(Deutsche Übersetzung gibt es auf meinem privaten Blog)

A huge issue of Serendipity's Static Page-Plugin has always been its visual presentation of the editing screen:

Voices have been raised in the past to dust up this interface, which is why I worked on it at the beginning of this week, and committed my changes already to the official plugin repository (staticpage.zip).

Technically, the changes are quite minimalistic und quick to implement (2 hours of my life time). But the impact is huge:

Starting as of now, static pages can be created and edited using a customized smarty template, plus a static page can now have custom properties, similar to blog entries.

By default, a template file saved as backend_templates/default_staticpage_backend.tpl is shipped with the plugin, in which the distribution of the input fields is contained. There is a new smarty helper function ({staticpage_input}) that takes care of accessing the usual introspection methods for emitting the default list of data fields.

Own templates can override this template file by putting it in their template subdirectory, so that you can now have your own editing masks depending on the currently used template. This should be a blessing for magazine-like templates such as Mimbo or Hemmingway.

You can also store multiple template files inside this backend_templates directory, so that they all will be available from within the selection dropdown of the interface. For our veterans, the old list-style view is still available, of course.

An example for saving custom fields for static pages is also contained within the default template, but is commented out so that you must manually enable it. All custom fields need to be implemented through usual HTML form elements, and need to save their values inside a serendipity[plugin][custom][XXX][ fieldname. Once entered, the data will be automatically saved inside the serendipity_staticpage_custom database table, and will be available through {$staticpage_custom.XXX} when later being displayed in the frontend.

This way, you can easily add new custom fields for a staticpage which could decide, which CSS-Body-ID to use for rendering the page. Or you could specify, which sidebars you want to see when a certain staticpage is rendered. Or specify a custom header image for each staticpage. Sky's the limit!

This all vastly improves Serendipity's CMS-abilities and even more pushes it into a custom CMS-Framework, where you can manage any kind of customized content.

I hope you like it. :-)

I will be holding a talk about Serendipity's Multi-User and Shared-Install-Capabilites at this year's FrOscon in St. Augustin, Germany.

I'd be happy to meet any of the fellow Serendipity user's at the weekend of 23./24. August 2008. Also have a look at the other very interesting panels at this convention!

Nach beinahe einem Jahr harter Arbeit kann nun die umfassende Dokumentation zu Serendipity sowohl online wie auch beim netten Buchhändler um die Ecke bestellt werden:

Serendipity: Individuelle Weblogs
für Einsteiger und Profis
(ISBN 978-3-937514-54-3, Amazon).

Das Buch behandelt auf 750 Seiten sowohl die ersten Schritte mit Serendipity (inklusive Installation und Bedienungsanleitung) als auch die Benutzung von Plugins, Templates und einer sehr ausführlichen API-Dokumentation. Ein gutes Schlagwortregister hilft zudem beim täglichen Nachschlagen.

Ein Probekapitel sowie das vollständige Inhaltsverzeichnis kann unter dem oben angegebenen Link eingesehen werden.

Kurzum, ein Buch dass sich jeder deutschsprachige Serendipity-Enthusiast einmal ansehen sollte. Leser des Buches sind natürlich herzlich eingeladen, ihre Meinung oder konstruktive Kritik zu dem Buch im Serendipity-Forum, mir persönlich oder als Amazon-Rezension mitzuteilen.

Zur Feier der Veröffentlichung gibt es ein Gewinnspiel mit 5 Exemplaren des Buches, die uns vom Verlag Open Source Press zur Verfügung gestellt werden. Um ein solches Exemplar kostenlos zu ergattern, könnt ihr folgendes tun:

• Bloggen.
  
  

  Wenn ihr ein eigenes Blog habt, erstellt einfach einen Beitrag bei dem ihr bitte folgenden Link einbaut:

  <a href="http://blog.s9y.org/archives/195-Serendipity-Handbuch.html">
      Serendipity-Handbuch
  </a>

  Dadurch wird, falls in eurem Blog aktiviert, auch automatisch ein Trackback gesetzt. Falls das nicht klappt und ihr eure URL hier nicht sofort seht, hinterlasst bitte hier im Blog einen Kommentar mit eurer URL (ohne HTML-Code, hier ist nur BBCode zugelassen).

  
  
• Kreativ sein.
  
  

  In eurem Artikel könnt ihr die folgenden zwei Fragen beantworten. Wer kein Blog besitzt, kann die Fragen auch gerne hier als Kommentar beantworten:

  Aus welchem Grund sollte man sich das Buch eigentlich kaufen, wenn man es nicht gerade gewinnt?

  Was gefällt euch am besten an Serendipity?

  
  
• Gewinnen.
  
  

  Der Einsendeschluss ist am 18.06.2008, der Rechtsweg ist ausgeschlossen. 3 Gewinner werden zufällig ausgelost, 2 Gewinner werden anhand der subjektiv originellsten Antworten auf die Fragen entschieden. Die Gewinner werden hier im Blog angekündigt und gebeten, mir ihre Post-Adresse per E-Mail zuzusenden. Teilnahme per Pseudonym ist vollkommen okay, eure Postdaten werden ausschließlich an den Verlag zur Versendung der Gewinne weitergegeben und danach wieder gelöscht.
  

Viel Spaß und Erfolg,
Garvin Hicking

Serendipity 1.3.1 has been released. This is a bugfix and security related release, basically adressing a potential XSS issue within the Top Referrers plugin as well as hypothetical XSS issues with the installer.

This release also adresses some basic PostgreSQL8 related problems, because implicit type casts have been removed from this version, causing breakage with several Serendipity core features. The fix for this is only partial and will still happen in (less common) functions of Serendipity. There is no ultimate solution to this because implicit type casts are required for certain entryproperty operations. Maybe the PostgreSQL8 team will think about if implicit type casts are not also quite helpful. ;-)

The only new feature addition is the exposition of a new smarty {serendipity_getImageSize} function.

This upgrade is recommended for users that use the Top Referrers plugin and new installations of Serendipity. Many thanks to Hanno Böck, once again, for reporting (and fixing) the two XSS issues (CVE-2008-1385 and CVE-2008-1386)!

You can find the new release on the s9y.org download page. Upgrade by simply uploading the deflated archive files to your webspace.

Serendipity 1.3 has finally been released. The new release is mainly a feature consolidation release, but also contains XSS security fixes:

• The karma rating plugin has been upgraded to support nice, CSS-based rating graphics (see this post) and an overall rehaul on the its coding.
• Make the Spartacus plugin be able to use FTP upload, a workaround for SafeMode PHP restrictions. Also add a remote backend for plugin update checks.
• An importer for phpNuke and lifetype has been added.
• Support for pingbacks has been improved a lot. Trackbacks can now be blocked based on Sender IP checks.
• Add better CSS styling for some internal plugins and the embedding of images. Also made the Remote-RSS plugin to be capable of Smarty-Templating.
• Increased Smarty templating features for the {serendipity_fetchPrintEntries} function, to be able to check for entry properties.
• Add support for SQRelay.
• Minor CSS and graphic updates to the Bulletproof template.

The full list of 41 changes to this release are documented within the NEWS file.

Regarding Security, the bundled Smarty library has been updated to version 2.6.19 and adresses an issue in environments where the PHP security mode is required. Also, the new Serendipity release contains tighter backend XSS checks so that environments with untrusted authors can be more secure - many thanks to Hanno Böck for addressing this. Most importantly, an issue with XSS attacks within received trackbacks has been discovered by Peter Hüwe and was fixed.

The update is easy as usual, and recommended for Serendipity users - especially if you do not regularly moderate or check your incoming trackbacks.

Upgrade pointers can be found in the FAQ and is as easy as just to upload the new files.

Have fun!

The Freetag plugin has been updated to version 2.96 to fix a possible XSS to the tagcloud output.

XSS attacks can be used by visitors to display foreign HTML or JavaScript to visitors of the blog, if they visit specially crafted URLs. This attack basically allows for cookie stealing.

Users of the freetag plugin should upgrade to the latest version; upgrading via Spartacus-Plugin or Spartacus.s9y.org is just a matter of a few minutes. Thanks to Alex from Bitsploit.de for reporting this issue to us.

Serendipity 1.2 has been well received by the community, there were only very few minor bugreports. Those have been addressed in the Serendipity 1.2.1 maintenance release, available now.

The new Serendipity version also includes some new Bulletproof Theme options (user-customized stylesheets) and addresses some very minor browser quirks. If you're using Bulletproof, it is suggested you perform the update.

Also this new version addresses a security issue in the Remote RSS sidebar plugin (reported by Hanno Böck), which did not properly treat links coming from an RSS feed, which could lead to possible XSS attack vectors, if you are showing foreign feeds that might distribute malicious content to you. If you're using this plugin with an unsafe RSS feed, you should upgrade Serendipity.

Serendipity 1.2.1 features a new WPXRSS importer and can import the new WordPress 2.3 database structure All bug fixes have also been applied to our current 1.3-release tree. This release currently features some new Smarty-Templating convenience features, a remote spartacus version information interface, full pingback support, a LifeType blog importer and support of SQLRelay.

Upgrading Serendipity is very easy, have a look at the FAQ. The new version is available on the Serendipity download page.

Enjoy Serendipity and have a nice Christmas time!