Serendipity 2.1 - First Release Candidate

26 01 2017

We are happy to announce the availibility of the first (and hopefully last) Release Candidate for Serendipity 2.1.

We feel comfortable with suggesting you to try out this release in productive environments (of course always make a backup of your database and files first).

Serendipity 2.1 focusses on:

  • Rewrites in some older legacy parts of the core (URL routing, template fallback chain, experimental internal caching) as well as PHP7 compatibility.
  • New bundled responsive themes "Timeline" and "Clean-Blog"
  • Improved usability of plugin upgrades by combining sidebar and event plugins and upgrading multiple plugins at once
  • Permission checks for the dashboard output and comments
  • Usability improvements to the media library, bulk moving support
  • New API wrapper for URL downloads that plugins can use (serendipity_request_url)
  • New Theme "Skeleton" (responsive, mobile first)
  • Improved preview iframe handling
  • Changes (simplifications) in template file routing for backend/frontend views, new smarty {getFile} function for theme authors
  • (new for rc1) Ability to set a default posting category for an author
  • (new for rc1) Improved security checks against CSRF attacks (comment moderation, comment toggling
  • (new for rc1) Improved security for referrer redirection
  • (new for rc1) Improved security for local file hotlinking
  • (new for rc1) Fixed sorting media database by filename

Many thanks at this point (in no specific order) for Lee Sheldon Victor, cdxy, Edric Teo and Xu Yue for helping a lot in improving on security aspects of Serendipity.

You can download the release file and unzip it to your installation as usual on our Github release tracker.


Serendipity 2.0.5 and 2.1-beta3 released

28 11 2016

Serendipity 2.0.5 is a maintenance security release which addresses these issues:

  • [Security] Improve preventing fetching local files, thanks to Xu Yue.
  • [Security] Prevent XSS in adding category and directory names, thanks to Edric Teo @smarterbitbybit, CVE-2016-9681.

Alongside a new Serendipity 2.1-beta3 version has been released, with the same fixes plus some more progress on the road to the 2.1 release.

Simply upgrade by unpacking and uploading the release file and confirming our web-based upgrader.


New Serendipity homepage online

26 09 2016

In the past few months we have also worked a lot on rebuilding the presentation page of www.s9y.org. We have moved our infrastructure for this over to Github Pages in the s9y.github.io repository, and reworked a lot of our documentation to streamline and better structurize.

Additionally, this documentation repository is now open for any kind of pull requests and contributions, and will be easier to maintain. Our devs onli and yellowled worked hard on bringing the visual side of things up to par, as well as MarioH for moving a lot of text files, and we hope you like our efforts!


Serendipity 2.0.4 and 2.1-beta2 released

26 09 2016

Serendipity 2.0.4 is a maintenance security release which addresses these issues:

  • [Security] Prevent moving files by using their directory name.
    [Security] Possible SQL injection for entry category assignment
    [Security] Possible SQL injection for removing&adding a plugin

    All issues require a valid backend login.
    Thanks to Hendrik Buchwald for finding this via their
    RIPS source code analyzer (www.ripstech.com)
  • [Security] Add new configuration option to enable fetching local files for the media uploader. By default this is now disabled to prevent Server Side Request Forgery (SSRF). Thanks to Xu Yue for pointing this out!

Alongside a new Serendipity 2.1-beta2 version has been released, with the same fixes plus some more progress on the road to the 2.1 release. Features like these have been added:

  • New API wrapper for URL downloads that plugins can use (serendipity_request_url)
  • Added new Theme "Skeleton" (responsive, mobile first)
  • Improved preview iframe handling
  • Changes (simplifications) in template file routing for backend/frontend views, new smarty {getFile} function for theme authors

Simply upgrade by unpacking and uploading the release file and confirming our web-based upgrader.


Serendipity 2.1-beta1 released

08 06 2016

The first beta of Serendpity 2.1 has been released and we are happy for people to test our latest changes.

The main focus of Serendipity 2.1 are rewrites in some older legacy parts of the core (URL routing, template fallback chain, experimental internal caching) as well as PHP7 compatibility.

Other notable changes include:

  • New bundled responsive themes "Timeline" (Demo) and "Clean-Blog" (Demo)
  • Improved usability of plugin upgrades by combining sidebar and event plugins and upgrading multiple plugins at once
  • Permission checks for the dashboard output and comments
  • Usability improvements to the media library, bulk moving support
  • The full list of changes can be found as usual in our docs/NEWS file.

We are happy to hear your feedback about this beta release on our forums!

Thanks on behalf of the team. And also thanks for our hard-working developers who contributed code to this Serendipity beta version, especially aristophian, onli, yellowled (in alphabetical order *g*),

Garvin


A Serendipitous Birthday Present

29 03 2016

On March 29th in 2003, Jannis Hermanns officially renamed his jBlog to Serendipity. Now, 13 years later, we are still actively working on improving what was meant to be a simple and expansive blogging infrastructure.

In April, we will have our second user/developer meetup in Germany (Essen) and hopefully decide on a couple of remaining issues for releasing version 2.1 of Serendipity and launching the currently "work in progress" version of docs.s9y.org. This new page will better present Serendipity and offer new and more streamlined documentation.

A few years ago, a Serendipity Book was published in german language by Garvin Hicking, which was later open-sourced and put into our documentation repository. Out of this, our fellow core developer Ian (Timbalu) has put an awesome amount of time and effort into updating this german documentation for recent Serendipity versions.

You can find this on docs.s9y.org/Book/ and you will see that it is still marked as "Draft" - which means, we would appreciate your feedback and input. We do hope to get this book translated to english at some point, any help on this is appreciated.

On behalf of the team, many thanks to Ian (Timbalu) and we're excited to keep making Serendipity be a great blogging tool for your needs.