Serendipity – The official Serendipity blog

For the time being, the Netmirror.org servers currently do not update anymore, they seem to be having a problem. We have contacted the maintainers last week and hope to get feedback soon.

Until then, download of some and new plugins via Spartacus through this mirror will not work, and you will need to configure the Spartacus plugin to use the SourceForge.Net mirror servers.

Once the problem is resolved, we will give you a status update here.

UPDATE: Netmirror.org works again, thanks to their technicians :-)

The last call for users in munich didn't result in too terribly many, so we're now broadening the userbase.

Joachim Harloff ist a usability expert and wants to help Serendipity in creating a better overview of plugins. To do so, he needs participants to find out what users needs. And guess what: YOU are those users. :-)

So if you want to help out and give Joachim some feedback, please get in touch with him privately: harloff at softuse dot com. Just refer to this blog entry, and he'll provide you with details on how you can help.

German

Der letzte Aufruf nach Münchner Usern ist nicht ganz so ausführlich ausgefallen, wie wir uns das erhofft hätten. Daher weiten wir das ganze etwas aus, damit sich nun jeder (via E-Mail) beteiligen kann.

Joachim Harloff ist ein Usability-Experte, der angeboten hat, die Pluginsortierung für Serendipity zu optimieren. Dafür benötigt er euer Feedback. Bitte schreibt ihm eine Mail an harloff at softuse dot com und bezieht euch auf diesen Blog-Eintrag, er wird euch dann weitere Details zukommen lassen, wie ihr helfen könnt.

Are there any Serendipity-users out there who live in or near Munich (that is München for our fellow germans)? Those people could help in improving Serendipity by getting in touch with me. Please respond on the forums, thank you.

Update, July 2nd: The Server is online again!

Hey folks,

as usual when I post here, it's kinda bad news. As you may have noticed, the main server running s9y.org and board.s9y.org went down a couple of hours ago. Since engineers at the noc are expensive on weekends (200€/h), it won't come back until monday. blog.s9y.org is hosted at supersized.org and not affected (obviously). But don't worry, another server is set up and s9y.org and board.s9y.org will be transferred over to that one asap and things should run a lot smoother than in the past.

For those of you who didn't upgrade yet, here are temporary downloads for the current versions:

• s9y-1.2beta2
• s9y-1.1.3

Update: The power adapter died and has been replaced.

Serendipity 1.1.3 and 1.2-beta2 have been released due to a SQL injection attack reported by Dr. Neal Krawetz today. It is possible to abuse a 'commentMode' variable to inject SQL code that was targeted to the function that fetches comment information. This variable was introduced to Serendipity 1.1 - all prior versions are not affected.

Please update your blogs as soon as possible. If you are using a database backend that allows SQL union queries, the injection could probably lead to disclosure of the stored MD5 password hashes. Because of this, we also suggest to update your blog user account passwords.

It is a good idea to check your server's Access-Logs and search for the 'commentMode' variable to see, if malicious request have been issued to your blog already.

For those people that do not want to upgrade to a whole new version, you can also simply patch the file include/functions_comments.inc.php and replace the single occurence of:

$type = $serendipity['GET']['commentMode'];

to

$type = serendipity_db_escape_string($serendipity['GET']['commentMode']);

We are very sorry for this, but happy to provide a quick fix in short time. You can download the latest files as usual on www.s9y.org. Read the FAQ on how to perform an easy update.

I upgraded the staticpage plugin in CVS to version 3.50 yesterday (which should be available via Spartacus now already).

It now supports to use a custom smarty function to show static pages. This can be used in your custom template files (like the userprofile .tpls) to emit specific staticpages depending on variables.

Go ahead and play with it. The API is quite basic and described in the new 'smarty.inc.php' file. It basically works like this:

{staticpage_display template="$TEMPLATE" pagevar="$PAGEVAR" id="$ID" permalink="$PERMALINK" pagetitle="$PAGETITLE" authorid="$AUTHORID" query="$QUERY"}

The API is quite fundamanetal right now. If you want to access more properties/parameters, please let me know, and I'll implement them. Please discuss this feature on our forums in this thread.