Skip to content

Serendipity-Kern

Serendipity verwendet ein sogenanntes "Session cookie" für sowohl das Frontend als auch das Backend. Ein Besucher bekommt ein Cookie mit einer eindeutigen ID, welches auf dem Server verwendet wird, um temporäre Benutzerdaten für die Session zu speichern (z.B. Gültigkeit des Login, Benutzereinstellungen). Dieses Cookie ist notwendig, um sich ins Backend einzuloggen, aber optional im Frontend. Bestimmte Plugins können das Session-Cookie verwenden, um zusätzlich temporäre Daten zu speichern.

Die folgenden Daten können von der Anwendung Serendipity auf dem Server gespeichert werden (vorübergehend, werden nach einer auf dem Server voreingestellten Zeit ungültig, üblicherweise binnen Stunden):

  • HTTP-Browser-Referrer, über den man auf das Blog kam
  • einzigartiger ID-Token des Autors
  • Benutzerdaten von angemeldeten Autoren, wie sie für schnelleren Zugriff in der Datenbank gespeichert werden:
    • Passwort
    • ID des Benutzers
    • eingestellte Sprache des Benutzers
    • Benutzername
    • E-Mail
    • Hashtyp des Logins
    • Berechtigungen zur Veröffentlichung von Einträgen
  • Inhalt des letzten Blogeintrags beim Speichern
  • Indikator, ob Smarty-Templates verwendet werden
  • möglicher Inhalt eines erzeugten CAPTCHA-Bildes
  • das eingestellte Frontend-Theme

Die folgenden Daten werden in Cookies gespeichert:

  • PHP Session-ID
  • Zustand der Auswahlschalter für Eintragseditor, Sortierung, Sortierungsrichtung und Filter sowie zuletzt verwendetes Verzeichnis der Mediendatenbank (nur, falls eingeloggt)
  • Login-Token des Autors (nur, falls eingeloggt)
  • Anzeigesprache
  • nach dem Kommentieren: Nachname, E-Mail, URL, Status von "Daten merken?" (falls aktiviert)

Die IP-Adressen von Benutzern werden wie folgt verwendet:

  • in der Datenbank gespeichert, falls Referrer-Tracking aktiviert ist (Statistiken)
  • gespeichert für Kommentare eines Benutzers und angezeigt in der E-Mail, die an Moderatoren gesendet wird
  • gespeichert in Logdateien (falls aktiviert) der Antispam-Plugins
  • übermittelt an den Akismet-Antispam-Filter (falls aktiviert)
  • temporärer Nur-lesen-Zugriff, um Referrer, Logins und IP-Flooding zu prüfen

Benutzereingeaben von Benutzern (nicht Autoren):

  • Kommentare (alle Metadaten eines Kommentars, gespeichert in der Datenbank-Tabelle serendipity_comments)
  • Referrer-URL, über die man auf das Blog kam (falls Referrer-Tracking aktiviert ist, gespeichert in der Datenbank-Tabelle serendipity_referers)

Zudem sind derzeit die folgenden Plugins aktiviert und erzeugen automatisch die folgende Liste an Ausgaben:

Textformatierung: Externe Links zählen

Web services / Third Party

  • bmi: BMI Link deflector
  • favatar: Google link deflector.

Frontend

  • Outgoing links are routed through a link deflector, so the target page will not get the referrer of this blog. However, this means that the link deflector service will get both the target and the originating link plus metadata of a visitor.

Attributes

  • Does not store user data (or not specified)
  • Does not store IP data (or not specified)
  • Operates on IP data (read-access, also when passing through metadata)
  • Transmits user input to services / third parties (not necessarily stored)

Spartacus

Web services / Third Party

Backend

  • Allows to download plugins from configured remote sources from the webserver, may also connect via FTP to a configured server.

Attributes

  • Does not store user data (or not specified)
  • Does not store IP data (or not specified)
  • Does not operate on IP data (or not specified)
  • Does not transmit user input to services / third parties (or not specified)

Spamschutz

Web services / Third Party

  • akismet: Transmits comment data (and metadata) to check whether it is spam: User-Agent, HTTP Referer, IP [can be anonymized], Author name [can be anonymized], Author mail [can be anonymized], Author URL [can be anonymized], comment body
  • tpas: Transmits comment data (and metadata) to check whether it is spam: User-Agent, HTTP Referer, IP [can be anonymized], Author name [can be anonymized], Author mail [can be anonymized], Author URL [can be anonymized], comment body

Frontend

  • To check a comment for spam, the Akismet/Typepad service can be enabled and receives comment data of the user and its metadata: User-Agent, HTTP Referer, IP [can be anonymized], Author name [can be anonymized], Author mail [can be anonymized], Author URL [can be anonymized], comment body.
  • Submitted and also rejected comments can be saved to a logfile.
  • When Captchas are enabled, the displayed graphic key is stored in the session data and uses a PHP session cookie.

Backend

  • To report a comment for spam, the Akismet/Typepad service can be enabled and receives comment data of the user and its metadata: User-Agent, HTTP Referer, IP [can be anonymized], Author name [can be anonymized], Author mail [can be anonymized], Author URL [can be anonymized], comment body.

Cookies

  • When Captchas are enabled, the displayed graphic key is stored in the session data and uses a PHP session cookie.

Attributes

  • Stores user data (like names, text, preferences) to a database, file or other storage (mail)
  • Stores IP data (written to storage)
  • Operates on IP data (read-access, also when passing through metadata)
  • Transmits user input to services / third parties (not necessarily stored)

Statistiken

Frontend

  • Saves user visitor data to the local database (visitors) for statistical analysis. Tracks IP, User Agent, HTTP Referer

Attributes

  • Stores user data (like names, text, preferences) to a database, file or other storage (mail)
  • Stores IP data (written to storage)
  • Operates on IP data (read-access, also when passing through metadata)
  • Does not transmit user input to services / third parties (or not specified)

Kontaktformular

Web services / Third Party

  • mail: Visitor feedback of the contact form is transferred via e-mail

Frontend

  • Visitor feedback of the contact form is transferred via e-mail

Attributes

  • Does not store user data (or not specified)
  • Does not store IP data (or not specified)
  • Operates on IP data (read-access, also when passing through metadata)
  • Transmits user input to services / third parties (not necessarily stored)

Recaptcha

Web services / Third Party

  • Google reCaptcha: Transmits captcha form data to Google Servers to check for human (=non robot) input to prevent spam

Frontend

  • If logging is enabled, saves user comment data (name, email, url, user agent, ip, comment body, timestamp, referrer) in database or file.
  • Transmits comment data to the Google ReCaptcha API

Attributes

  • Stores user data (like names, text, preferences) to a database, file or other storage (mail)
  • Stores IP data (written to storage)
  • Operates on IP data (read-access, also when passing through metadata)
  • Transmits user input to services / third parties (not necessarily stored)

Spamschutz (Bayes)

Frontend

  • All user data and metadata (IP address, comment fields) can be logged to database or file

Attributes

  • Stores user data (like names, text, preferences) to a database, file or other storage (mail)
  • Stores IP data (written to storage)
  • Operates on IP data (read-access, also when passing through metadata)
  • Does not transmit user input to services / third parties (or not specified)

Erweiterte Eigenschaften von Artikeln

Frontend

  • If password protected entries are used, the password can be sent by the visitor and if access is granted, this is stored in a session variable.

Cookies

  • Uses PHP session cookie for potential session storage whether access to a password-protected entry is granted

Attributes

  • Does not store user data (or not specified)
  • Does not store IP data (or not specified)
  • Does not operate on IP data (or not specified)
  • Transmits user input to services / third parties (not necessarily stored)

Active Theme "2k11"

  • This theme can optionally use webfonts. If enabled, webfonts are loaded from Google/CDN servers, who will receive the IP address of the visitor and his metadata (browser, referrer, user agent, possible cookies)
  • TODO: (Provide information on used javascripts, possible cookie, where data is transferred to)

Available Theme "bulletproof"

  • If custom javascripts are inserted, make sure to mention them in your GDPR / DSGVO legal notice

Available Theme "clean-blog"

  • This theme can optionally use webfonts. If enabled, webfonts are loaded from Google/CDN servers, who will receive the IP address of the visitor and his metadata (browser, referrer, user agent, possible cookies)
  • TODO: (Provide information on used javascripts, possible cookie, where data is transferred to)

Available Theme "next"

  • This theme can optionally use webfonts. If enabled, webfonts are loaded from Google/CDN servers, who will receive the IP address of the visitor and his metadata (browser, referrer, user agent, possible cookies)
  • TODO: (Provide information on used javascripts, possible cookie, where data is transferred to)

Available Theme "skeleton"

  • This theme can optionally use webfonts. If enabled, webfonts are loaded from Google/CDN servers, who will receive the IP address of the visitor and his metadata (browser, referrer, user agent, possible cookies)
  • TODO: (Provide information on used javascripts, possible cookie, where data is transferred to)

Available Theme "timeline"

  • This theme can optionally use webfonts. If enabled, webfonts are loaded from Google/CDN servers, who will receive the IP address of the visitor and his metadata (browser, referrer, user agent, possible cookies)
  • TODO: (Provide information on used javascripts, possible cookie, where data is transferred to)

Privacy statement / Imprint