Serendipity

Serendipity 1.5.4 released

mail@garv.in (Garvin Hicking) — Fri, 27 Aug 2010 12:28:28 +0200

Serendipity 1.5.4 has been released and addresses some minor bugfixes as well as a XSS security issue discovered and reported by High-Tech Bridge. The XSS is only exploitable though, if you are using the "Remember me" feature in the Serendipity backend to login. Thanks to the quick notification by the team we were able to fix the issue within 24 hours, as with all past security issues.

The XSS-issue can easily be patched by only replace the file include/functions_config.inc.php with the new file (link), or by applying this patch.

Other bugfixes that come with the new Serendipity 1.5.4 release are:

Fix PHP 5.3.2 parse error in a file, thanks to fyremoon
Fix SQL query statement for deleting a category, which on some DB types (SQlite) might not return "true" and thus not really delete the category.
Include license output in plugin listing
Fix escaping when using ImageMagick to create PDF-thumbnail images
Add new template variable to feed*.tpl files to support new plugins like pubsubhubbub, so that plugins can embed data to the main XML element

The latest release can be found on our SourceForge repository and on the usual place on . To upgrade from any previous Serendipity version, simply extract and upload the new files to your server.

Server hardware replaced

jannis@gmail.com (Jannis) — Wed, 18 Aug 2010 17:16:23 +0200

Hey there, we got some of the server hardware for s9y.org and board.s9y.org replaced, so let's hope everything goes a little more smoothly from here on... Cheers!

Server troubles

jannis@gmail.com (Jannis) — Sun, 01 Aug 2010 11:55:17 +0200

On of the servers running s9y.org/board.s9y.org has suffered from a hardware failure, unfortunately. It will be replaced in the next week. It's gonna be a bumpy ride until then, with a couple of downtimes. I'm working on it. Enjoy the weekend, and if it's sunny, go out :)

Goodbye,
apologetic Jannis.

PHP Parse Error on new PHP 5.3.2

mail@garv.in (Garvin Hicking) — Sun, 25 Jul 2010 00:34:53 +0200

As we were notified on our forums, the updated PHP 5.3.2 version seems to have changed a behaviour of quoting array variables within strings, which produces a PHP parse error on a serendipity file include/functions_entries.inc.php at line 1433 (in Serendipity 1.5.3).

The fix is actually quite easy, if you replace the code found at line 1433 from this:

serendipity_db_query("DELETE FROM {$serendipity["dbPrefix"]}entries WHERE id=$id");
serendipity_db_query("DELETE FROM {$serendipity["dbPrefix"]}entrycat WHERE entryid=$id");
serendipity_db_query("DELETE FROM {$serendipity["dbPrefix"]}entryproperties WHERE entryid=$id");
serendipity_db_query("DELETE FROM {$serendipity["dbPrefix2]}comments WHERE entry_id=$id");

to this:

serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}entries WHERE id=$id");
serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}entrycat WHERE entryid=$id");
serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}entryproperties WHERE entryid=$id");
serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}comments WHERE entry_id=$id");

If you can't easily spot the difference: It's changing ["dbprefix"] with double quotes to ['dbprefix'] with single quotes. We're sorry for this inconvenience, which is already fixed in our SVN branches and will be part of the next release.

Thanks a lot to fyremoon from the forums, this thread.

Server Maintenance

mail@garv.in (Garvin Hicking) — Tue, 29 Jun 2010 11:19:13 +0200

The s9y.org server currently is experiencing some issues. Jannis, our master-bithorder is investigating the issue and we hope it will be resolved shortly. The s9y.org server powers the main wiki as well as the forums; this blog here is hosted on a different machine.

Meanwhile: Summer.

Update 2010-07-05: The server was up and running during parts of the weekend, but it seems the situation was not resolved completely. The server is now once again up and running, but the bootup-process seems to be blocking due to some MySQL issue. The hardware does not report any specific failure, so we're a bit clueless as to what is happening, but we currently do not have the time to completely setup a new server. We'll further investigate the issue, and hope that this outage won't repeat itself too soon.

If something fails, the SourceForge.net support options on SourceForge.net/Projecs/php-blog will be there. We'll also try to work out a possibility for a secondary forum installation that people have offered, and see if we can setup a dump of s9y.org on a static install.

Update 2010-07-06: And the server went down again. We cannot seem to find the reason why it hangs. We might need to completely reinstall the machine. We try to make it happen as soon as possible and post updates here.

Update 2010-07-06, #2: Until being able to reinstall the machine, we try to fix the situation by manually booting the machine's services - currently it seems as if the machine "lives" for about 24-30 hours after each reboot.

Update 2010-07-06, #3: I created a temporary support forum on SourceForge: SourceForge Forum for Serendipity.

Flattr Plugin

mail@garv.in (Garvin Hicking) — Fri, 21 May 2010 09:21:00 +0200

Flattr is a new service that is up and coming the last days in the blogosphere. Their service offers a social micropayment platform that lets you show love for the things you like..

The service allows normal people (consumers) to create an account, where they can deposit a certain amount of money. Whenever they appreciate a blog entry, an image, a video or any other content they see on a flattr-enabled website, they can easily click a link to add support to this website. At the end of a certain period, the deposited money is distributed among all the authors of things, that the consumers liked.

In first regard, this is not really a service to get paid from, but rather a service to spend money on. The modern web has become more and more of a place where people expect free high-quality content. Now it's time to remember, that quality content is not something that has been free for all people all of the time. This is a new phenomenon of the internet, and people work hard on offering this content, just on their own and to contribute to mankind. With flattr, you can show appreciation for those great deeds, by giving something back to things that wouldn't otherwise be there.

This is a bit in the spirit of the early Paypal-donation days, but with a twist: The distribution of a specific deposit and the easy way to "bookmark" interesting things to rembemer them once a fresh billing cycle arrives. It's a bold move in the opposite direction that Facebook just recently went with their global "I like" method. Flattr not only gathers the information, but enables the originating authors to notice that other people appreciated their work.

Much ado about something, a plugin to this Interface from within Serendipity is mandatory. Even though the API of Flattr is terribly easy to implement with a small javascriptlet, the Serendipity Plugin does have its unique usage scenarios:

You can decide on a per-entry basis if you want to announce a blog entry for flattr.com appreciations.
You can enter the metadata (language, category, description) seperately for each blog entry (inside the usual blog entry administration).
If you don't provide specific information, the globally entered fallback will take effect and is used for flattr-submission. Like if you did not specificy a custom category for a blog title, the global category will be used.
The flattr-Badges are integrated within the RSS-Feed (for javascript-enabled RSS readers)
When using the Freetag-Plugin, its tags can be automatically used as flattr-tags - or you can override them with custom tags.
The plugin allows you to place the badge either inside the entry footer, the entry body or even place it in a custom Smarty template variable so that you can place it anywhere.

The plugin is available now on Spartacus, or for direct download. Just unzip to your plugin directory, and enable the event plugin inside the Serendipity plugin management interface.

Feedback on how to improve the plugin is welcome, preferrable on the Serendipity Forums.

Serendipity 1.5.3 released, Security Issue with Xinha

mail@garv.in (Garvin Hicking) — Mon, 10 May 2010 13:37:00 +0200

Serendipity 1.5.3 has been released, as a security-fix release with no other relevant changes.

A security issue has been discovered by Stefan Esser during the course of the Month of PHP Security. This issue was found in the WYSIWYG-Library Xinha (that Serendipity uses), and affects certain plugins to Xinha (Linker, ImageManager, ExtendedFileManager, InsertSnippet) which can use a dynamic configuration loader. This loader allows to upload file with arbitrary PHP-Code and thus allows remote code execution, even when not logged in to the Xinha/Serendipity backend.

Due to the seriousness of this bug, we urge everyone to upgrade their installations. People who don't want the hassle of a full upgrade and are not using the mentioned Xinha-plugins actively, can simply delete the file htmlarea/contrib/php-xinha.php, which will render the mentioned plugins and exploits useless.

Thanks to Stefan Esser for reporting this issue to us, and making a quick bugfix possible.