Serendipity Forums

The Serendipity team is happy to announce the immediate availability of a maintaineance release of Serendipity 0.7.1.

This release only fixes three little issues:

* The captcha plugin may on certain system not create enough "randomness" to the string displayed in the graphic

* Fixed a possible cross site scripting vulnerability. Thanks to Stefan Esser for reporting this issue.

* Entries to be published in the future could be accessed by their future URL before being shown on the mainpage.

Upgrading from any version to 0.7.1 is very easy: Just extract the files of our release into your existing directory, open your blog and the automatic upgrader will do the rest. Creating a backup before is still a good idea for any software, though.

For users who want to easily patch their 0.7 release, you only need to copy over those files:

* serendipity_config.inc.php
* compat.inc.php
* NEWS
* serendipity_functions.inc.php
* plugins/serendipity_event_spamblock/serendipity_event_spamblock.php

Meanwhile we are heavily working on our upcoming 0.8 release, which already has a huge list of changes (http://cvs.sourceforge.net/viewcvs.py/p ... iew=markup).

We are also happy to announce that finally the DNS issues of www.s9y.org are resolved, and the ressource is up and running again. For the future, a backup DNS name 'www.s9y.info' is available.

Have fun,
the Serendipity Team

garvinhicking wrote:For users who want to easily patch their 0.7 release, you only need to copy over those files:

* serendipity_config.inc.php
* compact.inc.php
* NEWS
* serendipity_functions.inc.php
* plugins/serendipity_event_spamblock/serendipity_event_spamblock.php

Many thanks to the whole team for reacting so quickly!

Two notes, though: copying the files above is not sufficient to protect against the cross site scripting vulnerability. The layout.php of the templates default, moz-modern and newspaper have to be copied over also. And it is include/compat.inc.php, not compact.inc.php - small typo.

Hi sil53r!

Two notes, though: copying the files above is not sufficient to protect against the cross site scripting vulnerability. The layout.php of the templates default, moz-modern and newspaper have to be copied over also. And it is include/compat.inc.php, not compact.inc.php - small typo.

In fact, this is not true. The variable is fixed in compat.inc.php, so no need to fix it in layout.php. We fixed it there by intention, so that nobody needs to fix their templates!

Thanks for the typo-notice, I fixed it!

Regards,
Garvin.