-
Notifications
You must be signed in to change notification settings - Fork 89
/
Copy pathNEWS
1760 lines (1203 loc) · 66.6 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Version 2.6-alpha1 ()
------------------------------------------------------------------------
* Update bundled avatar plugin: Fix gravatar image fetching, remove
defunct options for identica and twitter avatars, and clean up
documentation,
* PHP 8.4 fix: Remove deprecated constant E_STRICT
* PHP 8 compatibility fixes for bundled XML/RPC.php
* Upgrade bundled jQuery to jQuery 3
* Fix option to set a different theme as fallback option by setting
Engine: $themename in a themes info.txt
* Let installer check for the intl extension, needed for the strftime
compatibility library used for PHP 8.1+
* Update Parser of textile plugin
* Update smarty from v4.3.5 to v5.4.3. This new major version has
breaking changes, worked around as much as possible in the s9y core
* Fix an often broken element of old themes by not adding the
integrated search box when 2k11 is used as the default theme
* Fix specific search terms (like a - at the end) causing an error
page when using MySQL/MariaDB (thanks to GuillaumeValadas)
* Swap order of entries in the dashboard, so that upcoming
entries are shown first
* Set more efficient defaults for (jpg) thumbnail generation
* Add ability to receive webmentions. They will be displayed as ping-
or trackbacks
* Fix admin dashboard link in menu not showing tool tips
(thanks to HQJaTu Jari Turkia)
* Fix token cleanup SQL statement in PostgreSQL environments
(thanks to HQJaTu Jari Turkia)
* Block access to .inc php files via .htaccess
* Make serendipity_sendMail() standard compliant by using CRLF
instead of LF to separate headers.
Version 2.5.0 (February 13th, 2024)
------------------------------------------------------------------------
* Restore compatibility with PHP 7.4 by setting that version as
composer platform (downgrades psr/simple-cache dependency)
* Remove bundled composer.phar (thanks to hboeck)
* Update composer dependencies (mostly for PHP 8.3 compatibility):
katzgrau/klogger (1.0.0 => 1.2.2)
pear/http_request2 (v2.5.1 => v2.6.0)
pear/net_dns2 (v1.5.3 => v1.5.4)
psr/log (1.0.0 => 1.1.4)
smarty/smarty (v4.3.2 => v4.3.5)
* Fix a PHP notice in User management ("isEditable") (garvinhicking)
* Fix a bug when the p parameter given was set to 0 (@hannob)
* Fix an incompatibility with MySQL 5.7 or later (@mariohommel)
Version 2.5-beta1 (September 28th, 2023)
------------------------------------------------------------------------
* Update Net/DNS2 to v1.5.3
This dependency was also added to composer. A wrapper was added for
backwards compatibility with the old include path.
* Fix Onyx/RSS dependency under PHP >= 8.0
* Address several warnings when using PHP 8.2
* Update HTTP_Request2 to current version v2.5.1
This dependency was also added to composer. A wrapper was added for
backwards compatibility with the old include path.
Subsequently, some files form bundled_libs/HTTP were dropped that
were not part of Request2.
* Update smarty to current version v4.3.2.
Also enables a warning suppressor, which should avoid issues with
old smarty templates when using PHP 8.0 or newer.
* Avoid warning under PHP 8.2 when using an SQLite database
* Improved and extended russian translation files, thanks to Vadim
Rakhmatullin
* [!] Bugfix: Fixes showing wrong values for Usergroup permission
configuration. All checkboxes where enabled instead of
only the ones really set, thus saving any usergroup with
these checkboxes would changer permissions as indicated
by the checked values. Please ensure after upgrading that
any possible custom usergroup configurations have the
wanted permission settings. If you have never saved
a permission group setting, you will not be impacted.
(garvinhicking)
* Adds new time formats to 2k11 frontend (using %H:%M for date output)
* Fix: Several uninitialized variable error notices in upgrader,
category management, maintenance (garvinhicking)
* Fix: 2k11 fonts now downloaded locally and included with template.
* Fix: Utilizes missing variables in Smarty admin upgrader
(garvinhicking)
Version 2.4.0 (November 20th, 2022)
------------------------------------------------------------------------
* Fix: Avoid bad number of arguments to sprintf and fix logic error
in spamblock plugin.
* Improve w3c compatibility be encode square brackets of comment
mode links (thanks @hannob)
* Fix: Previewing comments warning threw a warning on PHP 8, when
debug mode on (thanks @hannob)
* Fix: Editor autosave cached was not deleted when saving entry
* Fix: Editor autosave was not on by default, despite the setting
being active by default
* Fix: admin/entries.tpl: fix undefined variable iso2br
* Fix: The calendar plugin threw a warning about $cond['join'] not
existing in some setups
* Fix: Avoid one more situation where responsive image upscaled
a small thumbnail
* Bugfix: Entryproperites plugin no longer insert empty records
for multiple authors (garvinhicking)
* Improve permalink generation performance and enable more unicode
replacements (thanks to mbirth!)
Version 2.4-beta1 (September 12th, 2021)
------------------------------------------------------------------------
* Hide more PHP warnings in production mode, to ease the migration
to PHP 8
* Fix: Deleting a user was not possible
* New images added via the ML will set loading="lazy", improving
site performance for visitors (only if height and width known)
* Remove multitude of wysiwyg toolbars
* PHP 8 compatibility for serendipity core
* Fix: Using the ML filters in the selection popup after uploading
no longer removes option to insert image into article
* Drop never fully integrated laminas-db powered database backend
* Drop legacy mysql database backend (long ago replaced by mysqli)
* Update Cache/Lite to 1.8.3 for better PHP 7.4 compat
* Change backend_image_add hook to always contain same structure
* Split date and time input in editor into two input fields
* Improve performance of the media library by caching the file list
Version 2.4-alpha2 ()
------------------------------------------------------------------------
* Adds 'image_id' to event 'backend_image_add' in addData array
* Move MySQL databases from MyIsam and UTF8 to InnoDB and utf8mb4,
enabling full unicode input.
* added type 'media' to configuration types,
this shows an input text with the button for the media library,
unified the CSS between this item and the plugin item,
hide the preview when no image is selected
* renamed 'multiDelete' in media selection to 'multicheck'
as suggested in the comments
* check for empty file input in media_upload
* stripped the multilingual tags from the preview iframe
* totally resorted the language files, added a new 'langsorter.php'
script which automatically sorts and completes the languages,
strings which doesn't seem in use are now in the 'orphaned' section
* Make it possible for plugins to let the core skip the check
whether trackbacks are already sent, with
$serendipity['skip_trackback_check']
* Add the original image to the response images srcset when
the original image is small, to avoid upscaling
Version 2.4-alpha1 ()
------------------------------------------------------------------------
* template/bootstrap4/sidebar.tpl: fix usage of wrong template
variable which prevented the sidebar from being emitted.
* templates/2k11/admin/comments.tpl: Stay on the same page after
approving a comment; truncate comments to the same length (200)
as given by /include/admin/comments.php
* Merge s9y and plugin update notifications in dashboard.
* Fix: Simplify count_plugin_upgrades() in event_spartacus.
* Fix: Modified sql statement used for htaccess blocking to work in
MySQL 5.7.
Thanks to @fasterit!
* Switch new installations with MySQL >= 5.6.4 or MariaDB >= 10.0.5
to the InooDB stoprage engine and utf8mb4 charset. This enables
proper unicode support plus fulltext indexes, something older
mysql databases were not capable of
* Plugin nl2br: Include figure and figcaption tags (2.21.3)
Thanks to @stephanbrunker!
* Plugin spamblock: Add timeout protection against spambots (1.89).
Thanks to @stephanbrunker!
* #657: functions.config.inc.php:
eventhooks backend_login and backend_fail in function
serendipity_login and serendipity_authenticate_author
now only called with external=true (secondary login)
* Fix: added eventhook multilingual_strip_langs in
categories and permalinks for tagged translation
Thanks to @stephanbrunker!
* Change language names to native languages.
Thanks to @stephanbrunker!
* #650: Multiple fixes and enhancements, mainly to language settings.
Thanks to @stephanbrunker!
* admin/personal.inc.php: removed setting of $_SESSION:
serendipity_lang (already set in serendipity_config.inc.php
for all scenarios)
* admin/plugins.inc.php: fix some lookups from $_GET to
$serendipity['GET']
* compat.inc.php: function detectLanguage returns now NULL if
the detection failed, also doesn't change $serendipity['autolang']
anymore which remains 'en' as general fallback.
* functions.config.inc.php:
* major rework of the functions serendipity_getSessionLanguage
and serendipity_getPostAuthSessionLanguage. Those two functions
should now process the user input via GET and POST, store it
into SESSION and COOKIE, and if no such input is given,
fallback to browser language negotiation and default language.
More details in the comments to that functions.
$serendipity['detected_lang'] is the language found from user
input or browser negotiation.
* function serendipity_load_configuration sets the language
back to 'autolang' (which is 'en') if the language loaded does
not exist. Also sets the value $serendipity['default_lang']
to the default language of the blog.
* removed the Cookie 'userDefLang' which is no longer needed
* functions.entries.php:
* function serendipity_printArchives() hooks now
into hook_event::'frontend_fetchentries' to get multilingual
data, also doesn't show months and years with zero entries.
* function fetchEntryCategories, fetchEntryData and
fetchCategories strips now data of multilingual tags
* functions.routing.inc.php: fix some lookups from $_GET to
$serendipity['GET']
* plugin_api.inc.php: added function find_plugin_id which returns
an array of the ids of the installed instances of the given plugin
this is used for checking the configuration of that plugin in other
plugins
* created a new event hook 'multilingual_strip_langs' to strip
tagged translation of elements outside the sidebar (mostly
categories in entry display).
* Add plugin update notifications to the plugin update button and
to the dashboard.
Version 2.3.5 (April 25th, 2020)
------------------------------------------------------------------------
* Fix: CSS: Restrict block display of summary to trackbacks. (#703)
* Fix: Don't strip HTML from comments body in serendipity_plugin_comments
before serendipity_event_unstrip_tags can convert the HTML tags
(being called via frontend_display hook). (#702)
* Fix: [CKE] Don't remove <details> and <summary> elements from
WYSIWYG editor.
* Fix: Don't delete extend properties from the entryproperties
plugin when publishing from dashboard (or sending
delayed trackbacks). (#695)
* Fix: SQL error in serendipity_plugin_history present since we
"don't allow requesting an archive page that doesn't exist"
(2.3.3). (#694)
* Fix: Entry title in backend list of entries was double escaped.
* Fix: Don't drop upgraded_version from local plugin cache.
* Fix: Regular expression in functions_routing.inc.php
* Fix: Truncate extension of media items to 5 chars (which ist the
max length of the corresponding database field). (#609)
Thanks to @mmitch!
Version 2.3.4 (March 25th, 2020)
------------------------------------------------------------------------
* Security: Fix RCE on Windows.
Thanks to Junyu Zhang <rgdz.eye@gmail.com>!
* Fix: ML: Fixed filename generation when renaming and added
some error messages on rename failures.
* Display source of plugins (Spartacus, bundled or locally installed).
Version 2.3.3 (March 22nd, 2020)
------------------------------------------------------------------------
* #651: When using checkboxes to insert multiple media files, if only
one asset has been selected, do not use the gallery mode,
but instead single-asset view. Also improves to click the title
of an asset to select its checkbox, and hides the 'Insert all'
button when no assets are selected. (garvinhicking)
* Use the video tag for videos in the Medialibrary, also when
inserting such a video into an entry
* media_choose.tpl: Fixes bad usage of
{serendipity_hookPlugin eventData=...} to {serendipity_hookPlugin eventData=}
and allow plugins to skip HTML block insertion to use their own
markup
* Updates mailer event plugin to support force sending mails on
published blog entries and ability to prepend a mail body.
Also fixes missing "keep strip tags" configuration option
* Fix serendipity_killPath().
Thanks to @surrim!
* Don't allow requesting an archive page that doesn't exist.
Thanks to @lotharsm!
* Fix: Set action to empty in functions_routing.php when serving JS;
otherwise the default page has been generated at every call.
* Fix: Add valid HTTP referrer when trying to delete a
trackback from the frontend.
* Fix: Wordwrap at word boundaries only in bundled plugin
serendipity_plugin_comments.
* Fix: Force empty limit to "" in serendipity_fetchEntries().
* Fix: Escape version string in update notifier to avoid XSS.
* Fix: Prevent renaming a ML object into an existing file,
resulting in deletion of both from disk and database.
* Fix: Items in Medialibrary that are not images now get
the correct link
* Fix: Remember where you stored images last (#652)
* Fix: [bbcode] Get roman numerals working in bbcode plugin.
Thanks to Fabien Chabreuil!
* Fix: Force positive limits for number of entries shown on
title page and in RSS feed. s9y doesn't work with 0 or
negative numbers, so force our default (15) in this case,
(#646)
Version 2.3.2 (October 16th, 2019)
------------------------------------------------------------------------
* Fix: Auto-generated mails submitted to qmail as MTA will get
mangled if encoded to quoted-printable due to qmail
changing "\r\n" linebreaks to "\r\r\n". Submit just "\n"
as linebreaks; other MTAs should cope with that.
* fix: Rotating an image did not rotate all responsive thumbnails
* fix: The wysiwyg editor stripped the figcaption element used
for image captions
* Only populate $serendipity['GET'], $serendipity['POST'] and
$serendipity['COOKIE'] with references to $_GET['serendipity'],
$_POST['serendipity'], $_COOKIE['serendipity'] if they are
transmitted as an array. Else, an empty array is used.
Prevents PHP warnings (Issue 642) thanks to @hannob
* Escape category images to avoid backend XSS.
Thanks to @hannob!
* Only allows .txt and .log files for spamblock logging.
Thanks to Gary O'Leary-Steele (CVE TBD)
* Fixes not properly displaying plugin save errors (validation)
* Fix autologin when using MySQL (thanks @Eike Rathke,
https://github.com/s9y/Serendipity/pull/632)
Version 2.3.1 (August 21st, 2019)
------------------------------------------------------------------------
* Enhance i18n of ML multimove.
* Fix ML multidelete.
* Change footer_info and prev/next links for archive pages for
"stable archives" sort order.
* Fix pagination in core for "stable archives" sort order and fix
prev/next links for pagination in timeline and bulletproof themes
when "stable archives" are active.
* Add Spartacus links ("more info") to plugin lists.
* Fix/Change: Wording of plugin display ("version") and PHP/smarty
variable names.
* Spartacus: Fix caching of plugin lists in getCachedPlugins().
Version 2.3.0 (August 10th, 2019)
------------------------------------------------------------------------
* Fix: Don't show "Array" under Update notification if autoupdate
plugin is not installed
* Fix PHP 7.4 issue in PEAR HTTP_Request2
Version 2.3-rc1 (August 3rd, 2019)
------------------------------------------------------------------------
* spamblock: Minor code change for PHP 7.4 compatibility (thanks
@hannob!)
* Fix: Make $entry available for templates.
* bulletproof theme: Fix preview iframe.
Version 2.3-beta1 (April 26th 2019)
------------------------------------------------------------------------
* Activate stablearchive option by default for new blogs
* Fix: Smarty reference and PHP7.2 compatibility issue in timeline theme.
* Fix: PHP7.2 compatibility issue in clean-blog theme.
* Security: Fix XSS in Editor Preview by interpreted EXIF tags
(thanks @hannob!)
* Security: Fix XSS in Media Library by interpreted EXIF tags
(thanks @hannob!)
* Allow to receive multiple trackbacks and pingbacks
(thanks @mitch!)
* Fallback for $lang variable when configuration failed to load,
which evades some unuseful error messages (thanks @HQJaTu!)
* Improve nl2br p mode to works with tags like <strike>
(thanks @stephanbrunker)
* Minimal PHP version is now PHP 7.0
* Update voku/simple-cache to 4.0.1, fixes opcache warning on
hosted environments (thanks @voku and @hannob)
* Fix bug in nl2br's p mode that ate pre elements (thanks
@stephanbrunker!)
* Add internal cache invalidation when comment is added
* Move cache into functions.inc.php, resulting in this API:
* serendipity_setupCache() (used internally)
* serendipity_cleanCache()
* serendipity_cacheItem($key, $item, $ttl = 3600)
* serendipity_getCacheItem($key)
* Drop deprecated serendipity_purgeEntry function
* Default settings: Disable entryproperties cache, enable internal
cache
* Update Smarty to 3.1.33
* Use voku/simple-cache for internal cache as bundled lib, which
will allow to cache with memcached and redis instead of just
on the filesystem
* Set responsiveimages as default plugin
* Add rewrite to absolute url for srcsets to the feed
generation
* Fix bug with not properly adding trailing "/" when managing
directories, so that saving different permissions would not
be properly applied
* Re-add missing plugin API event hook backend_media_rename
from prior pmigration in Serendipity 2.2 (#509)
* Re-add missing ACL adjustments after renaming a directory
(#509)
* Fix typo that switched read permissions with write permissions
when editing a category ACL
* Fix mispositioned button in media db directory list.
* Use figure/figcaption markup for media db images w/ captions.
* Add localization to maintenance mode, add German translation.
Version 2.2.1-alpha1 (September 20th, 2018)
------------------------------------------------------------------------
* PHP 7.2 support: New autologin token approach, various code
changes
* Add function to add multiple images to an enty at once,
creating a gallery
* Add maintenance mode, allowing access to the blog only for
currently logged in user. This is meant to be activated when
upgrading the blog.
* [Security] Improved password hashing by moving to bcrypt
* Fix bug that could lead to noindex being activated by accident
* Update Smarty to 3.1.32
* Update bootstrap 4 design to new bootstrap version
* Add option to disable google fonts in several designs
* Make it easier to drag plugins to other columns
* Improve and fix the p-mode of the nl2br plugin (Stephan Brunker)
* Support SVGs in Media Library
* Support automatic generation of responsive image thumbnails, and
using them when inserting images to entries
* Rework messy code updating the database and entries when
renaming or moving items in the media library
* Improve internal cache to work with more plugins, by reacting
to more variables changing the output
* Add backend_view_entry hook, that is executed for every entry
in the backend entry list
* Updated entryproperties plugin to support a custom property for
multiple ownership of an article
* Emit and detect rel=trackback element to find trackback
url, to have a reliable alternative to RDF used so far
* Merge and rename the two configuration variables to limit
displayed entries in the dashboard (#493):
$serendipity['dashboardLimit'] and
$serendipity['dashboardDraftLimit'] are now merged into
$serendipity['dashboardEntriesLimit'] - please change your
serendipity_config_local.inc.php accordingly if you used
the former variables.
The dashboard will now show as many future entries as
configured in "dashboardEntriesLimit"; if there are less
future entries, it will display drafts until
"dashboardEntriesLimit" is reached.
* Add a "delete" button to the backend entry form (#491, #494)
* Change Spartacus default mirror to github (#489)
Version 2.1.6 (August 9th, 2019)
------------------------------------------------------------------------
* Prevent error in upgrader when $sqlfiles is NULL.
* Fix preview iframe in bulletproof, thx pixel32
Version 2.1.5 (May 1st, 2019)
------------------------------------------------------------------------
* Security: Fix XSS in Editor Preview by interpreted EXIF tags
(thanks to @hannob!)
* Security: Fix XSS in Media Library by interpreted EXIF tags
(thanks to @hannob!)
* Fix mispositioned button in media db directory list.
* Change default for comment subscription to full text.
* Display errors if comment coulnd't be deleted.
* Make it easier to drag plugins to other column.
* Add fallback for broken JS in configuration screens.
Version 2.1.4 (September 20th, 2018)
------------------------------------------------------------------------
* Security: Fix XSS for pagination, when multi-category selection
is used. Thanks to Brian Carpenter (geeknik) and Hanno Boeck!
* Minor code fixes (proper PHP escaping for 'orderkey' SQL statement
* Skeleton, Timeline and Clean Blog templates: Add theme option to
disable google webfonts
* Link to https s9y.org pages
Version 2.1.3 (August 16th, 2018)
------------------------------------------------------------------------
* Security: Make sure that the admins configuration for RSS
and blog entry limit is parsed as integer for SQL queries.
Thanks to @oreamnos and Hanno Boeck for reporting!
* Security: Prevent XSS possibility in "edit entries" panel.
Thanks to @oreamnos and Hanno Boeck for reporting!
* Security: Disallow sending comment notifications and mails to more than one
mail address. This could be used to approving opt-ins of requests
that did not belong to the same email that was approved.
Thanks to Hanno Boeck for reporting!
* Security: Remove exit.php open redirect, when not using the trackexits-
plugin configured with Serendipity exit tracking.
Thanks to Julio Cesar (from infosec.com.br) and Hanno Boeck for reporting!
* Fix SQL compatibility for creating of table "serendipity_groupconfig"
* Added new "legal" plugin property bag attribute to indicate
impact for the GDPR / DSGVO, used in conjunction with the
serendipity_event_gdpr_dsgvo plugin
* Disabled subToMe service by default to prevent issues with GDPR
Version 2.1.2 (March 25, 2018)
------------------------------------------------------------------------
* Exclude defunct netmirror spartacus repository
* Adapt .htacess default rules to exclude rewriting documentation
(Issue #521)
* Fix a regression in Net/DNSBL regarding
serendipity_event_spamblock_rbl and
serendipity_event_spamblock_surbl by adding Net/DNS2 1.4.3 as a
bundled library to core and patching Net/DNSBL (#497)
* Fixed broken Akismet API calls (#507)
* Fixed comment preview for logged-in users (#503)
* Fixed message display after comment editing/deleting (#526)
* Don't show empty plugin groups in list (#496) and fix broken
plugin display in Firefox.
* Add template path as first entry to template_dirs (#524)
Version 2.1.1 (April 9th, 2017)
------------------------------------------------------------------------
* Fixed a regression issue where configuration variables could not
properly be stored when they were set to false.
Version 2.1.0 (April 8th, 2017)
------------------------------------------------------------------------
* Some more PHP7 error catching
* Fix missing token when updating plugin
* Fix missing variable name in regular expression match, Issue #442
Version 2.1-rc1 (January 26th, 2017)
------------------------------------------------------------------------
* Fix issue #437 - Remove the hardcoded media filter only_filename
input field and re-allow the $order_fields['i.name'].
* Issue #430, fix proper name of new feedShowMail configuration var
in rss.php for showing mail addresses
* [Security] Enhance CSRF-Tokens for toggling/moderating comments
* Allow to set a default category for authors (personal preferences)
* Changed how the hidden password element is displayed to prevent
browsers from autofilling it into the entryproperties plugin
* [Security] Enhanced media upload check to also check redirects
for local files, thanks to Xu Yue (again!)
* [Security] Prevent XSS in adding category and directory names,
thanks to Edric Teo @smarterbitbybit.
* [Security] For multi-deletion of entries, secure the HTTP referrer
output to prevent XSS (Issue #435)
* [Security] Reject %0D/%0A in exit tracking and other places
(Issue #434)
* [Security] Redirection of comment.php now checks the referrer
and only allows the blog's host (thanks to Lee Sheldon Victor)
* [Security] Fix missing integer casting for inserting new categories
(thanks to cdxy)
* Disabled Selenium test files unless enabled
Version 2.1-beta2 (September 26th, 2016)
------------------------------------------------------------------------
* Improved backend accessibility by hiding iconfont icons for
screenreaders (using aria-hidden).
* Replaced the JS-based equal height solution in the backend with
a modern CSS-only solution based on Flexbox for browsers that
support it. (Browsers that do not support Flexbox or that only
support outdated versions of Flexbox get the old JS solution as
a fallback.)
* [Security] Prevent moving files by using their directory name.
[Security] Possible SQL injection for entry category assignment
[Security] Possible SQL injection for removing&adding a plugin
All issues require a valid backend login.
Thanks to Hendrik Buchwald for finding this via their
RIPS source code analyzer (www.ripstech.com)
* [Security] Add new configuration option to enable fetching
local files for the media uploader. By default this is now
disabled to prevent Server Side Request Forgery (SSRF).
Thanks to Xu Yue for pointing this out!
* Added new API wrapper serendipity_request_url() to request URLs.
Currently uses HTTP_Request2, might change to curl or others in
the future, but irrelevant to plugins using this function.
* Removed outdated themes blue, carl_contest, kubrick and wp. They
live on Spartacus now.
* Added new theme "Skeleton". Skeleton is a responsive, mobile first
HTML5/CSS3 theme built on the Skeleton framework.
* Fix comaptibility bug preventing Internet Explorer (+Edge) to
clear the entry editor cache when saving an entry
* Remove backend js from preview_iframe.tpls, makeing entry previews
faster, more accurate and more reliable
* Introduce new plugin api function
$plugin->getFile($filename, $key = 'serendipityPath'). Other
than parseTemplate($filename) it will not parse the found file
via smarty, and it allows directories inside $filename. Intended
use is finding files like images via the fallback chain, giving
themes the chance to serve custom versions instead.
* Give theme authors the option to force using a template file from
the frontend, {getFile file=... frontend=true}
* Fix entry preview by making sure it always uses the correct
template files to generate preview, replacing internal magic
with direct parameters
* Rewrite and simplification of the file fallback chain in
serendipity_getTemplateFile. Removes templates/default/ from
from the chain, as it was replaced by templates/2k11/
Version 2.1-beta1 (June 8th, 2016)
------------------------------------------------------------------------
* Added new theme "Timeline". Timeline is a fully responsive,
mobile first HTML5/CSS3 theme built on the Bootstrap
framework.
* Add new config variable $serendipity['cors'] to allow to set
Access-Control-Allow-Origin: * headers for sensible places
(RSS feeds), to i.e. allow JavaScript's XMLHTTPRequest to read
those feeds.
* Introduce a section with modern recommended themes in the
themes backend menu. Themes can be included there by setting
Recommended: Yes in their info.txt
* Merge sidebar and event upgrade pages in one single page
button
* Add colorpicker as possible plugin option item type, set
type to 'color' to use it
* Comments made via the backend on own articles don't trigger
the comment notification (thanks to xoxys)
* Fix missing perm checks for "standard user" in MediaLibrary
* Fix show Dashboard entries by authors entries
* Fix show Dashboard comments by authors entries (#385)
* Use CDATA encoded body for ATOM feed
* Fix: Ajax upload to ML now also works for non-images
* Added new theme "Clean-Blog". Clean Blog is a fully responsive,
mobile first HTML5/CSS3 theme built on the Bootstrap
framework.
* Fixed checkbox entryproperties re-sets (#376)
* Fixed media item delete handler (#371)
* Rewrote Routing code for index.php to be outsourced into
include/functions_routing
* Removed broken feature for viewing blog entries by multiple
authors, dropped code from core and plugin_authors.
* Optimize scaleImage returns
* Fixed media item rename handler (#370)
* Fixed and enhanced multiple media redirects and path / name
related issues, as well as some better umlaut conversions
* Allow strict media directory selection by toggle filter
* Allow a better auto char conversion to media upload item names
* Added Start / End pagination to MediaLibrary and entries list
* Added new bulk image move ability to MediaLibrary. This fixes
several issues with rename AND remove and allows to automatically
check and set MediaLibrary item entry paths on MOVE.
Staticpages from v.4.52 are modified to support this too.
Now supports Quickblog (imageselectorplus) entry path repairs.
* Fix MediaLibrary objects not pass through into entryproperties
CustomFields
* Fix fatal error atom 1.0 issue; References #362
* Fix eraseEntryEditorCache script in preview_iframe updertHooks
IFRAME
* Fix the Serendipity template and file fallback chaining to work
more precise
* Disable CKEDITOR Source protection for Smarty and WP-Smarty like
markup, since now being usable w/o setting ACF OFF
* Set Serendipity var use_autosave in backend only
* Fix entries.inc fetching iframe event returning 1, when true and
added a new language constant change message for multilanguage
entry changes, instead of the wrongly used save message
* Fix importers to use the new mysqli API extension with PHP 5+
* WIP: Added an internal cache to speedup s9y's site generation. Can
be activated by setting use_internal_cache to true in
serendipity_config.inc.php. Test feedback needed.
* Added <IfModule mod_rewrite.c> checks to .htaccess for URL
rewriting
* Add support for cronjob plugin to spartacus, to notify blog owner
about possible updates (via e-mail)
* Added link to preview spartacus themes on blog.s9y.org
* Added two configuration variables that can be set in
serendipity_config_local.inc.php to influence the dashboard entry
limit:
- $serendipity['dashboardLimit']: How many future entries to fetch
(default: 5)
- $serendipity['dashboardDraftLimit']: How many entries in total
shall be displayed in the dashboard section (default: 5)
- $serendipity['dashboardCommentsLimit']: How many comments
(default: 5)
(Draft entries will only be fetched if there are less future
entries than the total entry limit)
* Fix: the syndication plugin links subtome correctly to the atom
feed when he is activated with the rss feed
* Issue #238: When creating/renaming media directories, replace
special characters with the same i18n rules like Permalinks are
created, renaming umlauts etc.
* Add "update all"-button to plugin update page
* Issue #234: Granular options to force backend popups for certain
areas
* Introduce serendipity['ajax'] to detect incoming ajax requests
and react accordingly in core and plugins
* Issue #248: Add $serendipity['forceBase64']=true option (can be
set in serendipity_config_local.inc.php) to make Serendipity
*not* use 8bit Imap functions for sending mail, for MTAs that
behave erradically otherwise.
* Issue #257: Make sure to check entered admin-user password
* Issue #264: Drop $authorid for permissions based on images
instead of directories, it was not used anymore
* Some small enhancements to the error reporting
Version 2.0.3 (January 4th, 2016)
------------------------------------------------------------------------
* Fix XSS in backend comment editing form for logged-in authors,
thanks to Onur Yilmaz and Robert Abela from Netsparker.com
* Fix some backend entry form related event messages
Version 2.0.2 (July 24th, 2015)
------------------------------------------------------------------------
* Fix security issues reported by Tim Coen of Curesec.com:
- Forbid uploading files with PHP contents and possible
PHP execution by authenticated users (critical if
you have possible untrustworthy authors)
- Add proper escaping for comment approval tokens to prevent
SQL injection (authenticated authors only)
- Add proper escaping of comment's author names in the
comment reply form to prevent XSS (2k11 template, javascript
based)
* Minor layout fixes for media DB media filters
* Backported some Importer db bugfixes
* CKEDITOR bugfix releases to 4.4.8 - please read the changelog.
Includes widget, lineutils, fakeobjects Plugins and S9y added
cheatsheet and procurator Plugins.
Changed config.autoParagraph set to false, to prevent wrapping
p tags around extraAllowedContent tags.
* Smarty bugfix upgrades to 3.1.27 - please read the changelog.
Compilation time was vastly improved.
New Features in NEW_FEATURES.txt.
* It is now possible to switch to a theme's admin theme if it has
been selected as a frontend theme first
* Syndication Plugin Issue #285:
- Add "none" as possible value for the xml-icon in the
syndication plugin, to enable plain links
- Reset subtome full icon path to support
serendipity_getTemplateFile()
- Link creation fixes for Bulletproof coloured style (eg blue)
* Fix auto include of a User theme /admin/user.css backend file.
PLEASE NOTE:
2.0.1 brought in an automated include of a themes "user.css"
file. If you don't want to use such file any more (and you have
one), you will have to delete or rename it by hand!
Also please note, that user stylesheet selectors like
.selector {
background-image: url(img/example.jpg);
}
now need to use the {TEMPLATE_PATH} like
.selector {
background-image: url({TEMPLATE_PATH}img/example.jpg);
}
Content of a user.css will always be put LAST into the combined
CSS, this means it will override any possible plugin output.
If a user.css file does not exist in your own template directory,
but inside the default 2k11 template directory, this will always
be used (this behaviour is called "default fallback chain").
* Use https URLs for Atom feed, if called through HTTPS (hboeck)
* Restore the "Show toolbar within media selector popup?" option,
it was ignored before.
* Fix Issue #321, negative offset for LIMIT SQL statements when
using stable archive sorting and plugins like history.