rrichards from the forums published his first public OpenID-Plugin results. Check out this thread on the forums. If you're interested in testing the plugin or are interested in OpenID, please give it a look and report about it.
Many thanks to rrichards and all volunteers!
Alp Uckan has released his theme Adaptation (german page, layout can be seen on his site). It's a "content-first" based theme with advanced Serendipity 1.1 design options such as choosing color- and fontsets. It evolves around full CSS and XHTML compatibility and thus providing accessibility options being set by the user in his browser (fontsize, colors etc. are based on browser setup).
Have a look at this clean template, it's now also being added to Spartacus! Thanks a lot to Alp for providing his theme to the public.
Ellen and Prabath from the OpenUsability.org project are conducting a User survey on how our users are working with Serendipity. The results of this survey will have a huge impact on Prabhath's student work as a Usability Engineer - he will try to make suggestions to enhance the user experience of the Serendipity Entry-editing interface, and maybe more.
Please participate, everyone. You will benefit by making Serendipity more user-friendly to fulfill your very own needs!
This evening we were notified by fellow co-developer Sebastian Nohn about a full-disclosure posting about a Serendipity SQL injection matter. We have investigated this reported 0day issue, and can tell you that it is not a SQL injection,but instead "only"an SQL error display.
No SQL can be injected using the described method. Because of an invalid category ID, serendipity tries to show entries for that category, but the resulting SQL string contains an emtpy "(())" statement which makes the MySQL parser fail, and report the error on-screen. The SQL queries that Serendipity uses are not secret, and could be looked up in the sourcecode as well.
Even though we consider this issue to be fairly low-impact, Serendipity 1.1.2 has been released because of this, mainly to assure the public that we have addressed the issue. It is not critical that you upgrade to that release. If you do, it is sufficient to update the include/functions_entries.inc.php file. The only change made to that function is documented here
We would also like to express, that we kindly appreciate all bug and security reports about Serendipity, and take them and our responsibility very seriously. Also rest assured that if you contact us developer first before publishing security advisories, we always cooperate, pay credit and fix issues immediately, as we have done in the past. So we look forward to working together with SaMuschie in the future, who seems to taking some serious work in checking security issues - good work on that! :-)
The latest release can be downloaded here. This fix has also been committed to the daily snapshots.
As you might have read in the Serendipity 1.1.1 release announcement, we have a fundamental code change in Serendipity 1.2 concerning the authentication theme.
Those changes were discussed in this forum thread
It basically evolves around those things:
Those changes might introduce new glitches, especially in environments where HTTPS is used, and/or the multilingual plugin features.
Everyone using such an environment, please download a recent Serendipity 1.2 snapshot and try it out on a test-system. You can easily clone an existing installation of yours by copying all files to a second directory, copying the database tables to a different table (or with a different table prefix) and then uploading the Serendpity 1.2 Snapshot to that dummy directory. After your login to that new installation, change the path locations in your Serendipity Configuration and you can test the new install with the data of your production blog.
Your help is much required to ensure the stability of Serendipity. Any problems you face that did not previously show up in older Serendipity versions should please be reported on our forums!
Many thanks go to rrichards_ from the original thread, who implemented the new functionality that will hopefully ultimately lead to OpenID integration into Serendipity. :-)
After the well-received Serendipity 1.1 release, we put our ears to the community and searched for any bugs left. Luckily, those were very few (like the IIS server cookie bug) - we didn't at first believe it, so we let some time go by to be absolutely sure there were no other things to fix before issuing a maintenance release.
And here it is now: Serendipity 1.1.1 is a bugfix-only release to fix these reported issues:
This is not a security-related upgrade. You only need to apply it if you think you are affected by any of the bugs listed.
Meanwhile, we continue to work on Serendipity 1.2 for feature improvements. Together with helpful users of the forum we are currently working on improving the authentication/plugin API sequence to better support future plugins like OpenID. Any help is appreciated, have a look at the forum thread. Also we are working on improving the Spartacus API, PDO::PostgreSQL support has been added, spamblock plugin improvements and some tweaks to the permalink system.
You can download the new version (or a recent snapshot of Serendipity 1.2) as always on our Download page. Detailed upgrade steps are explained in our FAQ, but it's as simply as: Download, extract, go to the Admin panel. :-)
Have fun!