It came to our attention a couple of hours ago that BlogEngine.NET 1.4 have a security issue in how it handles comments. The issue have been delt with and an easy-to-install patch have been released at CodePlex. 

It is not a serious security issue that can bring your blog to its knees or exposes your passwords, but it is highly recommended that you download the patch and apply it to your installation. It is as simple as uploading a single file. Sorry for the inconvenience.

Download the patch

It's been a while since the last release, but now the wait is over. We present to you the 5th and best version of BlogEngine.NET. Go download it.

New features in BlogEngine.NET 1.4

New database provider
BlogEngine.NET now works with most commercial and open source databases such as MySQL, SQL Server, VistaDB and many others. This allow you to use practically any database supported by your hosting provider. You can still use XML files if you don't want to use a database.

Drag 'n drop widgets
Widgets are the pieces of content most often located at the sidebar. It could be a list of recent posts, latest tweets from Twitter or anything else. You can drag and drop the widgets around in your sidebar and modify the content of them directly on the front-page. The widget works independently of the theme you are using as long as it is implemented in the theme. In BlogEngine.NET it is implemented in the Standard and Indigo themes and many more themes with widgets will be available for download very soon at the BlogEngine.NET website.

Extension settings
The new settings model for extensions have been upgraded to give you a much better experience using third-party extensions. For extension developers, it has never been easier to store your settings and let the user change them from the admin section. The same settings model is used by the widgets as well.

Web 3.0 improvements
BlogEngine.NET 1.4 makes full use of many semantic formats and technologies such as FOAF, SIOC and APML. It means that the content stored in your BlogEngine.NET installation will be fully portable and auto-discoverable. It is possible to filter the RSS feeds based on the visitor's interest defined in her APML file or do a site search with it as well. Read more the APML filtering in BlogEngine.NET.

Author profiles
By utilizing the ASP.NET profile provider it is now possible to let all authors maintain their own profile. This is used in the FOAF document and widget/extension developers can take full advantage of the profiles to provide new exciting visualizations and functionality.

Other new features
We've listened to what you - the user - wanted in BlogEngine.NET 1.4 and here is a list of some of those features that made it.

• Tag selector when adding new posts
• Subcategories
• Password encryption
• Improved live comment preview
• Hierarchical pages in the control panel
• Smarter comment spam protection
• Link collection widget
• Various performance improvements
• and much more...

Good luck and happy writing.

The BlogEngine.NET team

Over the weekend, we were alerted to a security flaw in BlogEngine.NET 1.3.0.0.   We have created a new release 1.3.1.0 which corrects this issue and are making a patch available here for users running 1.3.0.0.  For those people running development version of BlogEngine.NET (from the source tab on CodePlex), please note that the latest release 1.3.0.29 has the security fix as well.

The security flaw makes it possible to access BlogEngine.NET user passwords (and other data that you normally would see with a password).  The flaw has been in the system since version 1.2.0.23 and we strongly encourage all BlogEngine.NET users to update to 1.3.1 as soon as possible.  If you see a fellow blogger running something prior to 1.3.0.29 or 1.3.1.0, please let them know to update their site as soon as possible.  In addition, we encourage you to update your BlogEngine.NET password(s) as a security measure after you update.

The BlogEngine.NET team takes security very seriously and we regret that this security issue was introduced into the system.   We hope that no one was seriously effected by the issue and have not heard reports of any to date.  Please update your software as soon as you can.  We are truly sorry for the inconvenience.

It is unfortunate that the issue could not have been handled more discretely.  If you are blogger writing about the issue, we'd hope that you could refrain for spelling out exactly how to attack sites that haven't been updated yet.  (Yes, we do want people to know there is a problem that needs patched, but we'd prefer if were weren't tempting casual hackers to try out the hack on a unpatched site by giving them a step by step guide.)

Again, we are sorry for the inconvenience and any trouble this may have caused you.  If you know of other BlogEngine.NET users, please pass this information along.

Download Full Release: BlogEngine.NET 1.3.1.0

Download Patch for BlogEngine.NET 1.3.0.0

For all of you who likes social networking sites, we bring you some good news. BlogEngine.NET has been registered as a group anyone can join on both Facebook and LinkedIn. A group works the same way on both Facebook and LinkedIn. You can view the other members as well as discuss and comment on BlogEngine.NET related stuff.

The purpose is to make BlogEngine.NET visible to more people as well as to use Facebook and LinkedIn as hubs to related news and events.

Come on, join us now on Facebook and/or LinkedIn. You won't regret it.

Paul Tumelty recently put together a huge list of available extensions for BlogEngine.NET and was kind enough to allow us to share his work on our extensions page.

I'm sure there are more extensions available, but these are the ones we've seen.  If you have one you'd like to share, please leave a comment here and we'll try to get it posted soon. 

We recently updated our themes page with 12 new themes from the community.  There has been a lot going on with themes recently and we're excited to see all the new contributions.

We now have 18 additional themes you can download and use available from the theme page.  (This doesn't count the 8 themes that are ready out of the box.)  So check out the updated theme page and if you have a theme, you'd like to share, please let us know.

Jesse Foster has portet a really cool theme to BlogEngine.NET. It's a dark theme that looks really stylish and clean.

You can see and download the theme here.

Thanks Jesse - good work (and sorry for getting your name wrong the first time around. )

Al Nyveldt has just recorded two different installation guides for BlogEngine.NET 1.3 - one for general setup and one for using the SQL provider.

• General installation guide
• SQL provider guide 

They are really good and should take care of all issues regarding installation and setup. 

The fourth version of BlogEngine.NET has just been released. You can download it here.

We’ve listened to what you said and fixed a lot of stuff since the 1.2 release a little more than 2½ month ago. There are also a lot of new features and a lot of improvements to existing ones. This release is truly carried forward by the engaging community BlogEngine.NET has gotten. You’ve reported feature requests, filed bug reports and uploaded patches like never before. Thank you very much for that.

New features

• An extension manager that lets you disable and change settings for extensions
• Extended Windows Live Writer support for posts and pages
• Mobile devices get special output tailored for small screens
• Improved user and role management from the admin
• Non-admin users can only edit and delete their own posts
• The blog import tool now works with BlogML, RSS and ATOM
• Granular control over trackbacks and pingbacks
• User control injection with properties
• Related posts now also shows related pages
• New navigational links added to the top of posts
• More informative e-mails sent when a comment is added
• Mono is now fully supported out of the box

Backward compatibility

You might have created your own themes and extensions that you don’t want to rewrite because there is a new release. Don’t worry. Your themes will still work but your extensions might have to be updated.

Themes

All themes should be 100% backward compatible but there is one thing that has been deprecated. In the CommentView.ascx in your theme folder, you should replace

<%= ResolveLinks(Comment.Content) %>

With

<%= Text %>

You don’t have to if you don’t want to since the ResolveLinks method still exist. But it will be removed when the next version is released, so why not get it over with now.

Extensions

Extension builders have more events to write extensions for and some of the existing events have been upgraded to use a different EventArgs. You should check that your extensions work with the new CancelEventArgs used on Post.AddingComment and some other events. In most cases you can just swap EventArgs out for System.ComponentModel.CancelEventArgs and you’re good to go.

Happy holidays from the BlogEngine.NET team

Just before the release of BlogEngine.NET 1.3 we want to add an extension manager. It allows you to change settings and enable/disable the different extensions available. It's really cool and very useful, but we need your feedback on how to do it most optimal.

If you have any ideas in that regard, please comment on Ruslan's blog post about the subject. We really want to nail this feature. Thank you for your time.