Serendipity

It has been a while that we had to publish a security release. But this is one. After the 2.6.0 release, multiple security reports were submitted via Github's system. Not all of them were valid according to our criteria, but some turned out to be legitimate reports. These security reports will be released soon, but boil down to:

• A critical bug in the username logic, allowing existing usernames to be duplicated and to capture the rights of existing accounts (@DevVaibhav07)
• A XSS injection vector on the search page, the search term was not properly (or rather, twice) escaped (@hutsbotnet)
• An outdated blacklist for downloads into the media library, making network resources available that ought to be blocked. (@riodrwn)
• An open redirect in exit.php when the trackexit plugin was installed and the blog used for URL redirects via an option in the plugin (@DevVaibhav07)

These four security bugs are fixed in this release. Thanks to the reporters.

Regular Changes

We had already prepared smaller fixes for 2.6.0. They are included in this release as well:

• Fix 404 on cached page loads from plugins (i.e. staticpages) by @fasterit in https://github.com/s9y/Serendipity/pull/969
• Bypass the cache when comments are previewed or submitted otherwise by @fasterit in https://github.com/s9y/Serendipity/pull/971
• Update comments.inc.php for compatibility with PHP 8.3 by @qbi in https://github.com/s9y/Serendipity/pull/968
• Bypass cache for entry/staticpage preview, don't poison cache when we can easily avoid it by checking bypass_cache by @fasterit in https://github.com/s9y/Serendipity/pull/972
• Add cleanCache() calls where they were missing by @fasterit in https://github.com/s9y/Serendipity/pull/973
• Fix plugin backend page (its Javascript) on new installations

Thanks to the contributors.

New Contributors

• @qbi made their first contribution in https://github.com/s9y/Serendipity/pull/968

Full Changelog: https://github.com/s9y/Serendipity/compare/2.6.0...2.6.1

(MD5: b521205a1e2d9c17ddfdfe2a64942c09)