Over the weekend, we were alerted to a security flaw in BlogEngine.NET 1.3.0.0.   We have created a new release 1.3.1.0 which corrects this issue and are making a patch available here for users running 1.3.0.0.  For those people running development version of BlogEngine.NET (from the source tab on CodePlex), please note that the latest release 1.3.0.29 has the security fix as well.

The security flaw makes it possible to access BlogEngine.NET user passwords (and other data that you normally would see with a password).  The flaw has been in the system since version 1.2.0.23 and we strongly encourage all BlogEngine.NET users to update to 1.3.1 as soon as possible.  If you see a fellow blogger running something prior to 1.3.0.29 or 1.3.1.0, please let them know to update their site as soon as possible.  In addition, we encourage you to update your BlogEngine.NET password(s) as a security measure after you update.

The BlogEngine.NET team takes security very seriously and we regret that this security issue was introduced into the system.   We hope that no one was seriously effected by the issue and have not heard reports of any to date.  Please update your software as soon as you can.  We are truly sorry for the inconvenience.

It is unfortunate that the issue could not have been handled more discretely.  If you are blogger writing about the issue, we'd hope that you could refrain for spelling out exactly how to attack sites that haven't been updated yet.  (Yes, we do want people to know there is a problem that needs patched, but we'd prefer if were weren't tempting casual hackers to try out the hack on a unpatched site by giving them a step by step guide.)

Again, we are sorry for the inconvenience and any trouble this may have caused you.  If you know of other BlogEngine.NET users, please pass this information along.

Download Full Release: BlogEngine.NET 1.3.1.0

Download Patch for BlogEngine.NET 1.3.0.0

For all of you who likes social networking sites, we bring you some good news. BlogEngine.NET has been registered as a group anyone can join on both Facebook and LinkedIn. A group works the same way on both Facebook and LinkedIn. You can view the other members as well as discuss and comment on BlogEngine.NET related stuff.

The purpose is to make BlogEngine.NET visible to more people as well as to use Facebook and LinkedIn as hubs to related news and events.

Come on, join us now on Facebook and/or LinkedIn. You won't regret it.

Paul Tumelty recently put together a huge list of available extensions for BlogEngine.NET and was kind enough to allow us to share his work on our extensions page.

I'm sure there are more extensions available, but these are the ones we've seen.  If you have one you'd like to share, please leave a comment here and we'll try to get it posted soon. 

We recently updated our themes page with 12 new themes from the community.  There has been a lot going on with themes recently and we're excited to see all the new contributions.

We now have 18 additional themes you can download and use available from the theme page.  (This doesn't count the 8 themes that are ready out of the box.)  So check out the updated theme page and if you have a theme, you'd like to share, please let us know.

Jesse Foster has portet a really cool theme to BlogEngine.NET. It's a dark theme that looks really stylish and clean.

You can see and download the theme here.

Thanks Jesse - good work (and sorry for getting your name wrong the first time around. )

Al Nyveldt has just recorded two different installation guides for BlogEngine.NET 1.3 - one for general setup and one for using the SQL provider.

• General installation guide
• SQL provider guide 

They are really good and should take care of all issues regarding installation and setup. 

The fourth version of BlogEngine.NET has just been released. You can download it here.

We’ve listened to what you said and fixed a lot of stuff since the 1.2 release a little more than 2½ month ago. There are also a lot of new features and a lot of improvements to existing ones. This release is truly carried forward by the engaging community BlogEngine.NET has gotten. You’ve reported feature requests, filed bug reports and uploaded patches like never before. Thank you very much for that.

New features

• An extension manager that lets you disable and change settings for extensions
• Extended Windows Live Writer support for posts and pages
• Mobile devices get special output tailored for small screens
• Improved user and role management from the admin
• Non-admin users can only edit and delete their own posts
• The blog import tool now works with BlogML, RSS and ATOM
• Granular control over trackbacks and pingbacks
• User control injection with properties
• Related posts now also shows related pages
• New navigational links added to the top of posts
• More informative e-mails sent when a comment is added
• Mono is now fully supported out of the box

 

Backward compatibility

You might have created your own themes and extensions that you don’t want to rewrite because there is a new release. Don’t worry. Your themes will still work but your extensions might have to be updated.

Themes

All themes should be 100% backward compatible but there is one thing that has been deprecated. In the CommentView.ascx in your theme folder, you should replace

<%= ResolveLinks(Comment.Content) %>

With

<%= Text %>

You don’t have to if you don’t want to since the ResolveLinks method still exist. But it will be removed when the next version is released, so why not get it over with now.

Extensions

Extension builders have more events to write extensions for and some of the existing events have been upgraded to use a different EventArgs. You should check that your extensions work with the new CancelEventArgs used on Post.AddingComment and some other events. In most cases you can just swap EventArgs out for System.ComponentModel.CancelEventArgs and you’re good to go.

Happy holidays from the BlogEngine.NET team

Just before the release of BlogEngine.NET 1.3 we want to add an extension manager. It allows you to change settings and enable/disable the different extensions available. It's really cool and very useful, but we need your feedback on how to do it most optimal.

If you have any ideas in that regard, please comment on Ruslan's blog post about the subject. We really want to nail this feature. Thank you for your time.

We’re had a change of plans and have decided to hold off a few weeks on the next release of BlogEngine.NET.  While we initially wanted to make more of a patch release, we’ve kept adding more and more into it.  The new features need time for perfecting and really more than anything, we want another solid release.

However, since we are taking extra time and packing it full of features, we’re going to make the next release 1.3.  Here is a sampling of what to look forward to in BlogEngine.NET 1.3:

• Full mono support (right out of the box)
• Updated Metaweblog API including support for creating/editing pages in WLW.
• Improved Blog importer/exporter, including support for easily switching between XML and SQL backends
• New extension manager to managing extensions and their settings.
• New events for extension writers
• Support for mobile devices
• New themes

Version 1.3 will be released before Christmas 2007.  As soon as we feel it is ready, we'll release it for the world.  In the meantime, if you can't possibly wait another day, you're welcome to try the latest build from CodePlex and let us know if you experience any issues.  The more testing we have, the better the release will be.

The next release has been set to this November, but we need to push it another week or so. It's not because we want to push it, but we have had some issues with computers seriously crashing and just a general shortage of spare time.

We wan't to push the release so we can make sure the RSS/ATOM and BlogML importer will work perfectly and that the overall quality of the release will be as high as possible. Also, we wan't to make sure that we fully support Mono out of the box without any tweaks are needed. Hope you understand.