Serendipity Core

Serendipity uses a so-called "Session cookie" for both frontend and backend. A visitor will receive a cookie with a unique ID, which is used on the server to store temporary session user data (i.e. login validity, user preferences). This cookie is mandatory for logging in to the backend, but optional for the frontend. Certain plugins can use the session cookie to store additional temporary data.

The following data can be stored by the Serendipity application on the server (temporarily, invalidated after the server-configured timeout, usually in the range of hours):

• HTTP browser referer when entering the blog
• Unique author ID token
• User data of a logged in author as stored in the database for faster access:
  • Password
  • ID of the user
  • Configured language of the user
  • Username
  • E-Mail
  • Login hashtype
  • Publishing right
• Last blog entry contents when saving
• Indicator if Smarty templating is used
• Possible content of a generated captcha image
• The configured frontend theme

The following data is stored in cookies:

• PHP session ID
• State of entry editor toggle, sort, sort order and filter toggles, last used media library directory (only if logged in)
• Author login token (only if logged in)
• Display language
• After commenting: Last name, E-Mail, URL, state of "Remember comments" (if enabled)

The IP addresses of users are utilized at these places:

• Stored in database when referrer tracking is enabled (Statistics)
• Stored for comments of a visitor and displayed within the E-Mail that is sent to moderators
• Stored in logfile (if enabled) of the antispam plugin
• Transmitted in Antispam filter for Akismet (if enabled)
• Temporary Read-only access for checking referrers, logins, IP flooding

User input from visitors (not editors):

• Comments (all comment metadata, stored in Database table serendipity_comments)
• Referring URL when entering the blog (if referrer tracking is enabled, in database table serendipity_referers)

Additionally, the following plugins are currently enabled and this is their automatically generated manifest:

Spam Protector

Web services / Third Party

• akismet: Transmits comment data (and metadata) to check whether it is spam: User-Agent, HTTP Referer, IP [can be anonymized], Author name [can be anonymized], Author mail [can be anonymized], Author URL [can be anonymized], comment body
• tpas: Transmits comment data (and metadata) to check whether it is spam: User-Agent, HTTP Referer, IP [can be anonymized], Author name [can be anonymized], Author mail [can be anonymized], Author URL [can be anonymized], comment body

Frontend

• To check a comment for spam, the Akismet/Typepad service can be enabled and receives comment data of the user and its metadata: User-Agent, HTTP Referer, IP [can be anonymized], Author name [can be anonymized], Author mail [can be anonymized], Author URL [can be anonymized], comment body.
• Submitted and also rejected comments can be saved to a logfile.
• When Captchas are enabled, the displayed graphic key is stored in the session data and uses a PHP session cookie.

Backend

• To report a comment for spam, the Akismet/Typepad service can be enabled and receives comment data of the user and its metadata: User-Agent, HTTP Referer, IP [can be anonymized], Author name [can be anonymized], Author mail [can be anonymized], Author URL [can be anonymized], comment body.

Cookies

• When Captchas are enabled, the displayed graphic key is stored in the session data and uses a PHP session cookie.

Attributes

• Stores user data (like names, text, preferences) to a database, file or other storage (mail)
• Stores IP data (written to storage)
• Operates on IP data (read-access, also when passing through metadata)
• Transmits user input to services / third parties (not necessarily stored)

Spartacus

Web services / Third Party

• spartacus: Package server for plugin downloads
• github.com: Package server for plugin downloads
• s9y.org: Package server for plugin downloads
• sourceforge.net: Package server for plugin downloads

Backend

• Allows to download plugins from configured remote sources from the webserver, may also connect via FTP to a configured server.

Attributes

• Does not store user data (or not specified)
• Does not store IP data (or not specified)
• Does not operate on IP data (or not specified)
• Does not transmit user input to services / third parties (or not specified)

Spamblock Bee (Honeypot, Hidden Captcha)

Frontend

• Anti-Spam measurements by this plugin can transfer user data and metadata (??? plugin description missing ???)
• All user data and metadata (IP address, comment fields) can be logged to database or file

Attributes

• Stores user data (like names, text, preferences) to a database, file or other storage (mail)
• Stores IP data (written to storage)
• Operates on IP data (read-access, also when passing through metadata)
• Transmits user input to services / third parties (not necessarily stored)

Extended properties for entries

Frontend

• If password protected entries are used, the password can be sent by the visitor and if access is granted, this is stored in a session variable.

Cookies

• Uses PHP session cookie for potential session storage whether access to a password-protected entry is granted

Attributes

• Does not store user data (or not specified)
• Does not store IP data (or not specified)
• Does not operate on IP data (or not specified)
• Transmits user input to services / third parties (not necessarily stored)

Syndication

Web services / Third Party

• subtome: Enables visitors to easily subscribe to RSS feeds. The visitor loads a JavaScript from their servers, thus the IP address will be known to the service.
• feedburner.com: Feedburner can be used to track your feed subscription statistics. If used, a tracking pixel is loaded from FeedBurner.com servers and the IP address of the visitor will be known to the service.

Frontend

• To allow easy subscription to feeds and optional tracking statistics, the subtome or feedburner services can be used.

Attributes

• Does not store user data (or not specified)
• Does not store IP data (or not specified)
• Operates on IP data (read-access, also when passing through metadata)
• Transmits user input to services / third parties (not necessarily stored)

Active Theme "timeline"

• This theme can optionally use webfonts. If enabled, webfonts are loaded from Google/CDN servers, who will receive the IP address of the visitor and his metadata (browser, referrer, user agent, possible cookies)
• TODO: (Provide information on used javascripts, possible cookie, where data is transferred to)

Available Theme "2k11"

• This theme can optionally use webfonts. If enabled, webfonts are loaded from Google/CDN servers, who will receive the IP address of the visitor and his metadata (browser, referrer, user agent, possible cookies)
• TODO: (Provide information on used javascripts, possible cookie, where data is transferred to)

Available Theme "clean-blog"

• This theme can optionally use webfonts. If enabled, webfonts are loaded from Google/CDN servers, who will receive the IP address of the visitor and his metadata (browser, referrer, user agent, possible cookies)
• TODO: (Provide information on used javascripts, possible cookie, where data is transferred to)