Serendipity - Development

Serendipity 1.5.2 released

mail@garv.in (Garvin Hicking) — Mon, 25 Jan 2010 12:17:39 +0100

Serendipity 1.5.2 has been released to address the outstanding issue of SQLite installations with Serendipity. Upgrading an earlier version of Serendipity prior to 1.5.1 to this version should work without any problems, fixing the database upgrades that were faulty in Serendipity 1.5.1. This is the same patch that has been advertised in the old blog posting.

Users who had upgraded to Serendipity 1.5 already can fix problems by checking the database table 'serendipity' and make sure to insert a md5 hashed password, with hashtype=0.

SQLite users should backup their database file (a random file name ending in .db) before updating. For users of other database systems, the Serendipity 1.5.2 update does not contain any changes and can be left out.

Serendipity 1.5.1 with SQLite

mail@garv.in (Garvin Hicking) — Wed, 23 Dec 2009 15:06:07 +0100

UPDATE: Serendipity 1.5.2 release

Some SQLite upgrades from Serendipity prior to 1.5 to the current version might create a problem, that the database update cannot properly update the serendipity_authors database table structure to insert the new "hashtype" (int) column. Due to that column missing, this can lead to the inability to log in.

Sadly SQLite does not easily allow to ALTER a table structure, so unless you have a SQLite admin tool to manually that column, and until the Serendipity Team can provide a proper fix, you should not yet update. Due to Christmas 2009.1 getting released soon, this might takes us a few more extra days.

If you have NOT yet uploaded the new serendipity release and executed the update, you can simply copy the file sql/db_update_1.5-alpha1_1.5-alpha2_sqlite.sql onto your installation, which fixes the upgrade procedure.

Side information: Hashtype defines whether md5 (value '0') or salted sha1 (value '1') is used for the stored encrypted password of the serendipity_authors table. Once you login with a hashtype=0, serendipity will automatically convert your password to sha1, and adjust the hashtype column. This is why once we fix this issue in 1.5.2, we must make sure that no manuall updates you might have used are overwritten, that could lead to Serendipity no longer knowing which hashtype was used for your column. That requires some thoughtful thinking, and a bit more time instead of a hotfix that might make the situation worse.

Note that this ONLY applies to users UPGRADING and using SQLite. A fresh installation as well as using other Database types is not affected.

Serendipity 1.5.1, bugfix release

mail@garv.in (Garvin Hicking) — Mon, 21 Dec 2009 20:12:20 +0100

It's been a long time, and the Serendipity Team is proud to present the Serendipity 1.5.1 release...

...All bad things come in triplets, except this one, which came in a duplet: First the uploaded release file contained the current development version, the second issue was found due to just 3 mixed up characters, which prevents any plugin that has a HTML/WYSIWYG-Config-item (like the HTML Nugget plugin) to be properly displayed.

The fix is quite easy: include/functions_plugins_admin.inc.php. The cause for this problem was introduced only a few days earlier and sadly slipped by unnoticed. We're awfully sorry for the trouble this may cause you.

Due to this version mixup earlier and this annoying bug, Serendipity 1.5.1 (Codename Colin AKA If everybody else is doing it, why can't we; but well, it could be worse) has been released.

If you're lazy and already upgraded to 1.5, you will only need to download and replace the file found here: include/functions_plugins_admin.inc.php.

Now have a merry christmas, and let's hope that our best friend Murphy has no surprises left for us freezing germans.

Serendipity 1.5 released

mail@garv.in (Garvin Hicking) — Mon, 21 Dec 2009 08:07:00 +0100

The Serendipity Team is proud to present the final release of Serendipity 1.5. While the earlier beta versions are proven to work fine for many people, it was finally time to package up a real release. ;)

This version mainly addresses login security by changing our method how passwords are stored to use salted SHA1 checksums instead of plain MD5 checksums. This makes password retrieval (rainbow attacks, see special blog posting) through the database virtually impossible. Another thing is improved PHP 5.3 compatibility.

For users of our Bundled WYSIWYG-Editor Xinha users now have the ability to easily customize the appearance of this panel through a "my_custom.js" file inside the template directory (a draft of such a file can be found as fallback default in the htmlarea/ subdirectory).

One cool new feature for developers is that now also templates can register themselves inside the plugin API hooks to execute specific things, that don't require installation of an event plugin.

Other news include:

new event API hooks
fixed PDF thumbnail generation
ability to auto-scroll on borders when Drag/Dropping plugins
UTC server time zone support
improvements in the Smarty functions to easier use Serendipity as a CMS for individual entry output.
quicksearch improvements for doing a wildcard-search when too few searchresults were found on a fixed searchterm
support for Typepad anti-spam server-checks, additionally to Akismet

Minor improvements since the 1.5-beta1 release:

more PHP 5.3.0 compatibility improvements
Disallow uploading any files that contain ".php." in the filename for extra security with Apache MimeMagic-Modules
expermiental PDO:SQlite support
usability improvements for the comment moderation panel (bottom-navigation, removed border increase)

The current release can be easily installed on any previous Serendipity installation. Just unpack, upload and visit your admin panel to perform possible database upgrades. Upon first login with an old password, Serendipity will store your old password in the new format - please be sure to make a backup of your Database prior to upgrading, and read the upgrade pointers on Upgrading Serendipity.

Have fun using Serendipity, and let us know on the Forums if you have any issues!

Update: Accidentaly, the 1.6-alpha release file was uploaded with the wrong file name. This has been fixed, the real files are now available -- users who had already downloaded this 1.6 release can either re-download the new release bundle, or stay at their current version. 1.6 has only 2 minor changes yet, and is 99,9% identical with 1.5 at this point. The most major difference would only be the version number. ;-)
I'm sorry for this fault, I blame it on the german weather...

Serendipity 1.5-beta1 released

mail@garv.in (Garvin Hicking) — Mon, 24 Aug 2009 09:59:00 +0200

Serendipity 1.5-beta1 is the first public beta release of the upcoming Serendipity 1.5 version. Some important things have changed under the hood, that we would like to ask our users to try out and report back to us.

This version mainly addresses login security by changing our method how passwords are stored to use salted SHA1 chacksums instead of plain MD5 checksums. This makes password retrieval (rainbow attacks) through the database virtually impossible. Another thing is improved PHP 5.3 compatibility. See more about this in a special blog posting some time ago.

One cool new feature for developers is that now also templates can register themselves inside the plugin API hooks to execute specific things, that don't require installation of an event plugin.

Other news include:

new event API hooks
fixed PDF thumbnail generation
ability to auto-scroll on borders when Drag/Dropping plugins
UTC server time zone support
improvements in the Smarty functions to easier use Serendipity as a CMS for individual entry output.
quicksearch improvements for doing a wildcard-search when too few searchresults were found on a fixed searchterm
support for Typepad anti-spam server-checks, additionally to Akismet

The current release can be easily installed on any previous Serendipity installation. Just unpack, upload and visit your admin panel to perform possible database upgrades. Upon first login with an old password, Serendipity will store your old password in the new format - please be sure to make a backup of your Database prior to upgrading. Apart from that, the current beta release is already in production use on many blogs and there are no known problems/issues with this.

Serendipity Snapshot: New login hashing

mail@garv.in (Garvin Hicking) — Tue, 17 Feb 2009 14:04:00 +0100

Since quite some time, Serendipity uses old-fashioned md5 hashes to secure your passwords for logins to the backend.

Because mechanisms to crack md5 hashes with rainbow tables or even "dictionary hash"-lookups are getting more and more popular, we have decided to finally take the step to raise the serendipity hashing mechanism to something salted, and more secure (SHA1). Even though md5 hashes are still reasonably(!) safe when you use long, randomized passwords, the old-style hashing is a one-way route to hell.

Serendipity has always been had high tributes to backwards compatibility and ease-of-use and ease-of-upgrading, we have decided to take the "soft" upgrade approach. That means, new Serendipity versions will accept your old MD5 login ONCE, and then will use your user-specified password to create the safer hash and store that to the database.

This will help in hypothetical attack situations, where someone might have gotten hand on your hash values stored inside the database, because he will no longer be able to reverse-engineer your original password.

We could need help from any developer or betatester trying out the new functionality. Upgrading to the latest snapshot (get it from the s9y nightly downloads) with Serendipity 1.5-alpha2 will deploy the necessary database upgrades. Note that the one-time MD5-login is only possible in the first 6 months after you performed the installation of this serendipity version (through a saved timestamp in the database), and after that timespan, you can no longer login with the old password and must reset your password through the Administrator (or manual means, if you are the administrator).

Once you perform the update (do not try this on production blogs currently), everything should continue as usual. If it does not, please report your exact problems here or in the Forums. It is suggested that once you have the new serendipity version you change your password, so that nobody that might have already gotten your old md5 hash can use the reverse-engineered password to login again with the new hash created from the same original password.

Feedback is appreciated. The current mechanism is subject to change and currently more a proof-of-concept - feedback will most definitely lead to improvement. :-)

Serendipity 1.4.1 released

mail@garv.in (Garvin Hicking) — Fri, 16 Jan 2009 11:33:05 +0100

Serendipity 1.4.1 has been released. This is mainly a bugfix release for the updated of the bundled Smarty library, which fixes issues with Serendipity 1.4.

Other small fixes include better antispam checks for pingbacks (they were too strict before), an update to the sql index key creation of the statistics plugin and removal of error messages on open_basedir enabled servers.

You only need to upgrade to Serendipity 1.4.1 if one of the mentioned bugs affect you. Updating is easy and documented online.

Smarty problem with Serendipity 1.4

mail@garv.in (Garvin Hicking) — Tue, 30 Dec 2008 11:15:15 +0100

Due to some feedback on the forums, we were made aware of a bug of the bundled Smarty templating engine that can happen in some PHP environments and lead to PHP warning/error messages.

If this occurs for you, please simply download an updated version of the file bundled-libs/Smarty/libs/Smarty_Compiler.class.php and upload it to your blog directory. Of course we will integrate this update to a future point release of Serendipity.

Serendipity 1.4 released

mail@garv.in (Garvin Hicking) — Mon, 29 Dec 2008 10:43:00 +0100

The Serendipity-Team is proud to provide the final release of Serendipity 1.4, conveniently codenamed "Post-Christmas-Monk-Miles-Moondog".

There have been some larger improvements since the 1.4-beta release, so these are the highlights of this release in short:

(new since 1.4-beta1) References to online plugin documentation have been added (if existing) and the display of the short plugin names has been added to the plugin configuration menus.
(new since 1.4-beta1) Firefox now no longer autoremembers passwords at the wrong places
(new since 1.4-beta1) Added SMF importer
(new since 1.4-beta1) Added a new %parentname% permalink option for category links
(new since 1.4-beta1) Fix to properly, longer (30 days) sstrong>remember the user settings in cookies, like for media insertion
Improvements in the now Double-Opt-In comment subscription (plus support for fulltext comment notifications)
new bundled default WYSIWYG editing component (Xinha, the successor of HTMLArea). This new component is more reliable and cross-browser capable than the old version, by still supporting everything that worked with HTMLArea previously.
The Entryproperties plugin now uses the new widget-style configuration option to allow for custom arrangement of the entry-related features of this plugin to your liking.
The bulletproof template has been enabled as the new default template. The frontend imitates the look of Carl Galloways Serendipity 1.0 relaunch template, while the backend is much improved with a fresh, distinct look.
The Remote RSS-Feed sidebar plugin now is templated, so that you can achieve distinct look for certain feeds on the sidebar.

Serendipity also addresses some minor bugs usually only affecting very special environments. Other changes include new PostgreSQL ts_vector fulltext search, comment approval-by-mail for the spamblock plugin, better HTTP header status updates for CGI environments. For developers, some API improvements and new variables/parameters have been added. The performance of the entryroperties plugin can be enhanced by new configuration options that let you fiddle with the involved SQL generation.

The complete list of all changes is documented within the docs/NEWS file of the release. This serendipity release is also the first one to include checksums to verify your installation integrity.

Updating is easy and documented online: Just upload the new files onto your web, possibly refresh/purge your browser cache (and if you upgrade from Serendipity older than 1.2, you might need to purge your old cookies), go to the admin panel and you're done. For shared installations, make sure all deployed htmlarea directories are updated with the new files (if not, the old htmlarea will still be there, not Xinha).

Also, the new version contains release checksums. This makes sure that the files you uploaded correspond with the checksums generated through the release. This way, bad FTP uploads will no longer be driving you nuts. If this makes any trouble for you, try to upload the files in BINARY mode in your FTP client.

For the future, Serendipity is still planning on minor and major features. We always keep a close ear to the wishes of our users, some of those that cannot be solved instantly have been documented here: Future of Serendipity. If you're a developer or designer, and want to help in proving that Serendipity is a flexible and easy to use Blogging/CMS-application - your help is needed and appreciated! Speaking of which: Many thanks to all current developers and forum users, especially Don Chambers, YellowLED and Judebert. Your help has been, and is vital to the project.

On behalf of the team: Happy new year and have fun with the release,
Garvin

For 1.4 beta-testers

mail@garv.in (Garvin Hicking) — Sat, 06 Dec 2008 13:19:00 +0100

A bug was reported on the forums that affects current 1.4-beta2 users. When you store custom entry properties for an entry (using the entryproperties plugin) those will not get remembered properly, when you re-edit the entry. We consider this to be a serious bug in the problem, so all 1.4-betatesters using this plugin should fetch an updated 1.4 snapshot.

Since the final 1.4 version will be out in a few days, we do not think this warrants an extra 1.4-beta2 release, as the current Snapshots contain the same files.

Other things that have been added to the current 1.4 release tree include an SMF importer, a fix for remembering cookies longer, a new %parentname% permalink shortcut for category permalinks, adding an autocomplete=off attribute for the password-fields so that Firefox does not store the user password into unrelated password fields, more documentation and ChangeLog links to plugins and yet another fix for properly counting trackback/comment counts.

Serendipity 1.4-beta1 released

mail@garv.in (Garvin Hicking) — Tue, 11 Nov 2008 14:48:00 +0100

The first release candidate for Serendipity 1.4 can now be downloaded.

Serendipity 1.4 mainly addresses improvements in the now Double-Opt-In comment subscription (plus support for fulltext comment notifications) and ships with a new bundled default WYSIWYG editing component (Xinha, the successor of HTMLArea). This new component is more reliable and cross-browser capable than the old version, by still supporting everything that worked with HTMLArea previously.

Things that are visually noticeable include a new "widget-style" configuration option for the "Entryproperties"-Plugin, so that you can arrange and enable/disable each feature of that plugin to your own liking. Also you can now configure each sidebar plugin directly from your frontend.

Also, the Bulletproof has now been promted as new default template, imitating the design of the previous default template - but offering a now completely new distinct default look to the admin panel.

The Remote RSS-Feed sidebar plugin now is templated, so that you can achieve distinct look for certain feeds on the sidebar.

Serendipity also addresses some minor bugs usually only affecting very special environments. Other changes include new PostgreSQL ts_vector fulltext search, comment approval-by-mail for the spamblock plugin, better HTTP header status updates for CGI environments. For developers, some API improvements and new variables/parameters have been added. The performance of the entryroperties plugin can be enhanced by new configuration options that let you fiddle with the involved SQL generation.

The complete list of all changes is documented within the docs/NEWS file of the release. This serendipity release is also the first one to include checksums to verify your installation integrity.

Also, the new version contains release checksums. This makes sure that the files you uploaded correspond with the checksums generated through the release. This way, bad FTP uploads will no longer be driving you nuts. If this makes any trouble for you, try to upload the files in BINARY mode in your FTP client.

Please report any trouble with this new release candidate on the Serendipity Forums or here on this blog. Even though we find this release quite stable and generally believe it production ready, feedback is much required. If all goes well, the final version will be released in december.

Improvement of Static Page plugin

mail@garv.in (Garvin Hicking) — Wed, 27 Aug 2008 11:04:04 +0200

(Deutsche Übersetzung gibt es auf meinem privaten Blog)

A huge issue of Serendipity's Static Page-Plugin has always been its visual presentation of the editing screen:

Voices have been raised in the past to dust up this interface, which is why I worked on it at the beginning of this week, and committed my changes already to the official plugin repository (staticpage.zip).

Technically, the changes are quite minimalistic und quick to implement (2 hours of my life time). But the impact is huge:

Starting as of now, static pages can be created and edited using a customized smarty template, plus a static page can now have custom properties, similar to blog entries.

By default, a template file saved as backend_templates/default_staticpage_backend.tpl is shipped with the plugin, in which the distribution of the input fields is contained. There is a new smarty helper function ({staticpage_input}) that takes care of accessing the usual introspection methods for emitting the default list of data fields.

Own templates can override this template file by putting it in their template subdirectory, so that you can now have your own editing masks depending on the currently used template. This should be a blessing for magazine-like templates such as Mimbo or Hemmingway.

You can also store multiple template files inside this backend_templates directory, so that they all will be available from within the selection dropdown of the interface. For our veterans, the old list-style view is still available, of course.

An example for saving custom fields for static pages is also contained within the default template, but is commented out so that you must manually enable it. All custom fields need to be implemented through usual HTML form elements, and need to save their values inside a serendipity[plugin][custom][XXX][ fieldname. Once entered, the data will be automatically saved inside the serendipity_staticpage_custom database table, and will be available through {$staticpage_custom.XXX} when later being displayed in the frontend.

This way, you can easily add new custom fields for a staticpage which could decide, which CSS-Body-ID to use for rendering the page. Or you could specify, which sidebars you want to see when a certain staticpage is rendered. Or specify a custom header image for each staticpage. Sky's the limit!

This all vastly improves Serendipity's CMS-abilities and even more pushes it into a custom CMS-Framework, where you can manage any kind of customized content.

I hope you like it. :-)

The Future of Serendipity

mail@garv.in (Garvin Hicking) — Sat, 02 Aug 2008 09:08:04 +0200

When I started working on Serendipity about 5 years ago, this happened mainly because of a personal itch to scratch: I wanted to see my personal blogging and CMS-needs fulfilled on my own page.

Since then, development of Serendipity was mostly caused by my personal thoughts of usable features, and of course the wishes of this community. In my oppinion, this has worked out quite well, the features of the past years have been received well by you.

Despite of that, this also means that Serendipity does not have an outlined Feature-Agenda.

The differentiation of Serendipity against other blog engines is quite important to me. Serendipity cannot and willnot be a WordPress-Clone, but fills its own user base: A lean base system with strong expandibility, secure and bugfree code basis and workflows/usage methods close to the user. A 'bottom-up' development process is my favouriteed variant, as a Developer I would never want to push features into the product, that have not been mentioned by users (=non-developers).

For the next Serendipity 1.4 version I am still missing a few new useful functions, which is why I would like to ask the community, which things you currently miss most, or in which places see strong indicators to put work into. Because this is, where I would like to improve things.

Please write down your wishes and ideas for the future of Serendipity. This entry has also been posted on the Serendipity Forums, where it can be easily commented.

Netmirror.org Outage, Spartacus affected.

mail@garv.in (Garvin Hicking) — Fri, 16 May 2008 16:33:42 +0200

As of today, the netmirror.org server seems to be having a hiccup. The serendipity Plugin Spartacus by default requires this server to provide automatic plugin and theme updates and downloads. The inavailibility of this server can lead to timeouts and not being able to install new plugins.

The issue should resolve itself once netmirror.org is up again. Temporarily you can either reconfigure your Spartacus-plugin to use the SourceForge-Mirrors, or completely disable the Spartacus plugin. Using the s9y.org mirror will not help you, as this server is currently not hosting any files.

I will post an update once the server is up again. Sorry for the inconvenience.

Serendipity 1.3 released (addresses security)

mail@garv.in (Garvin Hicking) — Tue, 18 Mar 2008 10:11:50 +0100

Serendipity 1.3 has finally been released. The new release is mainly a feature consolidation release, but also contains XSS security fixes:

The karma rating plugin has been upgraded to support nice, CSS-based rating graphics (see this post) and an overall rehaul on the its coding.
Make the Spartacus plugin be able to use FTP upload, a workaround for SafeMode PHP restrictions. Also add a remote backend for plugin update checks.
An importer for phpNuke and lifetype has been added.
Support for pingbacks has been improved a lot. Trackbacks can now be blocked based on Sender IP checks.
Add better CSS styling for some internal plugins and the embedding of images. Also made the Remote-RSS plugin to be capable of Smarty-Templating.
Increased Smarty templating features for the {serendipity_fetchPrintEntries} function, to be able to check for entry properties.
Add support for SQRelay.
Minor CSS and graphic updates to the Bulletproof template.

The full list of 41 changes to this release are documented within the NEWS file.

Regarding Security, the bundled Smarty library has been updated to version 2.6.19 and adresses an issue in environments where the PHP security mode is required. Also, the new Serendipity release contains tighter backend XSS checks so that environments with untrusted authors can be more secure - many thanks to Hanno Böck for addressing this. Most importantly, an issue with XSS attacks within received trackbacks has been discovered by Peter Hüwe and was fixed.

The update is easy as usual, and recommended for Serendipity users - especially if you do not regularly moderate or check your incoming trackbacks.

Upgrade pointers can be found in the FAQ and is as easy as just to upload the new files.

Have fun!