Flattr Plugin

Flattr is a new service that is up and coming the last days in the blogosphere. Their service offers a social micropayment platform that lets you show love for the things you like..

The service allows normal people (consumers) to create an account, where they can deposit a certain amount of money. Whenever they appreciate a blog entry, an image, a video or any other content they see on a flattr-enabled website, they can easily click a link to add support to this website. At the end of a certain period, the deposited money is distributed among all the authors of things, that the consumers liked.

In first regard, this is not really a service to get paid from, but rather a service to spend money on. The modern web has become more and more of a place where people expect free high-quality content. Now it's time to remember, that quality content is not something that has been free for all people all of the time. This is a new phenomenon of the internet, and people work hard on offering this content, just on their own and to contribute to mankind. With flattr, you can show appreciation for those great deeds, by giving something back to things that wouldn't otherwise be there.

This is a bit in the spirit of the early Paypal-donation days, but with a twist: The distribution of a specific deposit and the easy way to "bookmark" interesting things to rembemer them once a fresh billing cycle arrives. It's a bold move in the opposite direction that Facebook just recently went with their global "I like" method. Flattr not only gathers the information, but enables the originating authors to notice that other people appreciated their work.

Much ado about something, a plugin to this Interface from within Serendipity is mandatory. Even though the API of Flattr is terribly easy to implement with a small javascriptlet, the Serendipity Plugin does have its unique usage scenarios:

  • You can decide on a per-entry basis if you want to announce a blog entry for flattr.com appreciations.
  • You can enter the metadata (language, category, description) seperately for each blog entry (inside the usual blog entry administration).
  • If you don't provide specific information, the globally entered fallback will take effect and is used for flattr-submission. Like if you did not specificy a custom category for a blog title, the global category will be used.
  • The flattr-Badges are integrated within the RSS-Feed (for javascript-enabled RSS readers)
  • When using the Freetag-Plugin, its tags can be automatically used as flattr-tags - or you can override them with custom tags.
  • The plugin allows you to place the badge either inside the entry footer, the entry body or even place it in a custom Smarty template variable so that you can place it anywhere.

The plugin is available now on Spartacus, or for direct download. Just unzip to your plugin directory, and enable the event plugin inside the Serendipity plugin management interface.

Feedback on how to improve the plugin is welcome, preferrable on the Serendipity Forums.

Serendipity 1.5.3 released, Security Issue with Xinha

Serendipity 1.5.3 has been released, as a security-fix release with no other relevant changes.

A security issue has been discovered by Stefan Esser during the course of the Month of PHP Security. This issue was found in the WYSIWYG-Library Xinha (that Serendipity uses), and affects certain plugins to Xinha (Linker, ImageManager, ExtendedFileManager, InsertSnippet) which can use a dynamic configuration loader. This loader allows to upload file with arbitrary PHP-Code and thus allows remote code execution, even when not logged in to the Xinha/Serendipity backend.

Due to the seriousness of this bug, we urge everyone to upgrade their installations. People who don't want the hassle of a full upgrade and are not using the mentioned Xinha-plugins actively, can simply delete the file htmlarea/contrib/php-xinha.php, which will render the mentioned plugins and exploits useless.

Thanks to Stefan Esser for reporting this issue to us, and making a quick bugfix possible.