MovableType.org - Home for the MT Community tag:www.movabletype.org,2007-05-25://2 2012-05-19T07:59:55Z Professional Publishing Platform for Bloggers Movable Type Pro 5.13-ja This is an XML content feed. It is intended to be viewed in a newsreader or syndicated to another site, subject to copyright and fair use. Movable Type 5.14 tag:www.movabletype.org,2012://2.28510 2012-05-16T19:00:00Z 2012-05-19T07:59:55Z Movable Type 5.14 was released today. This is a bugfix release without new features. It does not contain any security fix. Details about the issues that were fixed can be found in the release note. 5.14 Release Note Download... Takeshi Nick Osanai http://smallworld.west-tokyo.com Movable Type 5.14 was released today. This is a bugfix release without new features. It does not contain any security fix. Details about the issues that were fixed can be found in the release note.

Download

(What is the difference?)

Installation/upgrade instructions

Note: if you purchased a Movable Type license you can also purchase our installation or upgrade service and have all the work done by our excellent support team.

]]> Movable Type 5.13, 5.07, and 4.38 patch to fix the plugin template load error tag:www.movabletype.org,2012://2.28138 2012-03-01T15:31:37Z 2012-05-16T08:23:13Z Note : This patch was updated on the 5th of March, 2012 after the initial release on the 1st of March. If you still see the "Template load error" after applying the initial patch, please download again and re-apply the... Jun Kaneko http://www.goodpic.com/ Note : This patch was updated on the 5th of March, 2012 after the initial release on the 1st of March. If you still see the "Template load error" after applying the initial patch, please download again and re-apply the patch.

Thanks to the community feedback, we found an issue in Movable Type 5.13, 5.07, and 4.38 Security Updates and created a patch to resolve it. Due to the more strict policy in 5.13, 5.07 and 4.38, some plugins produce the "Template load error". There are two ways to resolve this error:

  1. Fix your plugin to meet the security policy in 5.13 / 5.07 / 4.38.
  2. Apply the patch and enable AllowFileInclude configuration directive to moderate the strict security policy.

It is recommended to (1) fix the plugin because AllowFileInclude weakens the protection against malicious plugins and templates. Please do not forget to disable AllowFileInclude directive once you update your plugin to the fixed version.

Please refer to the following pages for details.

If you are not seeing this "Template load error" after your upgrade, you don't need to apply this patch. This patch will be included in the next release of Movable Type.

]]> Movable Type 5.13, 5.07, and 4.38 Security Updates tag:www.movabletype.org,2012://2.28065 2012-02-22T03:41:51Z 2012-03-29T02:48:55Z Movable Type 5.13, 5.07, and 4.38 were released as mandatory security updates. These updates resolve multiple vulnerabilities discovered in Movable Type 5.x and Movable Type 4.x. The vulnerabilities were found as a result of our internal security audit, except... Jun Kaneko http://www.goodpic.com/

Movable Type 5.13, 5.07, and 4.38 were released as mandatory security updates. These updates resolve multiple vulnerabilities discovered in Movable Type 5.x and Movable Type 4.x. The vulnerabilities were found as a result of our internal security audit, except the one reported from Trustwave (TWSL2012-003). All users must upgrade to this latest release immediately.

Impact

5.13, 5.07, and 4.38 address the multiple vulnerabilities including:

  • OS Command Injection exists in the file management system, the most serious of which may lead to arbitrary OS command execution by a user who has a permission to sign-in to the admin script and also has a permission to upload files.
  • Session Hijack and CSRF exist in the commenting and the community script. A remote attacker could hijack the user session or could execute arbitrary script code on victim's browser under the certain circumstances.
  • XSS exists in templates where the variables are not escaped properly. A remote attacker could inject client-side script into web pages viewed by other users.
  • XSS exists in mt-wizard.cgi. This vulnerability was reported by Trustwave (TWSL2012-003)

Solution

Please upgrade to the latest versions of Movable Type 4 or Movable Type 5.

  • Movable Type Open Source 4.38
  • Movable Type Open Source 5.07
  • Movable Type Open Source 5.13
  • Movable Type 4.38( with Professional Pack, Community Pack)
  • Movable Type 5.07( with Professional Pack, Community Pack)
  • Movable Type 5.13( with Professional Pack, Community Pack)
  • Movable Type Enterprise 4.38
  • Movable Type Advanced 5.13

Here are the release notes for this release.

Upgrading to Movable Type 5.13, 5.07, or 4.38

Download

You can download the latest packages from these sites ( What is the difference? ).

Firstly, follow the instructions found in Movable Type's upgrade guide to upgrade your Movable Type installation.

Refresh Templates

As a result of security fixes in Movable Type 5.13, 5.06 and 4.38, some of the global templates and JavaScript template in each blog were updated. You need to refresh those templates to comment or to use Community features once you upgrade to Movable Type 5.13, 5.07, 4.38, or later version. Please refer to the following documentation.

Here are the details of template changes.

Changes in Movable Type 5.13, 5.07, and 4.38

You can see the complete list of fixed bugs at this FogBugz page.

Following significant changes have been made in Movable Type 5.13, 5.07, and 4.38.

New features in Movable Type 5.13

Supported Browsers

Movable Type 5.13 supports the following browsers and versions.

  • Internet Explorer 9
  • Firefox latest
  • Safari latest

Security Enhancements

Movable Type 5.13 introduces the following security features.

  • Account and IP Lockout
    Account lockout is a feature to protect your Movable Type account from a password-guessing attack known as a brute force attack or a dictionary attack. Movable Type locks out accounts after defined number of incorrect password attempts.
  • Changing Password Validation Rules
    A system administrator can set password validation policies to let users to use stronger passwords.
  • Stronger Password Encryption
]]> Status of Movable Type development tag:www.movabletype.org,2011://2.26479 2011-10-08T15:00:00Z 2012-05-16T08:19:57Z Having moved our case tracking system to Fogbugz on-demand, one of our favorite features is its reporting function. You can see the current activity of Movable Type development with a variety of graphs and charts. I would like to introduce... Jun Kaneko http://www.goodpic.com/ Having moved our case tracking system to Fogbugz on-demand, one of our favorite features is its reporting function. You can see the current activity of Movable Type development with a variety of graphs and charts. I would like to introduce some of the highlights here.

Number of fixed and implemented cases

The following graph shows numbers of fixed bugs and implemented features since 2007 when we started to use Fogbugz. As you can see, it is more active than ever.

Number of fixed and implemented cases

I should also mention that this achievement includes a lot of contributions from the community which is also shown in the long list of the acknowledgments in 5.1 release notes.

You can check the live status if you have an account. If you don't, you can create an account to report a bug or send a feature request.

Number of open cases

You might wonder how the submitted cases are handled. The development team is reviewing new cases on every Thursday. And periodically we conduct "a big triage" to sweep remaining cases. The following graph shows the improvement in our product management.

Number of open cases

Now all the feature request cases have been reviewed and categorized in this product backlog page.

10th birthday of Movable Type

October is a special month for Movable Type. And especially this year, it is the 10th anniversary since it was born in 2001. Thank you for your continual support. We hope to be a further exciting platform for you to enjoy.

MT10th　birthday
]]> Bug Tracker maintenance completed tag:www.movabletype.org,2011://2.25085 2011-06-28T10:10:28Z 2012-03-31T10:45:49Z We have successfully migrated our Movable Type issue tracking system to the new location. The new URL is here. https://movabletype.fogbugz.com/ I hope that you will enjoy the newest FogBugz features ! The Movable Type issue tracking system ( Fogbugz )... Jun Kaneko http://www.goodpic.com/ We have successfully migrated our Movable Type issue tracking system to the new location. The new URL is here.

https://movabletype.fogbugz.com/

I hope that you will enjoy the newest FogBugz features !

The Movable Type issue tracking system ( Fogbugz ) is currently under maintenance.
We are moving this installation to the Fog Creeks' on-demand service, and it will be back next week. Please use Movable Type Forums to report bugs during this period.
Sorry for your inconvenience !

]]> Movable Type 5.12, 5.06, and 4.37 Security Updates tag:www.movabletype.org,2011://2.25027 2011-06-23T02:30:00Z 2012-05-21T05:43:39Z Movable Type 5.12, 5.06, and 4.37 were released as mandatory security updates. These updates resolve multiple vulnerabilities discovered in Movable Type 5.x and Movable Type 4.x. All users must upgrade to this latest release immediately. The impact of the vulnerabilities... Jun Kaneko http://www.goodpic.com/ Movable Type 5.12, 5.06, and 4.37 were released as mandatory security updates. These updates resolve multiple vulnerabilities discovered in Movable Type 5.x and Movable Type 4.x. All users must upgrade to this latest release immediately.

The impact of the vulnerabilities

Under certain circumstances, a user who has "Create Entries" or "Manage Blog" pemissions may be able to read known files on the local file system.

Versions Affected

  • Movable Type Open Source 4.x
  • Movable Type Open Source 5.x
  • Movable Type 4.x ( with Professional Pack, Community Pack )
  • Movable Type 5.x ( with Professional Pack, Community Pack )
  • Movable Type Enterprise 4.x

Solution

Please upgrade to the latest versions of Movable Type 4 or Movable Type 5.

  • Movable Type Open Source 4.37
  • Movable Type Open Source 5.06
  • Movable Type Open Source 5.12
  • Movable Type 4.37( with Professional Pack, Community Pack)
  • Movable Type 5.06( with Professional Pack, Community Pack)
  • Movable Type 5.12( with Professional Pack, Community Pack)
  • Movable Type Enterprise 4.37
  • Movable Type Advanced 5.12

Download

(What is the difference?)

Installation/upgrade instructions

Fixed issues

The following issues were fixed in MT5.12.

  • 106303 Published URL was changed after upgrading to 5.1x

The following issues were fixed in Movable Type 5.12, 5.06, and 4.37.

  • 106307 Permission error when saving custom fields settings without a system administration privilege
]]> Movable Type 5.11 and 5.051, 4.361 Security Updates tag:www.movabletype.org,2011://2.24920 2011-06-09T04:39:23Z 2011-06-23T02:46:24Z Movable Type 5.11, 5.051, 4.361 were released as mandatory security updates. These updates resolve multiple vulnerabilities discovered in Movable Type 5.x and Movable Type 4.x. All users must upgrade to this latest release immediately. The impact of the vulnerabilities... Jun Kaneko http://www.goodpic.com/ Movable Type 5.11, 5.051, 4.361 were released as mandatory security updates. These updates resolve multiple vulnerabilities discovered in Movable Type 5.x and Movable Type 4.x. All users must upgrade to this latest release immediately.

The impact of the vulnerabilities

A remote attacker could create, read or modify the contents in the system under certain circumstances.

Versions Affected

  • Movable Type Open Source 4.x
  • Movable Type Open Source 5.x
  • Movable Type 4.x ( with Professional Pack, Community Pack )
  • Movable Type 5.x ( with Professional Pack, Community Pack )
  • Movable Type Enterprise 4.x

Solution

Please upgrade to the latest versions of Movable Type 4 or Movable Type 5.

  • Movable Type Open Source 4.361
  • Movable Type Open Source 5.051
  • Movable Type Open Source 5.11
  • Movable Type 4.361( with Professional Pack, Community Pack)
  • Movable Type 5.051( with Professional Pack, Community Pack)
  • Movable Type 5.11( with Professional Pack, Community Pack)
  • Movable Type Enterprise 4.361
  • Movable Type Advanced 5.11

Download

(What is the difference?)

Installation/upgrade instructions

New features and fixed issues

Please see the release notes for new features and fixed issues in Movable Type 5.11, 5.051, and 4.361.

]]> Movable Type 5.1 and 5.05, 4.36 Security Updates tag:www.movabletype.org,2011://2.24742 2011-05-25T02:30:00Z 2012-05-02T06:17:46Z After three months of the beta testing, the official release of the Movable Type 5.1 is now ready to download. Movable Type 4.36 and 5.05 are also released as mandatory security updates. These updates resolve multiple vulnerabilities discovered in Movable... Jun Kaneko http://www.goodpic.com/ After three months of the beta testing, the official release of the Movable Type 5.1 is now ready to download. Movable Type 4.36 and 5.05 are also released as mandatory security updates. These updates resolve multiple vulnerabilities discovered in Movable Type 5.x and Movable Type 4.x.

About Movable Type 5.1

Introducing Movable Type 5.1
View more presentations from Six Apart KK

Please see the following links for details.

Movable Type 5.1 includes a lot of feedback, patches and contributions from our community. Thank you very much for all of your help !

Movable Type 4.36 and 5.05 Security Updates

The impact of the vulnerabilities

A remote attacker could execute arbitrary code in a logged-in users' web browser. A remote attacker could read or modify the contents in the system under certain circumstances.

Versions Affected

  • Movable Type Open Source 4.x
  • Movable Type Open Source 5.x
  • Movable Type 4.x ( with Professional Pack, Community Pack )
  • Movable Type 5.x ( with Professional Pack, Community Pack )
  • Movable Type Enterprise 4.x

Solution

Please upgrade to the latest versions of Movable Type 4 or Movable Type 5.

  • Movable Type Open Source 4.36
  • Movable Type Open Source 5.05
  • Movable Type Open Source 5.1
  • Movable Type 4.36( with Professional Pack, Community Pack)
  • Movable Type 5.05( with Professional Pack, Community Pack)
  • Movable Type 5.1( with Professional Pack, Community Pack)
  • Movable Type Enterprise 4.36
  • Movable Type Advanced 5.1

Special thanks to Alfasado, Eldar Marcussen and other reporters for reporting these security issues.

Download

(What is the difference?)

Installation/upgrade instructions

]]> Movable Type 5.1 RC4 tag:www.movabletype.org,2011://2.24674 2011-05-20T08:16:06Z 2011-05-25T02:56:06Z The Movable Type 5.1 RC4 is available to download. The case 106201 was fixed in this release. To try RC4: Downloading beta builds Downloading MTOS nightly builds Getting the source code from GitHub Movable Type 5.1 Release Notes ( RC4... Jun Kaneko http://www.goodpic.com/ The Movable Type 5.1 RC4 is available to download. The case 106201 was fixed in this release.

Please see FogBugz for all cases.

Reporting Bugs

Your feedback is important to get Movable Type 5.1 ready for the final release. Without your feedback, it is almost impossible for developers to test the software in all of the various conditions that might occur. So please don't hesitate to create a new case.

]]> Movable Type 5.1 RC3 tag:www.movabletype.org,2011://2.24652 2011-05-18T06:26:55Z 2011-05-20T08:19:59Z The Movable Type 5.1 RC3 is available to download now. To try RC3: Downloading beta builds Downloading MTOS nightly builds Getting the source code from GitHub Here is the release notes for Movable Type 5.1 RC3. There are couple of... Jun Kaneko http://www.goodpic.com/ The Movable Type 5.1 RC3 is available to download now.

Here is the release notes for Movable Type 5.1 RC3. There are couple of bugs (such as 106201) which have been reported recently, and we may roll another RC release shortly.

Please see FogBugz for all cases.

For more details:

Reporting Bugs

Your feedback is important to get Movable Type 5.1 ready for the final release. Without your feedback, it is almost impossible for developers to test the software in all of the various conditions that might occur. So please don't hesitate to create a new case.

]]> Movable Type 5.1 RC2 tag:www.movabletype.org,2011://2.24403 2011-04-27T04:00:00Z 2012-03-29T08:24:49Z The Movable Type 5.1 RC2 is available to download now. This release includes several minor bug fixes and improved French localization thanks to François. To try RC2: Downloading beta builds Downloading MTOS nightly builds Getting the source code from GitHub... Jun Kaneko http://www.goodpic.com/ The Movable Type 5.1 RC2 is available to download now. This release includes several minor bug fixes and improved French localization thanks to François.

Here is the release notes for Movable Type 5.1 RC2. Please note that minor cases are not listed here, please see FogBugz for all cases.

For more details:

Reporting Bugs

Your feedback is important to get Movable Type 5.1 ready for the final release. Without your feedback, it is almost impossible for developers to test the software in all of the various conditions that might occur. So please don't hesitate to create a new case.

We look forward to hearing from you !

]]> Movable Type 5.1 RC1 tag:www.movabletype.org,2011://2.24339 2011-04-21T04:35:15Z 2011-04-23T15:17:21Z The Movable Type 5.1 RC1 is now available to download. In Release Candidate 1, the development team has implemented all new features and fixed major bugs. If we don't find any new issues at the following regression test (and your... Jun Kaneko http://www.goodpic.com/ The Movable Type 5.1 RC1 is now available to download. In Release Candidate 1, the development team has implemented all new features and fixed major bugs. If we don't find any new issues at the following regression test (and your feedback is also crucial at this final momement), Movable Type 5.1 will be ready to ship around the end of May. Please check the 5.1 schedule wiki for updates toward the production release !

Here is the release notes for Movable Type 5.1 RC1. Please note that minor cases are not listed here, please see FogBugz for all cases.

For more details:

Reporting Bugs

Your feedback is important to get Movable Type 5.1 ready for the final release. Without your feedback, it is almost impossible for developers to test the software in all of the various conditions that might occur. So please don't hesitate to create a new case.

We look forward to hearing from you !

]]> Movable Type 5.1 Beta 4 tag:www.movabletype.org,2011://2.24147 2011-04-06T05:20:39Z 2011-04-06T05:21:49Z Movable Type 5.1 Beta 4 is available to download and test. Here is the release notes for Movable Type 5.1 Beta. Please note that minor cases are not listed here, please see FogBugz for all cases. Movable Type 5.1... Jun Kaneko http://www.goodpic.com/

Movable Type 5.1 Beta 4 is available to download and test.

Here is the release notes for Movable Type 5.1 Beta. Please note that minor cases are not listed here, please see FogBugz for all cases.

For more details:

Reporting Bugs

Your feedback is important to get Movable Type 5.1 ready for the final release. Please don't hesitate to create a new case.

]]> Movable Type 5.1 Beta 3 tag:www.movabletype.org,2011://2.24005 2011-03-24T06:00:00Z 2011-04-06T04:45:17Z We would like to express our deepest sympathy to those who have suffered loss on account of the terrible earthquake in Japan. It is our sincere hope that the afflicted areas may recover at the earliest time. Movable Type... Jun Kaneko http://www.goodpic.com/

We would like to express our deepest sympathy to those who have suffered loss on account of the terrible earthquake in Japan. It is our sincere hope that the afflicted areas may recover at the earliest time. Movable Type team in Japan have been collaborating with several local communities for the past years. Tohoku area is where MTDDC Meetup, this local support project first took place. We will continue our efforts toward the realization of recovery, constantly thinking of the people of Tohoku and neighboring areas.

Here is the release notes for Movable Type 5.1 Beta. The list now includes implemented, fixed and active cases. Please note that minor cases are not listed here, please see FogBugz for all cases.

For more details:

Reporting Bugs

Your feedback is important to get Movable Type 5.1 ready for the final release. Please don't hesitate to create a new case.

]]> Movable Type 5.1 Beta 2 tag:www.movabletype.org,2011://2.23721 2011-03-02T06:30:00Z 2011-03-13T16:40:05Z Movable Type 5.1 Beta 2 is available to download and test. The development team is actively working on the beta, and we have already implemented 120 cases, fixed 715 cases, and there are only 120 active cases remaining. Please join... Jun Kaneko http://www.goodpic.com/ Movable Type 5.1 Beta 2 is available to download and test. The development team is actively working on the beta, and we have already implemented 120 cases, fixed 715 cases, and there are only 120 active cases remaining. Please join the beta by

For more details:

Reporting Bugs

Your feedback is important to get Movable Type 5.1 ready for the final release. Without your feedback, it is almost impossible for developers to test the software in all of the various conditions that might occur. So please don't hesitate to create a new case.

We look forward to hearing from you !

]]>