Einträge für Garvin Hicking – Serendipity

Some users have reported on the forums that they had login problems to their Serendipity Admin suite since the upgrade to version 1.1.

Thanks to the help of Shadowin it was discovered that a problematic $_SERVER['HTTPS'] variable setting by the Windows IIS Server caused this. According to the PHP documentation, $_SERVER['HTTPS'] should only contain a non-empty value in case of enabled SSL/HTTPS connections, in which case Serendipity would issue a "secure" cookie.

To fix this odd behaviour in Serendipity 1.1 you need to open the file include/functions_config.inc.php and replace the line

$secure = !empty($_SERVER['HTTPS']) ? true : false;

with

$secure = (strtolower($_SERVER['HTTPS']) == 'on') ? true : false;. Also replace this line in the file serendipity_config.inc.php:

if ($_SERVER['HTTPS'])) {
  @ini_set('session.name', 'SSLSID');
  @ini_set('session.cookie_secure', '1');
}

with

if (strtolower($_SERVER['HTTPS']) == 'on') {
  @ini_set('session.name', 'SSLSID');
  @ini_set('session.cookie_secure', '1');
}

This will use a more stricter check. For people who are afraid to edit that file, simply download this file and replace it with your current include/functions_config.inc.php file. Also please download this file and replace it with the 'serendiptiy_config.inc.php' file.

A fully patched 1.1.1 version will be made available later, when we have made sure that there are no other bugs left. So far, the 1.1 version has been received very stable by the public! Thanks for improving Serendipity through your reports and help!

The Serendipity Team is proud to release the Serendipity Weblog version 1.1 to the public.

This new version is aimed for feature enhancement and stability consolidation. The most important change is the overhaul of the media database, which vastly enhances the already obvious superiority of Serendipity's Media management. In depth this means that you can now store and customize meta properties easily - store descriptions, EXIF-Tags and keywords which you can later see and search in your database. You can also now assign detailed privileges for each directory of the media database, and the output is now completely templated. Yes, that means you can customize and style your very own media database, both effective in the backend and the frontend.

The other important change is more granular plugin permission management. You can enable/disable certain markup-plugins on a per-entry basis, and allow/forbid specific usergroups to access certain plugins.

Another visual apparent change is the overhaul of the plugin manager. You can now drag'n'drop order and move your plugins around. Together with the ability of templates to specific the amount and names of sidebars, you have virtually unlimited flexibility for plugin management!

Templating has also intensively been upgraded in the respect of themes being able to specify custom "options". A theme could allow you to choose navigation links, colorsets and much more. Explore the possibilites! Many themes by Carl Galloway and other great designers from our forums have already used that feature to provide you with many cool options!

For the developers among us, it might be of interest to note that Serendipity now also supports easy custom template-engine support. Tired of Smarty? You can also use a plain old PHP template emulation or even a XSLT-transformation layer (read more on this topic here).

Of course we have not only focussed on injecting features, but also fixed some minor bugs, a huge-impact central SQL query optimization and glitches and smaller improvements. In total we have 29 feature improvements, 24 bugfixes and 21 usability/technical improvements. For intense reports on this either read our NEWS-file or past 1.1-beta announcements here and there.

Upgrading is easy as always: Download, unpack, go to your Admin panel, done. Read more here: Serendipity FAQ. The download is available here: Serendipity Download Page.

We hope you'll have fun with this new release and continue to make Serendipity an ever-improving system. Let's have a great 2007!

As you might have noticed, our server went away this week, but is now up and running again. This had effects on our Serendipity 1.1 release cycle. 1.1 was scheduled for this week, but could not be released. Now I'm out of time because of upcoming christmas, so expect the new Serendipity version in the last week of this year. :-)

This new Serendipity release addresses a local file inclusion security issue discovered yesterday. It was possible to give a special parameter to a serendipity file to include a file on your own web-tree (or other files the webserver has read access to). If used on clear-text files, this could be used to disclose information like the apache logfiles on your website.

This error can only happen in a scenario with two prerequisites: Register_Globals needs to be turned on in your PHP configuration AND your webserver must ignore the default Serendipity .htaccess file. This .htaccess file usually prevents to directly call Serendipity's include files via HTTP. Thus we feel that only a very low percentage of installations should be affected by this bug.

However, Serendipity 1.0.4 is a recommended upgrade for everyone taking security responsibly, like we do. We are thankful to the community for inspecting Serendipity, searching for bugs and security issues and reporting them to us. In this case, many thanks to Majestic from the forums for notifying us.

Most of the plugins (both bundled and available via spartacus) were upgraded to also circumvent that bug, so you should upgrade all of your active plugins to the recent versions as well.

The Serendipity 1.1 release tree was also modified with a patch for this issue. It will be contained in todays snapshot, and the 1.1-beta6 release file. The easy steps to perform an upgrade are documented in our FAQ on http://www.s9y.org/.

Thanks to Robert from the forums he convinced me to implement a feature for him. Well, actually he bribed me to do it. ;-)

Nevertheless, now that I implemented the feature, I kinda like it. The enhancement to the Freetag plugin (version 2.7, should be available via Spartacus now) allows you to enter a list of comma seperated keywords for each tag you have available on your blog.

Whenever you save an article now, the plugin will analyze the content of your entry. For each keyword that you entered and that is found in the article, the corresponding tag will be auotmatically assigned to your entry (taking care that no duplicate tags happen).

So, if you have the Tag "PHP" you could enter keywords like "Serendipity,php,s9y,phpbb,xss,sesser". When you now create an entry where you use the keyword "Serendipity", the freetag plugin will automatically assign the tag "PHP" to this entry.

Thus, especially if you have a low count of tags you can save a lot of time by assigning meaningful keywords to your tags. Beware that if you enter a lot of keywords for a lot of tags, that this might slow down saving an entry. This happens because a list of EVERY available keyword needs to be compiled and matched against your saved article to be able to see which keywords were used.

Have fun!

The Serendipity 1.1 release cycle is finally getting ready to be pushed out of the door. It seems to run quite well from the reports on the forums we gathered and we have not heard of any showstoppers or open bugs left in it.

I would like you all to testdrive the latest snapshots (which should run without any problems) and see if you find any remaining bugs/issues. If possible, report them on the forums where we can best discuss about it.

Also, for any possible translator of our language files - we need your help to translate new strings before the release. Please download the snapshots on www.s9y.org and have a look at the contained language files. You can send the translations to the forums or drop a message here and I will commit them.

Special help is required for these languages which have no active maintainer, have not been updated for a long time or no maintainer has been entered in our language files: Tamil, Romanian, Polish, Norwegian, Hungarian, Czech.

The goal is to release Serendipity within the second week of December.