Einträge für Garvin Hicking – Serendipity

A Release Candidate 3 has just been released (see s9y.org - Downloads, that fixes a couple of reported PHP error notices (in Spartacus, for template configurations). Also the error reporting itself has been reworked a bit to be less verbose. This version also addresses enhanced escaping for stored cookie values of the media database, which we have received a (not very clear) report of. This only affected logged-in users of the backend, so the impact should be minimal.

Please report any issues you find with RC3 as usual on the s9y forums; if you want to address any security issues, please contact security (at) s9y . org. We take all reports seriously, and are very thankful for anyone reporting issues to us. We are a small team, so any help from the outside is really appreciated (and needed) by us. Thanks!

The Serendipity Team is happy to announce the second Release Candidate for Serendipity 1.7.

The first RC1 that was online for only a couple of hours had two issues that made us pull this release candidate. One bug affected people with older plugin versions, that could throw PHP notices and prevent Serendipity from executing properly. The other bug affected that certain variables for Smarty templates were not existing due to missing variable transporting. Both issues have been fixed in this second release candidate.

While we are still working hard to rebuilding the backend (for future HTML5 possibilities, better maintenance and in the end, a better design/UI) we have tried to make Serendipity 1.7 to be the final "pre 2.0" release that deals with a couple of problems with older Serendipity versions.

First and foremost, this release addresses several PHP 5.4 compatibility issues. Serendipity 1.7 now at least requires PHP 5.2 to operate (due to Smarty3). If you have a lower PHP version than 5.2, you can run Serendipity 1.6.x properly, but of course should better ensure that your webserver will be upgraded to a more recent PHP release version.

Serendipity 1.7 comes with Smarty3, a larger rewrite of the Smarty Templating Engine. To make proper use of Smarty3, several core mechanisms have been updated. Other features include better nl2br/nobr plugin handling, Updated 2k11 theme, RSS sidebarplugin can now handle Atom feeds, entryproperties plugin can now define defaults for custom fields. See the contained NEWS release file on github for a list of all changes.

In our alpha development process, many kinks should have been ironed out, so that at this point we feel confident to let YOU try out this new version without facing issues. Now we need you to make sure that there are no quirky webservers or installations out there, that would report any PHP5 notices/errors. Testing the release is quite easy; first you should backup your current installation (download all files via FTP/SSH/RSYNC/whatever, make a database dump) and then simply upload all new files to your webserver; then you're ready to go.

Please report all issues and bugs on the Serendipity Forums (specifically, this thread). If all goes well, we can then soon release the 1.7 final version, so that our developers can fully concentrate on finishing our 2.0 development. On this matter: A huge thanks to developers who made the recent new features, (re)built templates and fixed plugins. This specifically applies to ophian, yellowled, onli, mattsches, Don - your continued work and help is invaluable to me (=Garvin).

Now, go, grab that release: s9y.org Download section

On behalf of the team,
Garvin

The problematic 1.7-rc1 has now been superseded with a new 1.7-rc2 release candidate. The original announcement has been updated to reflect the changes.

The 1.7-rc1 that has been published today has an issue with older Serendipity plugins existing on prior installations, preventing Serendipity 1.7 to operate properly. While we fix this issue for an upcoming rc2, this problematic rc1 has been removed at this point.

Hey!

Finally I've been to a small West-Coast-Trip to the USA. I also visited Las Vegas, and guess what I found...

So there we have the place for our meetup; there's one in New York as well... ;-)

Best regards, Garvin

UPDATED: 2012-05-22 12:00 to clarify impact.

Good and bad things come in doubles, it seems. We are sorry to inform you that another security issue in Serendipity has been found by the High-Tech Bridge SA Security Research Lab (Advisory HTB23092). This issue has been reported today at 11:27 and we're happy to provide a quick fix for that.

You can either download the full 1.6.2 release, or apply this simple fix to the file include/functions_trackbacks.inc.php: diff on github.

The error here is that input is not properly validated and can be used (when magic_quotes_gpc is off) to inject SQL code to a SQL query; since our DB layer does not execute multiple statements, and the involved SQL query is not used to produce output code. Thanks to Pawel Golen it was made clear to us that this issue can in fact be used to remotely access the database through blind sql injection attacks (this method however is really slow and creates a lot of traffic, since only using 0/1 as a result of the exploit will mean a lot of queries to deduce the content). Thus you should definitely upgrade your installation.

Serendipity is an open-source based product with no specific funding, so we depend on nice people like High-Tech Bridge, Stefan Schurtz, Hanno Böck and all the others of the past to report issues to us. In turn we promise to fix them as quickly and transparently as possible.