Serendipity - Infrastructure

Serendipity 1.6.2 released

nospam@example.com (Garvin Hicking) — Wed, 16 May 2012 11:45:47 +0200

UPDATED: 2012-05-22 12:00 to clarify impact.

Good and bad things come in doubles, it seems. We are sorry to inform you that another security issue in Serendipity has been found by the High-Tech Bridge SA Security Research Lab (Advisory HTB23092). This issue has been reported today at 11:27 and we're happy to provide a quick fix for that.

You can either download the full 1.6.2 release, or apply this simple fix to the file include/functions_trackbacks.inc.php: diff on github.

The error here is that input is not properly validated and can be used (when magic_quotes_gpc is off) to inject SQL code to a SQL query; since our DB layer does not execute multiple statements, and the involved SQL query is not used to produce output code. Thanks to Pawel Golen it was made clear to us that this issue can in fact be used to remotely access the database through blind sql injection attacks (this method however is really slow and creates a lot of traffic, since only using 0/1 as a result of the exploit will mean a lot of queries to deduce the content). Thus you should definitely upgrade your installation.

Serendipity is an open-source based product with no specific funding, so we depend on nice people like High-Tech Bridge, Stefan Schurtz, Hanno Böck and all the others of the past to report issues to us. In turn we promise to fix them as quickly and transparently as possible.

Spartacus infrastructure change, Developers please read

nospam@example.com (Garvin Hicking) — Tue, 13 Dec 2011 14:06:21 +0100

Since the core Serendipity project is now maintained on github.com and every developer is quite happy about that, we decided to go the jquery-plugins route and delete all Serendipity plugins.

No, just kidding. We actually imported all data from the SourceForge.net CVS servers into the github infrastructure. The short version for normal end-users: Nothing should change for you!

https://github.com/s9y/additional_plugins

https://github.com/s9y/additional_themes

All current Serendipity developers also have access to those repositories to contribute code. Developers now no longer should commit code to CVS (actually, they can't, because I took all their committing karma *eg*).

The harder task for the Spartacus infrastructure service is the actual publishing of data. The Spartacus plugin operates on a PEAR-like XML format for each plugin, which luckily is automatically generated by a small shellscript which runs once daily on one of our webservers (emerge.sh). That script iterates on a checkout of all plugins and templates, creates the XML and uploads it to all mirror servers (currently netmirror.org, s9y.org and now also github.com).

Downloading the files also either works via the files that are uploaded daily to netmirror.org and s9y.org, or you always could use the SourceForge.net server, that published the file via a nasty ViewVC oddity. The spartacus plugin of the current github core code (version 2.25) now can also retrieve those files from the Github.com servers.

For all users that currently use the Spartacus plugin with the SourceForge.Net mirror, our daily script now pushes all changes in the GitHub tree also to CVS, so that both repositories *should* be kept in sync. This is done via the gitclone.sh and gitclone.php scripts in the additional_plugins repository, for anyone that's interested.

Most likely, something in this script won't work properly, so in the next days it might be that some glitches in the matrix can occur. In that case, please report issues and remain seated. Or buy christmas presents for your beloved. Or your beloved developers.

Details about the GitHub migration process, developers please read!

nospam@example.com (Garvin Hicking) — Wed, 05 Oct 2011 17:28:51 +0200

This is just a reference posting to indicate something important going on. Please read here on the process of the Serendipity source code repository being about to move to GitHub

Read the posting on the s9y forums

BerliOS closing down, Serendipity moving

nospam@example.com (Garvin Hicking) — Sun, 02 Oct 2011 22:22:21 +0200

Serendipity's code repository is being hosted on BerliOS for several years. Their free service is now closing down, which means that Serendipity will move its versioning control to a new provider.

The current idea is to migrate SVN over to GitHub.com. This might even motivate some new contributors to get accustomed with the Serendipity core code and make contributing patches easier.

We are planning to move the code repository at the end of October and will keep you posted here. If there are people reading this who are well familiar with Git and especially SVN migration, please step up here or in the forums to help us in the process.

Asides from the SVN service, Serendipity is currently using this infrastructure:

A self-hosted webserver providing a phpBB board on http://board.s9y.org. This is quite active and will stay in the future.
A self-hosted wiki software on http://www.s9y.org/ that allows for a custom navigation and wiki documentation by users. We might switch this to another software, but are not happy with the way MediaWiki handles navigation. We'll see if GitHub is an option to power this.
A self-hosted Serendipity installation on http://blog.s9y.org/
The http://spartacus.s9y.org/ plugin and theme repository, hosted on SourceForge.Net
The code repository for plugins and themes, also hosted on SourceForge.Net and maintained through CVS. Depending on the usage license of GitHub, we are looking into if we can merge plugins/templates and the Core code on GitHub.
A issue tracker, hosted on SourceForge.net. We might utilize the GitHub-Tracker for this in the future.
A mailinglist, that is not very active anymore, also hosted on SourceForge.Net. Since we favor the s9y forums, we might not further spend time on changing this mailinglist.

Server Maintenance

nospam@example.com (Garvin Hicking) — Tue, 29 Jun 2010 11:19:13 +0200

The s9y.org server currently is experiencing some issues. Jannis, our master-bithorder is investigating the issue and we hope it will be resolved shortly. The s9y.org server powers the main wiki as well as the forums; this blog here is hosted on a different machine.

Meanwhile: Summer.

Update 2010-07-05: The server was up and running during parts of the weekend, but it seems the situation was not resolved completely. The server is now once again up and running, but the bootup-process seems to be blocking due to some MySQL issue. The hardware does not report any specific failure, so we're a bit clueless as to what is happening, but we currently do not have the time to completely setup a new server. We'll further investigate the issue, and hope that this outage won't repeat itself too soon.

If something fails, the SourceForge.net support options on SourceForge.net/Projecs/php-blog will be there. We'll also try to work out a possibility for a secondary forum installation that people have offered, and see if we can setup a dump of s9y.org on a static install.

Update 2010-07-06: And the server went down again. We cannot seem to find the reason why it hangs. We might need to completely reinstall the machine. We try to make it happen as soon as possible and post updates here.

Update 2010-07-06, #2: Until being able to reinstall the machine, we try to fix the situation by manually booting the machine's services - currently it seems as if the machine "lives" for about 24-30 hours after each reboot.

Update 2010-07-06, #3: I created a temporary support forum on SourceForge: SourceForge Forum for Serendipity.

Serendipity 1.5.1 with SQLite

nospam@example.com (Garvin Hicking) — Wed, 23 Dec 2009 15:06:07 +0100

UPDATE: Serendipity 1.5.2 release

Some SQLite upgrades from Serendipity prior to 1.5 to the current version might create a problem, that the database update cannot properly update the serendipity_authors database table structure to insert the new "hashtype" (int) column. Due to that column missing, this can lead to the inability to log in.

Sadly SQLite does not easily allow to ALTER a table structure, so unless you have a SQLite admin tool to manually that column, and until the Serendipity Team can provide a proper fix, you should not yet update. Due to Christmas 2009.1 getting released soon, this might takes us a few more extra days.

If you have NOT yet uploaded the new serendipity release and executed the update, you can simply copy the file sql/db_update_1.5-alpha1_1.5-alpha2_sqlite.sql onto your installation, which fixes the upgrade procedure.

Side information: Hashtype defines whether md5 (value '0') or salted sha1 (value '1') is used for the stored encrypted password of the serendipity_authors table. Once you login with a hashtype=0, serendipity will automatically convert your password to sha1, and adjust the hashtype column. This is why once we fix this issue in 1.5.2, we must make sure that no manuall updates you might have used are overwritten, that could lead to Serendipity no longer knowing which hashtype was used for your column. That requires some thoughtful thinking, and a bit more time instead of a hotfix that might make the situation worse.

Note that this ONLY applies to users UPGRADING and using SQLite. A fresh installation as well as using other Database types is not affected.

Mail-server problems

nospam@example.com (Garvin Hicking) — Sun, 20 Dec 2009 18:40:51 +0100

Currently the mailserver of the board.s9y.org is malfunctioning, so new board registrations and reply notifications cannot be sent. Jannis is working on migrating the Mailserver so that the unstable behaviour of the mail-sending of the board is hopefully an issue of the past quite soon.

Update 2009-20-12: SMTP should work again now! If anyone still faces problem, please contact garvin(-at)s9y(-dot)org!

Serendipity Packages for Softaculous

nospam@example.com (Garvin Hicking) — Tue, 11 Aug 2009 09:26:33 +0200

Softaculous is a provider for automatted web-application installations on cPanel/DirectAdmin environments. They have an automatted API for software vendors like Serendipity to be able to setup and install their applications.

Thanks to the hard work of the Softaculous-Team, they have created a package for Serendipity on their own efforts - many thanks for that!

So you can easily install Serendipity on a Softaculous-Platform and be able to upgrade to later installations easily. Check out their Demo site to see an auto-installed Serendipity at work. You can also use this as a free demo of Serendipity, including the backend. Also Softaculous itself has a admin-demo, if you want to have a look on how to automate your installations of web-applications.

On the Serendipity@Softaculous-Site, you can also rate Serendipity or contribute reviews. Currently there are none available, so please feel free to both vote and spread the word on Serendipity there!

Nominate Serendipity in SF.Net Community Awards

nospam@example.com (Garvin Hicking) — Thu, 14 May 2009 09:40:03 +0200

The SourceForge.Net Community Choice Award Nominations are now open. Nominate Serendipity! :-)

Serendipity-Handbuch

nospam@example.com (Garvin Hicking) — Wed, 04 Jun 2008 11:20:27 +0200

(Announcement for the german book. English users have to please stay patient for a possible translation!)

Nach beinahe einem Jahr harter Arbeit kann nun die umfassende Dokumentation zu Serendipity sowohl online wie auch beim netten Buchhändler um die Ecke bestellt werden:

Serendipity: Individuelle Weblogs
für Einsteiger und Profis
(ISBN 978-3-937514-54-3, Amazon).

Das Buch behandelt auf 750 Seiten sowohl die ersten Schritte mit Serendipity (inklusive Installation und Bedienungsanleitung) als auch die Benutzung von Plugins, Templates und einer sehr ausführlichen API-Dokumentation. Ein gutes Schlagwortregister hilft zudem beim täglichen Nachschlagen.

Ein Probekapitel sowie das vollständige Inhaltsverzeichnis kann unter dem oben angegebenen Link eingesehen werden.

Kurzum, ein Buch dass sich jeder deutschsprachige Serendipity-Enthusiast einmal ansehen sollte. Leser des Buches sind natürlich herzlich eingeladen, ihre Meinung oder konstruktive Kritik zu dem Buch im Serendipity-Forum, mir persönlich oder als Amazon-Rezension mitzuteilen.

Zur Feier der Veröffentlichung gibt es ein Gewinnspiel mit 5 Exemplaren des Buches, die uns vom Verlag Open Source Press zur Verfügung gestellt werden. Um ein solches Exemplar kostenlos zu ergattern, könnt ihr folgendes tun:

Bloggen.

Wenn ihr ein eigenes Blog habt, erstellt einfach einen Beitrag bei dem ihr bitte folgenden Link einbaut:

<a href="http://blog.s9y.org/archives/195-Serendipity-Handbuch.html">
Serendipity-Handbuch
</a>

Dadurch wird, falls in eurem Blog aktiviert, auch automatisch ein Trackback gesetzt. Falls das nicht klappt und ihr eure URL hier nicht sofort seht, hinterlasst bitte hier im Blog einen Kommentar mit eurer URL (ohne HTML-Code, hier ist nur BBCode zugelassen).
Kreativ sein.

In eurem Artikel könnt ihr die folgenden zwei Fragen beantworten. Wer kein Blog besitzt, kann die Fragen auch gerne hier als Kommentar beantworten:

Aus welchem Grund sollte man sich das Buch eigentlich kaufen, wenn man es nicht gerade gewinnt?

Was gefällt euch am besten an Serendipity?
Gewinnen.

Der Einsendeschluss ist am 18.06.2008, der Rechtsweg ist ausgeschlossen. 3 Gewinner werden zufällig ausgelost, 2 Gewinner werden anhand der subjektiv originellsten Antworten auf die Fragen entschieden. Die Gewinner werden hier im Blog angekündigt und gebeten, mir ihre Post-Adresse per E-Mail zuzusenden. Teilnahme per Pseudonym ist vollkommen okay, eure Postdaten werden ausschließlich an den Verlag zur Versendung der Gewinne weitergegeben und danach wieder gelöscht.

Viel Spaß und Erfolg,
Garvin Hicking

Spamblock and blogg.de blacklist

nospam@example.com (Garvin Hicking) — Sat, 08 Dec 2007 10:16:00 +0100

The Serendipity Anti-Spam plugin allows to utilize the blogg.de IP blacklist service to block spam. Their service seems to have ceased existence, or at least is rejecting connections. This can lead to comments to your serendipity blog to be rejected. You can easily disable the blogg.de blacklist service in your Anti-Spam plugin configuration.

Note that this option is by default disabled in Serendipity since blogg.de announced that they are no longer actively maintaining the blacklist. A well fit alternative to this service is the Akismet API, which the spamblock plugin also supports.

Your help in sorting serendipity plugins

nospam@example.com (Garvin Hicking) — Thu, 16 Aug 2007 10:20:05 +0200

Like announced earlier on the serendipity blog, fellow usability expert Joachim Harloff is currently trying to improve the listing of Serendipity Plugins so that they are more accessible to users.

He needs your help to fulfill them. Initially he planned to personally meet with serendipity users, but this proved more complex than initially hoped. Thus he has created a smaller, text-based version of it.

You can download the file at http://www.softuse.com/serendipity_sorting.zip. It contains detailed instructions. You can also feel free to personally contact Joachim about any questions you have.

Joachim estimates this questionnaire to take you about 1,5 hours of your time. You could greatly help to improve the serendipity usability, so please participate! Joachim wants to evaluate your responses starting on September the 8th.

NetMirror.org Outage

nospam@example.com (Garvin Hicking) — Mon, 06 Aug 2007 10:32:01 +0200

For the time being, the Netmirror.org servers currently do not update anymore, they seem to be having a problem. We have contacted the maintainers last week and hope to get feedback soon.

Until then, download of some and new plugins via Spartacus through this mirror will not work, and you will need to configure the Spartacus plugin to use the SourceForge.Net mirror servers.

Once the problem is resolved, we will give you a status update here.

UPDATE: Netmirror.org works again, thanks to their technicians :-)

German PHP Magazine featuring Serendipity article

nospam@example.com (Garvin Hicking) — Sat, 19 May 2007 12:50:51 +0200

This month's german PHP magazine features an article introducing Serendipity and its capabilities, as well as some looks into thecode- written by yours truly, Garvin Hicking. The article is titled "Blogging mit Biss"

The article was written with newbies to Serendipity in mind, but also targetted at eager developers who might want to contribute to Serendipity. When the next PHP magazine issue comes out, we'll see to publishing the article on s9y.org.

If you've read the article and want to share your opinion, feel free to comment here.:-)

Double the servers is double the fun!

nospam@example.com (Jannis) — Fri, 01 Dec 2006 18:27:39 +0100

The nice folks of AOE media GmbH offered to sponsor the s9y project with another dedicated server, which arrived today. I spent the day installing the base system, setting up mysql replication through a vpn between the two servers, and stuff like that. So for those of you who noticed a downtime today, it was a planned one (and also un-announced ;-), that I used to copy a snapshot of the s9y.org and supersized.org databases over to the new server. I hope it didn't cause too much trouble for you, but this made future work/load-distribution over the servers a lot easier. All the s9y.org-webserver-responsiveness-jazz of the last months should ease up a little over the next few months. Finally ;)