Development - 15 – Serendipity

Serendipity 1.0.x an PHP 5.2.0 currently do not go well together because of the new PHP ext/filter extension. In the early PHP 5.2.0 cycles this provided a function 'input_name_to_filter' which was later dropped, but not removed from Serendipity 1.0

Serendipity 1.1 beta versions already use a function_exists() check to prevent this, but it had not made it into the 1.0 release cycle.

Thus, to make s9y work with PHP 5.2.0, you have three options:

1. Disable the ext/filter extension in your php.ini configuration,
2. Upgrade to Serendipity 1.1-beta versions or
3. edit your serendipity include/compat.inc.php file and replace the string "extension_loaded('filter')" with "extension_loaded('xfilter')", which will effectively disable the follow-up code to take effect

The upcoming Serendipity 1.1 final version will of course integrate a more thorough fix. The serendipity Team is sorry for this confusion it may cause for PHP 5.2.0 users.

Time again for a new release!

Serendipity 1.0.2 mainly features a XSS injection attack on the admin backend which could happen if registered authors can be tricked into following a specially crafted URL. This bug was detected by the ever-restless Stefan Esser, many thanks for notifying us. Users of previous version of Serendipity are urged to upgrade to be secure. Note though that this bug requires your own interaction and thus exploits of this depend on how well you can stay away from clicking links that you do not know what they do exactly. ;-)

Serendipity 1.1-beta5 features the following new changes since 1.1-beta1:

1. Prevent XSS backend injection attack (see above)
2. Themes can now support custom amounts and positions of any number of sidebars (top, bottom, left, right etc.) (more)
3. Usergroups can now configure which plugins/events a group is allowed to execute (more)
4. Added the options to use HTTP-Authentication for your login, which enables you to use secured RSS-Feeds with login credentials
5. Some permalinks oddities when using % in URLs and some other minor fixes

Serendipity 1.1 is getting very close to getting finalized (targets mid-December). New major features will be added to a 1.2 version branch, so expect no more major changes here. Please help us by trying out the latest version and report bugs/issues!

Upgrading is easy as ever: Download, unpack, go to your Admin panel, done. Read more here: Serendipity FAQ. The download is available here: Serendipity Download Page

Have fun!

For ages, Serendipity has given users the flexibility to move around plugins in the left/right sidebar. Two sidebars were a usual concept for blogs in the days past, and for surely some more days to come.

But some themes, like the Hemingway theme give people a different approach to surrounding their blog content. The result of a porting discussion on the forums lead me to patch our plugin API.

Serendipity 1.1 already support custom theme options (like special navigation bars, colorsets etc.), and what came out of my recent patch is the functionality to define multiple custom sidebars.

With this, you can add a "top", "bottom", "middle" or whatever else sidebar locations to your themes, and put them in the smarty templates using the function {serendipity_printSidebar side="XXX"} wherever you like.

It's as easy as adding a config.inc.php file to your template, add a $template_config array value like this:

       
$template_config = array(
     array(
       'var'     => 'sidebars',
       'title'   => 'Sidebars',
       'type'    => 'string',
       'default' => 'left,hide,right,bot'
     )
);

(or modify existing config arrays) and save the file. When you now enter your plugin configuration section, you will see each of the sidebar locations next to another, so that you can move around plugins from one to the other location.

There are two things to watchout: If you use locations other than 'left' and 'right', other templates may not output plugins that were put to a location like 'bot'. So if you switch templates, you must watch out on where you put your sidebar plugins into.
The other thing to pay attention: Only use "," to separate the sidebar item names (no spaces!) and never use more than 6 characters for your locations.

Please have a test with these new possibilities, tell us if you like it, and show us the results you made with it!

This functionality has been implemented into recent Serendipity 1.1 nightlies (currently 1.1-beta4)

Despite my downtime, I was able to find the time to commit some changes I was having up my sleeve to the 1.1 beta version.

It involves, what many people have asked for: Specify, which user/usergroups are able to have access to certain plugins. My standpoint until now was, that plugins should implement the versatile permission management of Serendipity, available since version 0.9.

However, reality got me when I saw that no plugin was really ported yet to use that permission management setup to provide custom permission sets. But people wanted to have the ability to say "The staticpage plugin is only available to user XY".

Thus, I implemented a rather hackish way into the groupmanagement: You can now specify complete plugins, or specific event hooks which are forbidden for a usergroup. This way, you can say that group X is not allowed to execute a 'Staticpage' plugin.

This approach should work quite well for many usage scenarios - the upside is, that all old plugins are supported instantly. However, the neater approach of course is to modify plugins so that they provide their own permissions for more granulate control of what you want to achieve.

To enable this functionality you must first enable the option "Enable Plugin ACL for usergroups" in the serendipity configuration. The reason why you must explicitly enable this is, because those plugin checks decrease the performance of the plugin API. Every executed plugin hook must be checked against the blacklist, and those checks would hurt bloggers that do not intent to use this feature. To satisfy everyone, you have an option for this.

You can try the feature in the nightly builds created today, or using an SVN checkout. The feature is contained in 1.1-beta4.

The Serendipity Team is proud to offer two new releases:

Serendipity 1.0.1 addresses a few minor bugfixes in the otherwise very well-received 1.0 stable release. Those are related to utf8-iconv conversion on older PHP setups, sending comment mails to users without an email address and a WYSIWYG image insertion issue.

The most important fix and reasing for the 1.0.1 release is a security issue that has been reported by Sebastian Nohn using the cool new Security-Scanner Chorizo. The only reported issue by Chorizo was the possibility of Users who could add plugins to the installation (usually only Administrators) to insert file references to other arbitrary PHP files that are then included. We feel this is a minor impact, because usually all administrators already would have full access to the PHP filebase and could include remote files with different means. Also note that users with safemode/open_basedir restrictions would not be affected by this.

Users with multi-users installations, giving plugin access to untrusted users are urged to upgrade to the latest release!

Serendipity 1.1-beta1 brings the long awaited new features to a first public release. The 1.1-alpha versions have been tested in the past quite well and are thought to run quite stable.

The 1.1 version brings those major new features (also see an earlier blog entry for details):

"New Serendipity Releases: 1.0.1 and 1.1-beta1" vollständig lesen

Two new plugins have been added to CVS by me:

serendipity_event_metadesc / "HTML META-Tags" allows you to define meta-description and meta-keywords per entry. Those will then be shown on the detailed entry page within the HTML head. As a nice bonus, if you leave the fields empty, the plugin tries to auto-detect keywords and description based on your text. For that it evaluates Bold/Strong tags in HTML to auto-guess your content.

serendipity_event_cronjob / "Cronjob scheduler" finally offers some cronjob functionality that people have sometimes requested. A lengthy explaination of this plugin follows. :-)

"Cronjob functionality" vollständig lesen