some time, Serendipity uses old-fashioned md5 hashes to secure your passwords for logins to the backend.

Because mechanisms to crack md5 hashes with rainbow tables or even "dictionary hash"-lookups are getting more and more popular, we have decided to finally take the step to raise the serendipity hashing mechanism to something salted, and more secure (SHA1). Even though md5 hashes are still reasonably(!) safe when you use long, randomized passwords, the old-style hashing is a one-way route to hell.

Serendipity has always been had high tributes to backwards compatibility and ease-of-use and ease-of-upgrading, we have decided to take the "soft" upgrade approach. That means, new Serendipity versions will accept your old MD5 login ONCE, and then will use your user-specified password to create the safer hash and store that to the database.

This will help in hypothetical attack situations, where someone might have gotten hand on your hash values stored inside the database, because he will no longer be able to reverse-engineer your original password.

We could need help from any developer or betatester trying out the new functionality. Upgrading to the latest snapshot (get it from the s9y nightly downloads) with Serendipity 1.5-alpha2 will deploy the necessary database upgrades. Note that the one-time MD5-login is only possible in the first 6 months after you performed the installation of this serendipity version (through a saved timestamp in the database), and after that timespan, you can no longer login with the old password and must reset your password through the Administrator (or manual means, if you are the administrator).

Once you perform the update (do not try this on production blogs currently), everything should continue as usual. If it does not, please report your exact problems here or in the Forums. It is suggested that once you have the new serendipity version you change your password, so that nobody that might have already gotten your old md5 hash can use the reverse-engineered password to login again with the new hash created from the same original password.

Feedback is appreciated. The current mechanism is subject to change and currently more a proof-of-concept - feedback will most definitely lead to improvement. :-)

Serendipity 1.4.1 released

mail@garv.in (Garvin Hicking) — Fri, 16 Jan 2009 11:33:05 +0100

Serendipity 1.4.1 has been released. This is mainly a bugfix release for the updated of the bundled Smarty library, which fixes issues with Serendipity 1.4.

Other small fixes include better antispam checks for pingbacks (they were too strict before), an update to the sql index key creation of the statistics plugin and removal of error messages on open_basedir enabled servers.

You only need to upgrade to Serendipity 1.4.1 if one of the mentioned bugs affect you. Updating is easy and documented online.

Smarty problem with Serendipity 1.4

mail@garv.in (Garvin Hicking) — Tue, 30 Dec 2008 11:15:15 +0100

Due to some feedback on the forums, we were made aware of a bug of the bundled Smarty templating engine that can happen in some PHP environments and lead to PHP warning/error messages.

If this occurs for you, please simply download an updated version of the file bundled-libs/Smarty/libs/Smarty_Compiler.class.php and upload it to your blog directory. Of course we will integrate this update to a future point release of Serendipity.

Serendipity 1.4 released

mail@garv.in (Garvin Hicking) — Mon, 29 Dec 2008 10:43:00 +0100

The Serendipity-Team is proud to provide the final release of Serendipity 1.4, conveniently codenamed "Post-Christmas-Monk-Miles-Moondog".

There have been some larger improvements since the 1.4-beta release, so these are the highlights of this release in short:

(new since 1.4-beta1) References to online plugin documentation have been added (if existing) and the display of the short plugin names has been added to the plugin configuration menus.
(new since 1.4-beta1) Firefox now no longer autoremembers passwords at the wrong places
(new since 1.4-beta1) Added SMF importer
(new since 1.4-beta1) Added a new %parentname% permalink option for category links
(new since 1.4-beta1) Fix to properly, longer (30 days) sstrong>remember the user settings in cookies, like for media insertion
Improvements in the now Double-Opt-In comment subscription (plus support for fulltext comment notifications)
new bundled default WYSIWYG editing component (Xinha, the successor of HTMLArea). This new component is more reliable and cross-browser capable than the old version, by still supporting everything that worked with HTMLArea previously.
The Entryproperties plugin now uses the new widget-style configuration option to allow for custom arrangement of the entry-related features of this plugin to your liking.
The bulletproof template has been enabled as the new default template. The frontend imitates the look of Carl Galloways Serendipity 1.0 relaunch template, while the backend is much improved with a fresh, distinct look.
The Remote RSS-Feed sidebar plugin now is templated, so that you can achieve distinct look for certain feeds on the sidebar.

Serendipity also addresses some minor bugs usually only affecting very special environments. Other changes include new PostgreSQL ts_vector fulltext search, comment approval-by-mail for the spamblock plugin, better HTTP header status updates for CGI environments. For developers, some API improvements and new variables/parameters have been added. The performance of the entryroperties plugin can be enhanced by new configuration options that let you fiddle with the involved SQL generation.

The complete list of all changes is documented within the docs/NEWS file of the release. This serendipity release is also the first one to include checksums to verify your installation integrity.

Updating is easy and documented online: Just upload the new files onto your web, possibly refresh/purge your browser cache (and if you upgrade from Serendipity older than 1.2, you might need to purge your old cookies), go to the admin panel and you're done. For shared installations, make sure all deployed htmlarea directories are updated with the new files (if not, the old htmlarea will still be there, not Xinha).

Also, the new version contains release checksums. This makes sure that the files you uploaded correspond with the checksums generated through the release. This way, bad FTP uploads will no longer be driving you nuts. If this makes any trouble for you, try to upload the files in BINARY mode in your FTP client.

For the future, Serendipity is still planning on minor and major features. We always keep a close ear to the wishes of our users, some of those that cannot be solved instantly have been documented here: Future of Serendipity. If you're a developer or designer, and want to help in proving that Serendipity is a flexible and easy to use Blogging/CMS-application - your help is needed and appreciated! Speaking of which: Many thanks to all current developers and forum users, especially Don Chambers, YellowLED and Judebert. Your help has been, and is vital to the project.

On behalf of the team: Happy new year and have fun with the release,
Garvin

For 1.4 beta-testers

mail@garv.in (Garvin Hicking) — Sat, 06 Dec 2008 13:19:00 +0100

A bug was reported on the forums that affects current 1.4-beta2 users. When you store custom entry properties for an entry (using the entryproperties plugin) those will not get remembered properly, when you re-edit the entry. We consider this to be a serious bug in the problem, so all 1.4-betatesters using this plugin should fetch an updated 1.4 snapshot.

Since the final 1.4 version will be out in a few days, we do not think this warrants an extra 1.4-beta2 release, as the current Snapshots contain the same files.

Other things that have been added to the current 1.4 release tree include an SMF importer, a fix for remembering cookies longer, a new %parentname% permalink shortcut for category permalinks, adding an autocomplete=off attribute for the password-fields so that Firefox does not store the user password into unrelated password fields, more documentation and ChangeLog links to plugins and yet another fix for properly counting trackback/comment counts.

Serendipity 1.4-beta1 released

mail@garv.in (Garvin Hicking) — Tue, 11 Nov 2008 14:48:00 +0100

The first release candidate for Serendipity 1.4 can now be downloaded.

Serendipity 1.4 mainly addresses improvements in the now Double-Opt-In comment subscription (plus support for fulltext comment notifications) and ships with a new bundled default WYSIWYG editing component (Xinha, the successor of HTMLArea). This new component is more reliable and cross-browser capable than the old version, by still supporting everything that worked with HTMLArea previously.

Things that are visually noticeable include a new "widget-style" configuration option for the "Entryproperties"-Plugin, so that you can arrange and enable/disable each feature of that plugin to your own liking. Also you can now configure each sidebar plugin directly from your frontend.

Also, the Bulletproof has now been promted as new default template, imitating the design of the previous default template - but offering a now completely new distinct default look to the admin panel.

The Remote RSS-Feed sidebar plugin now is templated, so that you can achieve distinct look for certain feeds on the sidebar.

Serendipity also addresses some minor bugs usually only affecting very special environments. Other changes include new PostgreSQL ts_vector fulltext search, comment approval-by-mail for the spamblock plugin, better HTTP header status updates for CGI environments. For developers, some API improvements and new variables/parameters have been added. The performance of the entryroperties plugin can be enhanced by new configuration options that let you fiddle with the involved SQL generation.

The complete list of all changes is documented within the docs/NEWS file of the release. This serendipity release is also the first one to include checksums to verify your installation integrity.

Also, the new version contains release checksums. This makes sure that the files you uploaded correspond with the checksums generated through the release. This way, bad FTP uploads will no longer be driving you nuts. If this makes any trouble for you, try to upload the files in BINARY mode in your FTP client.

Please report any trouble with this new release candidate on the Serendipity Forums or here on this blog. Even though we find this release quite stable and generally believe it production ready, feedback is much required. If all goes well, the final version will be released in december.

Improvement of Static Page plugin

mail@garv.in (Garvin Hicking) — Wed, 27 Aug 2008 11:04:04 +0200

(Deutsche Übersetzung gibt es auf meinem privaten Blog)

A huge issue of Serendipity's Static Page-Plugin has always been its visual presentation of the editing screen:

Voices have been raised in the past to dust up this interface, which is why I worked on it at the beginning of this week, and committed my changes already to the official plugin repository (staticpage.zip).

Technically, the changes are quite minimalistic und quick to implement (2 hours of my life time). But the impact is huge:

Starting as of now, static pages can be created and edited using a customized smarty template, plus a static page can now have custom properties, similar to blog entries.

By default, a template file saved as backend_templates/default_staticpage_backend.tpl is shipped with the plugin, in which the distribution of the input fields is contained. There is a new smarty helper function ({staticpage_input}) that takes care of accessing the usual introspection methods for emitting the default list of data fields.

Own templates can override this template file by putting it in their template subdirectory, so that you can now have your own editing masks depending on the currently used template. This should be a blessing for magazine-like templates such as Mimbo or Hemmingway.

You can also store multiple template files inside this backend_templates directory, so that they all will be available from within the selection dropdown of the interface. For our veterans, the old list-style view is still available, of course.

An example for saving custom fields for static pages is also contained within the default template, but is commented out so that you must manually enable it. All custom fields need to be implemented through usual HTML form elements, and need to save their values inside a serendipity[plugin][custom][XXX][ fieldname. Once entered, the data will be automatically saved inside the serendipity_staticpage_custom database table, and will be available through {$staticpage_custom.XXX} when later being displayed in the frontend.

This way, you can easily add new custom fields for a staticpage which could decide, which CSS-Body-ID to use for rendering the page. Or you could specify, which sidebars you want to see when a certain staticpage is rendered. Or specify a custom header image for each staticpage. Sky's the limit!

This all vastly improves Serendipity's CMS-abilities and even more pushes it into a custom CMS-Framework, where you can manage any kind of customized content.

I hope you like it. :-)

The Future of Serendipity

mail@garv.in (Garvin Hicking) — Sat, 02 Aug 2008 09:08:04 +0200

When I started working on Serendipity about 5 years ago, this happened mainly because of a personal itch to scratch: I wanted to see my personal blogging and CMS-needs fulfilled on my own page.

Since then, development of Serendipity was mostly caused by my personal thoughts of usable features, and of course the wishes of this community. In my oppinion, this has worked out quite well, the features of the past years have been received well by you.

Despite of that, this also means that Serendipity does not have an outlined Feature-Agenda.

The differentiation of Serendipity against other blog engines is quite important to me. Serendipity cannot and willnot be a WordPress-Clone, but fills its own user base: A lean base system with strong expandibility, secure and bugfree code basis and workflows/usage methods close to the user. A 'bottom-up' development process is my favouriteed variant, as a Developer I would never want to push features into the product, that have not been mentioned by users (=non-developers).

For the next Serendipity 1.4 version I am still missing a few new useful functions, which is why I would like to ask the community, which things you currently miss most, or in which places see strong indicators to put work into. Because this is, where I would like to improve things.

Please write down your wishes and ideas for the future of Serendipity. This entry has also been posted on the Serendipity Forums, where it can be easily commented.

Netmirror.org Outage, Spartacus affected.

mail@garv.in (Garvin Hicking) — Fri, 16 May 2008 16:33:42 +0200

As of today, the netmirror.org server seems to be having a hiccup. The serendipity Plugin Spartacus by default requires this server to provide automatic plugin and theme updates and downloads. The inavailibility of this server can lead to timeouts and not being able to install new plugins.

The issue should resolve itself once netmirror.org is up again. Temporarily you can either reconfigure your Spartacus-plugin to use the SourceForge-Mirrors, or completely disable the Spartacus plugin. Using the s9y.org mirror will not help you, as this server is currently not hosting any files.

I will post an update once the server is up again. Sorry for the inconvenience.

Serendipity 1.3 released (addresses security)

mail@garv.in (Garvin Hicking) — Tue, 18 Mar 2008 10:11:50 +0100

Serendipity 1.3 has finally been released. The new release is mainly a feature consolidation release, but also contains XSS security fixes:

The karma rating plugin has been upgraded to support nice, CSS-based rating graphics (see this post) and an overall rehaul on the its coding.
Make the Spartacus plugin be able to use FTP upload, a workaround for SafeMode PHP restrictions. Also add a remote backend for plugin update checks.
An importer for phpNuke and lifetype has been added.
Support for pingbacks has been improved a lot. Trackbacks can now be blocked based on Sender IP checks.
Add better CSS styling for some internal plugins and the embedding of images. Also made the Remote-RSS plugin to be capable of Smarty-Templating.
Increased Smarty templating features for the {serendipity_fetchPrintEntries} function, to be able to check for entry properties.
Add support for SQRelay.
Minor CSS and graphic updates to the Bulletproof template.

The full list of 41 changes to this release are documented within the NEWS file.

Regarding Security, the bundled Smarty library has been updated to version 2.6.19 and adresses an issue in environments where the PHP security mode is required. Also, the new Serendipity release contains tighter backend XSS checks so that environments with untrusted authors can be more secure - many thanks to Hanno Böck for addressing this. Most importantly, an issue with XSS attacks within received trackbacks has been discovered by Peter Hüwe and was fixed.

The update is easy as usual, and recommended for Serendipity users - especially if you do not regularly moderate or check your incoming trackbacks.

Upgrade pointers can be found in the FAQ and is as easy as just to upload the new files.

Have fun!

Serendipity 1.3-beta1 released

mail@garv.in (Garvin Hicking) — Mon, 25 Feb 2008 11:53:00 +0100

Serendipity 1.3-beta1 has been released. This beta is considered a release candidate before the final 1.3 release, which is scheduled to be released at the end of this month.

The new release is mainly a feature consolidation release:

The karma rating plugin has been upgraded to support nice, CSS-based rating graphics and an overall rehaul on the its coding.
Make the Spartacus plugin be able to use FTP upload, a workaround for SafeMode PHP restrictions. Also add a remote backend for plugin update checks.
An importer for phpNuke and lifetype has been added.
Support for pingbacks has been improved a lot. Trackbacks can now be blocked based on Sender IP checks.
Add better CSS styling for some internal plugins and the embedding of images. Also made the Remote-RSS plugin to be capable of Smarty-Templating.
Increased Smarty templating features for the {serendipity_fetchPrintEntries} function, to be able to check for entry properties.
Add support for SQRelay.

The full list of 35 changes to this release are documented within the NEWS file.

Please test this release and give us feedback here or on the forums so that we can further improve this upcoming version. The files are available on the s9y.org Downloads page. Upgrade pointers can be found in the FAQ and is as easy as just to upload the new files.

Spamblock and blogg.de blacklist

mail@garv.in (Garvin Hicking) — Sat, 08 Dec 2007 10:16:00 +0100

The Serendipity Anti-Spam plugin allows to utilize the blogg.de IP blacklist service to block spam. Their service seems to have ceased existence, or at least is rejecting connections. This can lead to comments to your serendipity blog to be rejected. You can easily disable the blogg.de blacklist service in your Anti-Spam plugin configuration.

Note that this option is by default disabled in Serendipity since blogg.de announced that they are no longer actively maintaining the blacklist. A well fit alternative to this service is the Akismet API, which the spamblock plugin also supports.

PHP Magazine Article (German)

mail@garv.in (Garvin Hicking) — Fri, 28 Sep 2007 12:25:14 +0200

Some while ago, I announced an article about Serendipity in the German PHP Magazine (read here). This article was now made available as a PDF by the publisher, so you can feel free to download and read it:

PHP Magazin Mai 2007: "Blogging mit Biss" von Garvin Hicking (German/Deutsch)

Have fun reading!

Your help in sorting serendipity plugins

mail@garv.in (Garvin Hicking) — Thu, 16 Aug 2007 10:20:05 +0200

Like announced earlier on the serendipity blog, fellow usability expert Joachim Harloff is currently trying to improve the listing of Serendipity Plugins so that they are more accessible to users.

He needs your help to fulfill them. Initially he planned to personally meet with serendipity users, but this proved more complex than initially hoped. Thus he has created a smaller, text-based version of it.

You can download the file at http://www.softuse.com/serendipity_sorting.zip. It contains detailed instructions. You can also feel free to personally contact Joachim about any questions you have.

Joachim estimates this questionnaire to take you about 1,5 hours of your time. You could greatly help to improve the serendipity usability, so please participate! Joachim wants to evaluate your responses starting on September the 8th.

Feedback!

mail@garv.in (Garvin Hicking) — Thu, 12 Jul 2007 14:13:48 +0200

The last call for users in munich didn't result in too terribly many, so we're now broadening the userbase.

Joachim Harloff ist a usability expert and wants to help Serendipity in creating a better overview of plugins. To do so, he needs participants to find out what users needs. And guess what: YOU are those users. :-)

So if you want to help out and give Joachim some feedback, please get in touch with him privately: harloff at softuse dot com. Just refer to this blog entry, and he'll provide you with details on how you can help.

German

Der letzte Aufruf nach Münchner Usern ist nicht ganz so ausführlich ausgefallen, wie wir uns das erhofft hätten. Daher weiten wir das ganze etwas aus, damit sich nun jeder (via E-Mail) beteiligen kann.

Joachim Harloff ist ein Usability-Experte, der angeboten hat, die Pluginsortierung für Serendipity zu optimieren. Dafür benötigt er euer Feedback. Bitte schreibt ihm eine Mail an harloff at softuse dot com und bezieht euch auf diesen Blog-Eintrag, er wird euch dann weitere Details zukommen lassen, wie ihr helfen könnt.