Serendipity 1.5-beta1 released

Serendipity 1.5-beta1 is the first public beta release of the upcoming Serendipity 1.5 version. Some important things have changed under the hood, that we would like to ask our users to try out and report back to us.

This version mainly addresses login security by changing our method how passwords are stored to use salted SHA1 chacksums instead of plain MD5 checksums. This makes password retrieval (rainbow attacks) through the database virtually impossible. Another thing is improved PHP 5.3 compatibility. See more about this in a special blog posting some time ago.

For users of our Bundled WYSIWYG-Editor Xinha users now have the ability to easily customize the appearance of this panel through a "my_custom.js" file inside the template directory (a draft of such a file can be found as fallback default in the htmlarea/ subdirectory).

One cool new feature for developers is that now also templates can register themselves inside the plugin API hooks to execute specific things, that don't require installation of an event plugin.

Other news include:

  • new event API hooks
  • fixed PDF thumbnail generation
  • ability to auto-scroll on borders when Drag/Dropping plugins
  • UTC server time zone support
  • improvements in the Smarty functions to easier use Serendipity as a CMS for individual entry output.
  • quicksearch improvements for doing a wildcard-search when too few searchresults were found on a fixed searchterm
  • support for Typepad anti-spam server-checks, additionally to Akismet

The current release can be easily installed on any previous Serendipity installation. Just unpack, upload and visit your admin panel to perform possible database upgrades. Upon first login with an old password, Serendipity will store your old password in the new format - please be sure to make a backup of your Database prior to upgrading. Apart from that, the current beta release is already in production use on many blogs and there are no known problems/issues with this.

Trackbacks

Trackback-URL für diesen Eintrag

Kommentare

Ansicht der Kommentare: (Linear | Verschachtelt)

rollenc am um :

I have upgrade my blog http://www.rollenc.com to 1.5 beta-1, No bug found

Thanks for your good job.

rollenc am um :

One bug found:

Searching doesn't work any more.

URL:

http://www.rollenc.com/index.php?serendipity[action]=search&serendipity[searchTerm]=ubuntu&serendipity[searchButton]=Quicksearch

Error:

Unknown column 'orderkey' in 'order clause'

rollenc am um :

The search function did not work as expected. Notice for the administrator of this blog: This may happen because of missing index keys in your database. On MySQL systems your database user account needs to be privileged to execute this query:

CREATE FULLTEXT INDEX entryidx on serendipityentries (title,body,extended)

The specific error returned by the database was:

SELECT e.id, e.authorid, a.realname AS author, e.allowcomments, e.moderatecomments, a.email, e.timestamp, e.comments, e.title, e.body, e.extended, e.trackbacks, e.exflag, e.isdraft, e.last_modified, a.username AS loginname

                  FROM
                        serendipity_entries e
             LEFT JOIN  serendipity_authors a
                    ON  e.authorid = a.authorid
             LEFT JOIN  serendipity_entrycat ec
                    ON  e.id = ec.entryid
                         LEFT OUTER JOIN serendipity_entryproperties ep_access
                                          ON (e.id = ep_access.entryid AND ep_access.property = 'ep_access')

LEFT JOIN serendipityentryproperties epsticky ON (e.id = epsticky.entryid AND epsticky.property = 'epissticky') WHERE (MATCH(title,body,extended) AGAINST('ubuntu*' IN BOOLEAN MODE)) AND isdraft = 'false' AND timestamp

Garvin am um :

Thanks for that bugreport. Sadly this was caused by a last minute change.

Please download this file:

http://svn.berlios.de/viewcvs/checkout/serendipity/trunk/include/functions_entries.inc.php

and overwrite the include/functions_entries.inc.php file with that.

Bectrade am um :

Thanks for your quick reply and fix.

Hanno am um :

Why do you switch to sha1, knowing this is already under attack similar to md5? While it may take some time till sha1-attacks reach a state where this will matter for password storage, it'd be a safety measure to switch to sha256 with salt.

Garvin am um :

It's salted, so we could've even stuck to md5.

mike johnston am um :

Is there any eta on a release candidate or new beta?

Garvin am um :

Yes, as soon as our SMTP is up again, the release will be posted.

Kommentar schreiben

Die angegebene E-Mail-Adresse wird nicht dargestellt, sondern nur für eventuelle Benachrichtigungen verwendet.

Um maschinelle und automatische Übertragung von Spamkommentaren zu verhindern, bitte die Zeichenfolge im dargestellten Bild in der Eingabemaske eintragen. Nur wenn die Zeichenfolge richtig eingegeben wurde, kann der Kommentar angenommen werden. Bitte beachten Sie, dass Ihr Browser Cookies unterstützen muss, um dieses Verfahren anzuwenden.
CAPTCHA

BBCode-Formatierung erlaubt
Markdown-Formatierung erlaubt