[serendipity-cvs] [s9y/Serendipity] f9fe01: Fix XSS on search page
onli via php-blog-cvs <[email protected]> Wed, 22 Jul 2026 15:27:57 -0700
| Newsgroups | gmane.comp.serendipity.cvs |
|---|---|
| Message-ID | <s9y/Serendipity/push/refs/heads/master/[email protected]> |
Branch: refs/heads/master
Home: https://github.com/s9y/Serendipity
Commit: f9fe0153628747dc4c82ed1e75f5a3ea32c8a148
https://github.com/s9y/Serendipity/commit/f9fe0153628747dc4c82ed1e75f5a3ea32c8a148
Author: onli <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M docs/NEWS
M include/functions_routing.inc.php
Log Message:
-----------
Fix XSS on search page
Commit: 2a1e9a6b370f6c03cbe4afc33cffa65e9338da10
https://github.com/s9y/Serendipity/commit/2a1e9a6b370f6c03cbe4afc33cffa65e9338da10
Author: DevVaibhav07 <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M include/admin/upgrader.inc.php
M include/functions_config.inc.php
M include/functions_upgrader.inc.php
M sql/db.sql
A sql/db_update_2.6_2.7-alpha1_mysql.sql
A sql/db_update_2.6_2.7-alpha1_postgres.sql
A sql/db_update_2.6_2.7-alpha1_sqlite.sql
Log Message:
-----------
Fix auth context confusion: pass validated row to serendipity_load_userdata, add UNIQUE constraint on authors.username (GHSA-v645-243f-jwgh)
Commit: 3ef05863270bc99b64510b89af1eba1fbee83a78
https://github.com/s9y/Serendipity/commit/3ef05863270bc99b64510b89af1eba1fbee83a78
Author: onli <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M docs/NEWS
M include/admin/upgrader.inc.php
M include/functions_upgrader.inc.php
M serendipity_config.inc.php
Log Message:
-----------
Fix unique username upgrade task for sqlite3-pdo
Also set 2.6.1 as target for the release with this patch, instead of linking it to 2.7-alpha1
Commit: 078a4b2371db4c66ca084b18d7a92e062c2ddcb5
https://github.com/s9y/Serendipity/commit/078a4b2371db4c66ca084b18d7a92e062c2ddcb5
Author: DevVaibhav07 <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M exit.php
Log Message:
-----------
Fix open redirect in exit.php via trackexits comment redirection (GHSA-77rw-27c5-4hxm)
When the serendipity_event_trackexits plugin is configured with
commentredirection = 's9y', exit.php redirected to any base64-encoded
$_GET['url'] supplied by an unauthenticated visitor, with only a CRLF
check. This is an open redirect (CWE-601): an attacker can craft a URL
on the blog's trusted domain that silently bounces victims to an
arbitrary external site (phishing, malware, reputation abuse).
Rather than whitelisting against a single source (which would break the
other trackexits deflection cases this same code path serves -- comment
bodies, HTML nuggets and entry links not present in the references
table), this routes the unverified, visitor-supplied destination through
an interstitial confirmation page instead of a silent Location redirect.
The visitor sees the real destination and consciously continues, so the
blog domain can no longer be abused for a transparent redirect, while
every legitimate deflection target still works with one extra click.
Verified DB reference links (url_id/entry_id) are blog-published and stay
a direct 301. Only http(s) destinations are made clickable, so a
javascript:/data: payload cannot become click-through XSS, and the
destination is HTML-escaped on output.
Commit: e573580d2b1cfa877392aa36d25e6a952f8104e5
https://github.com/s9y/Serendipity/commit/e573580d2b1cfa877392aa36d25e6a952f8104e5
Author: DevVaibhav07 <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M exit.php
M lang/UTF-8/serendipity_lang_de.inc.php
M lang/UTF-8/serendipity_lang_en.inc.php
M lang/serendipity_lang_en.inc.php
A templates/2k11/exit_redirect.tpl
Log Message:
-----------
Use Smarty template and translation system for exit interstitial
Per review feedback:
- Add EXIT_LEAVING_* constants to EN and DE lang files; fallback
defines in exit.php cover untranslated languages
- Add templates/2k11/exit_redirect.tpl rendered via serendipity_smarty_init()
and serendipity_getTemplateFile(), loading the active theme CSS
- Plain-HTML fallback retained for installs where Smarty is unavailable
- Fix inline comment: comment bodies are stripped by strip_tags() before
the frontend_display hook, so they never traverse exit.php
Commit: 60577f5db4a586a69eca60dcda487b4c73a93c8e
https://github.com/s9y/Serendipity/commit/60577f5db4a586a69eca60dcda487b4c73a93c8e
Author: onli <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M docs/NEWS
M lang/UTF-8/serendipity_lang_bg.inc.php
M lang/UTF-8/serendipity_lang_cn.inc.php
M lang/UTF-8/serendipity_lang_cs.inc.php
M lang/UTF-8/serendipity_lang_cz.inc.php
M lang/UTF-8/serendipity_lang_da.inc.php
M lang/UTF-8/serendipity_lang_de.inc.php
M lang/UTF-8/serendipity_lang_en.inc.php
M lang/UTF-8/serendipity_lang_es.inc.php
M lang/UTF-8/serendipity_lang_fa.inc.php
M lang/UTF-8/serendipity_lang_fi.inc.php
M lang/UTF-8/serendipity_lang_fr.inc.php
M lang/UTF-8/serendipity_lang_hu.inc.php
M lang/UTF-8/serendipity_lang_is.inc.php
M lang/UTF-8/serendipity_lang_it.inc.php
M lang/UTF-8/serendipity_lang_ja.inc.php
M lang/UTF-8/serendipity_lang_ko.inc.php
M lang/UTF-8/serendipity_lang_nl.inc.php
M lang/UTF-8/serendipity_lang_no.inc.php
M lang/UTF-8/serendipity_lang_pl.inc.php
M lang/UTF-8/serendipity_lang_pt.inc.php
M lang/UTF-8/serendipity_lang_pt_PT.inc.php
M lang/UTF-8/serendipity_lang_ro.inc.php
M lang/UTF-8/serendipity_lang_ru.inc.php
M lang/UTF-8/serendipity_lang_sa.inc.php
M lang/UTF-8/serendipity_lang_se.inc.php
M lang/UTF-8/serendipity_lang_sk.inc.php
M lang/UTF-8/serendipity_lang_ta.inc.php
M lang/UTF-8/serendipity_lang_tn.inc.php
M lang/UTF-8/serendipity_lang_tr.inc.php
M lang/UTF-8/serendipity_lang_tw.inc.php
M lang/UTF-8/serendipity_lang_zh.inc.php
M lang/serendipity_lang_bg.inc.php
M lang/serendipity_lang_cn.inc.php
M lang/serendipity_lang_cs.inc.php
M lang/serendipity_lang_cz.inc.php
M lang/serendipity_lang_da.inc.php
M lang/serendipity_lang_de.inc.php
M lang/serendipity_lang_es.inc.php
M lang/serendipity_lang_fa.inc.php
M lang/serendipity_lang_fi.inc.php
M lang/serendipity_lang_fr.inc.php
M lang/serendipity_lang_hu.inc.php
M lang/serendipity_lang_is.inc.php
M lang/serendipity_lang_it.inc.php
M lang/serendipity_lang_ja.inc.php
M lang/serendipity_lang_ko.inc.php
M lang/serendipity_lang_nl.inc.php
M lang/serendipity_lang_no.inc.php
M lang/serendipity_lang_pl.inc.php
M lang/serendipity_lang_pt.inc.php
M lang/serendipity_lang_pt_PT.inc.php
M lang/serendipity_lang_ro.inc.php
M lang/serendipity_lang_ru.inc.php
M lang/serendipity_lang_sa.inc.php
M lang/serendipity_lang_se.inc.php
M lang/serendipity_lang_sk.inc.php
M lang/serendipity_lang_ta.inc.php
M lang/serendipity_lang_tn.inc.php
M lang/serendipity_lang_tr.inc.php
M lang/serendipity_lang_tw.inc.php
M lang/serendipity_lang_zh.inc.php
Log Message:
-----------
Document exit open redirect fix and add missing language costants
Commit: 89916475ffc22314c9fb9a2577c00ae01a22edae
https://github.com/s9y/Serendipity/commit/89916475ffc22314c9fb9a2577c00ae01a22edae
Author: onli <[email protected]>
Date: 2026-07-05 (Sun, 05 Jul 2026)
Changed paths:
M docs/NEWS
M include/functions.inc.php
Log Message:
-----------
Security fix: serendipity_url_allowed could sometimes be bypassed
Instead of relying on a custom Regex, this now uses PHP's filter_var and flags to detect forbidden IP ranges. Patch provided by @riodrwn
Commit: 210121820d9683dee779e74212a6ed74060dc887
https://github.com/s9y/Serendipity/commit/210121820d9683dee779e74212a6ed74060dc887
Author: Matthias Gutjahr <[email protected]>
Date: 2026-07-07 (Tue, 07 Jul 2026)
Changed paths:
M include/functions_config.inc.php
M include/functions_upgrader.inc.php
M templates/2k11/config.inc.php
Log Message:
-----------
Propose some small changes
Commit: 9fc021daf3e68c1c2f659427b87ea2fbf076788a
https://github.com/s9y/Serendipity/commit/9fc021daf3e68c1c2f659427b87ea2fbf076788a
Author: onli <[email protected]>
Date: 2026-07-10 (Fri, 10 Jul 2026)
Changed paths:
M include/functions_config.inc.php
M include/functions_upgrader.inc.php
M templates/2k11/config.inc.php
Log Message:
-----------
Merge pull request #1 from s9y/fix/mattsches
Some small changes
Commit: 874b324d1f5bad34dc0bed1fcb1704effe904ae2
https://github.com/s9y/Serendipity/commit/874b324d1f5bad34dc0bed1fcb1704effe904ae2
Author: onli <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
M docs/NEWS
M exit.php
M include/admin/upgrader.inc.php
M include/functions.inc.php
M include/functions_config.inc.php
M include/functions_routing.inc.php
M include/functions_upgrader.inc.php
M lang/UTF-8/serendipity_lang_bg.inc.php
M lang/UTF-8/serendipity_lang_cn.inc.php
M lang/UTF-8/serendipity_lang_cs.inc.php
M lang/UTF-8/serendipity_lang_cz.inc.php
M lang/UTF-8/serendipity_lang_da.inc.php
M lang/UTF-8/serendipity_lang_de.inc.php
M lang/UTF-8/serendipity_lang_en.inc.php
M lang/UTF-8/serendipity_lang_es.inc.php
M lang/UTF-8/serendipity_lang_fa.inc.php
M lang/UTF-8/serendipity_lang_fi.inc.php
M lang/UTF-8/serendipity_lang_fr.inc.php
M lang/UTF-8/serendipity_lang_hu.inc.php
M lang/UTF-8/serendipity_lang_is.inc.php
M lang/UTF-8/serendipity_lang_it.inc.php
M lang/UTF-8/serendipity_lang_ja.inc.php
M lang/UTF-8/serendipity_lang_ko.inc.php
M lang/UTF-8/serendipity_lang_nl.inc.php
M lang/UTF-8/serendipity_lang_no.inc.php
M lang/UTF-8/serendipity_lang_pl.inc.php
M lang/UTF-8/serendipity_lang_pt.inc.php
M lang/UTF-8/serendipity_lang_pt_PT.inc.php
M lang/UTF-8/serendipity_lang_ro.inc.php
M lang/UTF-8/serendipity_lang_ru.inc.php
M lang/UTF-8/serendipity_lang_sa.inc.php
M lang/UTF-8/serendipity_lang_se.inc.php
M lang/UTF-8/serendipity_lang_sk.inc.php
M lang/UTF-8/serendipity_lang_ta.inc.php
M lang/UTF-8/serendipity_lang_tn.inc.php
M lang/UTF-8/serendipity_lang_tr.inc.php
M lang/UTF-8/serendipity_lang_tw.inc.php
M lang/UTF-8/serendipity_lang_zh.inc.php
M lang/serendipity_lang_bg.inc.php
M lang/serendipity_lang_cn.inc.php
M lang/serendipity_lang_cs.inc.php
M lang/serendipity_lang_cz.inc.php
M lang/serendipity_lang_da.inc.php
M lang/serendipity_lang_de.inc.php
M lang/serendipity_lang_en.inc.php
M lang/serendipity_lang_es.inc.php
M lang/serendipity_lang_fa.inc.php
M lang/serendipity_lang_fi.inc.php
M lang/serendipity_lang_fr.inc.php
M lang/serendipity_lang_hu.inc.php
M lang/serendipity_lang_is.inc.php
M lang/serendipity_lang_it.inc.php
M lang/serendipity_lang_ja.inc.php
M lang/serendipity_lang_ko.inc.php
M lang/serendipity_lang_nl.inc.php
M lang/serendipity_lang_no.inc.php
M lang/serendipity_lang_pl.inc.php
M lang/serendipity_lang_pt.inc.php
M lang/serendipity_lang_pt_PT.inc.php
M lang/serendipity_lang_ro.inc.php
M lang/serendipity_lang_ru.inc.php
M lang/serendipity_lang_sa.inc.php
M lang/serendipity_lang_se.inc.php
M lang/serendipity_lang_sk.inc.php
M lang/serendipity_lang_ta.inc.php
M lang/serendipity_lang_tn.inc.php
M lang/serendipity_lang_tr.inc.php
M lang/serendipity_lang_tw.inc.php
M lang/serendipity_lang_zh.inc.php
M serendipity_config.inc.php
M sql/db.sql
A sql/db_update_2.6_2.7-alpha1_mysql.sql
A sql/db_update_2.6_2.7-alpha1_postgres.sql
A sql/db_update_2.6_2.7-alpha1_sqlite.sql
M templates/2k11/config.inc.php
A templates/2k11/exit_redirect.tpl
Log Message:
-----------
Merge branch 'fix/securityReports'
Commit: 27ad4ea5fed66389fdc534b69eacc98b2aeb2a8a
https://github.com/s9y/Serendipity/commit/27ad4ea5fed66389fdc534b69eacc98b2aeb2a8a
Author: onli <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
A sql/db_update_2.6_2.6.1_mysql.sql
A sql/db_update_2.6_2.6.1_postgres.sql
A sql/db_update_2.6_2.6.1_sqlite.sql
R sql/db_update_2.6_2.7-alpha1_mysql.sql
R sql/db_update_2.6_2.7-alpha1_postgres.sql
R sql/db_update_2.6_2.7-alpha1_sqlite.sql
Log Message:
-----------
Apply DB schema upgrades to 2.6.1
Commit: 5c967cb76187af1654db01a4a40cb51b5db99f4c
https://github.com/s9y/Serendipity/commit/5c967cb76187af1654db01a4a40cb51b5db99f4c
Author: onli <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
R sql/db_update_2.6_2.6.1_mysql.sql
R sql/db_update_2.6_2.6.1_postgres.sql
R sql/db_update_2.6_2.6.1_sqlite.sql
Log Message:
-----------
Remove duplicate SQL schema upgrades
The PHP upgrade task will already upgrade the schema and takes care of removing duplicate values. The SQL schema files would run before the PHP task and could fail.
Commit: d91a8d1640a16fd66bf52540d5c17c8fd1e47814
https://github.com/s9y/Serendipity/commit/d91a8d1640a16fd66bf52540d5c17c8fd1e47814
Author: onli <[email protected]>
Date: 2026-07-22 (Wed, 22 Jul 2026)
Changed paths:
M include/functions_upgrader.inc.php
Log Message:
-----------
Fix duplicated username query for postgres
Commit: 9aa100a744977cd3d85e462fe5f190c866d7e8a0
https://github.com/s9y/Serendipity/commit/9aa100a744977cd3d85e462fe5f190c866d7e8a0
Author: onli <[email protected]>
Date: 2026-07-23 (Thu, 23 Jul 2026)
Changed paths:
M docs/NEWS
M docs/RELEASE
Log Message:
-----------
Point to 2.6.1 release
Compare: https://github.com/s9y/Serendipity/compare/343cb695e5d5...9aa100a74497
To unsubscribe from these emails, change your notification settings at https://github.com/s9y/Serendipity/settings/notifications