Arbitrary header inclusion in "Mail Entry" plugin

Thanks to a user on the Forums I was notified of an arbitrary Header injection issue of the "Mail Entry" plugin. This plugin is only available in our additional_plugins repository and neither bundled nor installed by default, and a not frequently used plugin (according to the forum messages). In this plugin it was possible for spammers to inject arbitrary E-Mail header fields into an email that was passed to the PHP mail() function. This can lead to your server being used as a SPAM or phishing mail relay. It does not affect compromising SQL or author data or makes your blog as such insecure. Many Mail servers also do not let spam mails like these go through, if they make apply some level of relay checking. The additional_plugins repository contains several plugins from other people, for which the Serendipity developers can only taken a ground-level of responsibility. We leave much of the responsibility up to the authors, even though we perform several tests on new plugins, and we are very sorry for this security issue in the plugin. We strongly advise plugin authors to use the serendipity_sendMail() function to send E-Mails, which applies some validation of E-Mail headers. Version 1.20 of the plugin has just been committed and can be fetched from CVS after the usual SourceForge anonymous lag of about 24 hours. Users of that plugin are urged to either remove that plugin or temporarily deactivate it until they have upgraded to the new version.

New plugins: Markread, Showentries

I've committed two new plugins to the repository. First the serendipity_event_markread ("Show read/unread state of entries for visitors"), which is a plugin that allows to you mark entries as read for your visitors. Just as the description says *g*. This is very usable for aggregator-sites; the plugin offers new smarty variables (look at the PHP code for info) so that you can custom style your entry layout depending on the read state of an entry.

You could, for example, show the extended body for all unread entries, and only show the first 20 characters for all read entries. Use the power!

The read state is saved in an additional DB table and sets a cookie to remember your visitor ID. If you're a registed author/user of a blog, it will set your cookie in a way that you can also log on to other computers where the read state will also be carried over to. As anonymous user, your read-state will be per-computer.

The second plugin is serendipity_plugin_showentries ("Show entries in sidebar"). It allows you to show an entry listing with body texts and so on of certain entries inside the sidebar. You can show entries of a specific category there, which makes it great for moblogging sidebars, where you can fetch all entries of a "Moblog" category

Have fun and a nice weekend, Garvin

Serendipity 0.9-beta3 released

Serendipity 0.9-beta3 has been released. This should be the last release candidate for Serendipity 0.9, which is scheduled to be out next Friday.

Fixed issues in beta3 are:

  • RSS Feeds no longer show email addresses by default (configured via syndication plugin)
  • Fixed siteConfiguration option was not available for Blog editor group users
  • Fixed bugs with per-author/category RSS feeds when not using URL Rewriting
  • Enhance entryproperties to allow entering custom fields
  • Fix not having fetched properties of entries when displaying search results
  • Fix some PHP 4.4 compatibility issues about returning variables by reference
  • Fix some blog importer problems remaining when the source DB is not the same as the target DB

Updating from any Serendipity version is easy: Backup first, then extract the release files over your old installation, make sure the files .htaccess/serendipity_config_local.inc.php are writable, login to Serendipity and be guided through the automatic upgrade process.

Have a nice weekend, and thanks in advance for reporting bugs to us!

Extended Properties for Entries: Custom Fields

As a response to a Feature Request from Karotte, I have just committed an enhancement to the entryproperties plugin to 0.9-beta3 of our SVN (which will hopefully be turned into a 0.9 final at the end of this month).

The plugin configuration has now been altered so that you can add a comma-separated list of custom fieldnames, which you can then fill in when creating an entry.

That means, you can create two custom fields called Listening and Playing (don't use whitespace or special characters for fieldnames). Create an entry, and fill in values for those two fields. Now edit your entries.tpl template and place the Smarty Codes

Now listening to: {$entry.properties.ep_Listening}
Now playing: {$entry.properties.ep_Playing}

anywhere you like inside the entry loop. Remember to prefix your property keyname with ep_. Then you'll see those fields at the place you configured. You can also add the usual Smarty markup to check if a variable is empty, and add some DIV or other tags to surround your output.

This brings Serendipity a bit closer to CMS-features, once again. :-)

(The SVN nightlies will be built tomorrow, containing the new patch. SVN checkouts contain the change already at this time - users familiar with SVN only need to fetch the plugins/ serendipity_event_entryproperties/ serendipity_event_entryproperties.php file)

Serendipity 0.9-beta2 released

Serendipity 0.9 is still in beta-testing, but getting close to the final release. Thus a 0.9-beta2 version has been released, which mainly fixes two problems with beta1: Spartacus not indicating new plugin versions and the "easy installer" inserting invalid configuration values that lead to the dreadded "function serendipity_mb not found" error.

On top of that, the second beta contains:

  • Per-author XML feeds
  • Enhanced entryproperties plugin that can hide selected entries from the RSS feed
  • Recent Comments plugin can be configured to show comments, trackbacks or both
  • Make Spartacus plugin be able to set configured chmod/chown permissions
  • Improved Spamblock plugin to allow configuring author/url filters straight from the "Comments" interface
  • Category plugin can now use smarty templates and show number of entries
  • Fix Track Exits plugin to properly redirect when used in HTML nuggets
  • Fixed bug in fetchEntry() function that can lead to wrong author/authorid settings in certain cases

Updating from any Serendipity version is easy: Backup first, then extract the release files over your old installation, make sure the files .htaccess/serendipity_config_local.inc.php are writable, login to Serendipity and be guided through the automatic upgrade process.

If all things go smoothly with the 0.9 betas (which it basically seems right now), you can expect a final release at the end of this month. We need your feedback, please testdrive the new version!