Movable Type Demo

Movable Type v5.14

2012-05-17T00:30:08Z

Six Apart launched a new movable type release today.

This new version called v5.14 includes one new features and an important number of bug fixes.

I'm glad to share with you that 3 bug reports of me have been converted into 3 fixes includes on this new release. More fixes from my side to come in the next versions.

New Feature

HeaderCacheControl

HeaderCacheControlconfiguration directive was introduced in Movable Type 5.14. If you set this directive in your mt-config.cgi, you can define how pages should be handled by caches.

Fixed Issues

IE9 RC: Unable to move category/folder on Manage Categories/Folders screen

IE9 RC: Unable to move widgets on Manage Entries/Pages screen

Template load error occurs when a plugin calls MT::Template::load_file with an invalid file path

key and index modifier of MTGetVar tag do not work in dynamic publishing

[patch] Always output by 'png' when make thumbnail file on dynamic

[patch] Got an error when doing validation in "Manage Folders" and "Manage Categories"

Error when saving a template on Template Preview screen

encode_xml does not remove invalid characters in XML

[patch] mt:Include is not cached in "memcached" environment

[patch] mt:Include that has "key" attribute gets an error in dynamic publishing.

[patch] mt:Include that has "key" attribute cannot be used in statically and dynamically at same time.

mt-search.cgi fails with IncludeBlogs=all after upgrade to MT-5.1

MTIfMoreResults can't work in dynamic publishing.

[patch] mt:MultiBlog that has no arguments overrides "local_blog_id" in dynamic publishing.

[Patch] General Settings doesn't display "Attribution-NonCommercial-NoDerivs" license name

MT5.1 Search code regressions

URL on Registration Notification is relative path.

Search and Replace Limited to 126 entries

Theme elements order required.

Memory Leak: Reblessed objects contain cyclic ref

"Request-URI Too Large" error occurs when restoring a backup file which contains a lot of assets

Thumbnail for file-type asset is not displayed on the search results screen for asset

MTInclude tag does not work with key modifier

Duplicated cache filename when using PHP SSI

MTArchiveList archive_type="Category-Daily" doesn't work under static publishing

Browsing Select a Blog Style screen generate styles.css template

Checkbox custom fields are not saved properly on Edit Entry screen in some situations

javascript error occurs in a list which is created by listing framework

MTIf doesn't work with a hash variable under dynamic publishing

Custom fields' data can be imported by entry import even if there are no custom fields in the blog

"Create Blog + Website Administrator" permission user cannot clone blog

FF5: can not go back to WYSIWYG mode after switching to HTML mode

Chrome: Malfunction when switching mode from HTML to WYSIWYG

IE9: Malfunction of text decoration in WYSIWYG mode

IE9: Can not insert item and image when WYSIWYG mode

IE8: When setting anchor link at web page edit on IE, [editor-content.html] is added unintentionally

Original relative URL is not preserved when we click the Link button.

no author ID record in mt_category when the blog are created by custom theme

Comment author disappears from the commenter list when he is unbanned

Cannot eject value in hash, while dynamic publishing

[Customfields] If you change the basename, data you entered will disappear

Doesn't display entries correctly when include_subcategories="1" and include_blogs="all" are configured.

Can't remove multiple filters at once

Styling : the display breaks when the category name is long

Unable to cancel deleting a comment properly on Edit Comment screen

MTCalendar month="this" doesn't work on published entry archive

Editor cannot add tags at System > Manage Assets

Community Blog's 'Powered by' widget does not show 'Powered by MT' icon

Cannot move to login screen after created a new blog with French

Other Changes

Update the CodeMirror from 2.16+patch to 2.22

Blog.pm's post_save() isn't treat extended table columns.

Category name which is created when choosing theme, gets translated according to language setting

[patch] The MultiBlog's plugin-data is loaded multiple times in dynamic publishing.

You could find out more details about this release at:

http://www.movabletype.org/2012/05/movable_type_514.html

Also, let me remind you that you could access the latest version by clicking on "v5x" from this Website header. Inside that page you will find the login URLs as well as the credentials to evaluate movable type v5.14 professional and/or open source.

Last, but not least, I'm available to upgrade your installation(s) and if you need another pair of hands.

Movable Type 5.13, 5.07, and 4.38 Security Updates

2012-02-23T01:41:52Z

It's always a pleasure for me to announce that Six Apart launches a new movable type release.

The pleasure is even higher when the update contains a combination of new features, bug fixes and isolated security issues.

There are almost 8 months from the previous release and many may have wondered if this product is further developed or not. Those that are aware of this place (http://bugs.movabletype.org) know that Six Apart Japan is working on every single day to make this product even better.

When movable type celebrated 10 years Jun Kaneko wrote a nice post called "Status of Movable Type development". In that post he was showcasing the number of fixed and implemented cases over time and clearly shows that the work on improving movable type is stronger than ever.

You could judge the amount of excellent work that has been done from this version release note.

Vulnerabilities' Fixes

The main thing that you should be aware of and the main reason to immediate upgrade your installation is that this version fixes multiple vulnerabilities which include:

OS Command Injection exists in the file management system, the most serious of which may lead to arbitrary OS command execution by a user who has a permission to sign-in to the admin script and also has a permission to upload files.
Session Hijack and CSRF exist in the commenting and the community script. A remote attacker could hijack the user session or could execute arbitrary script code on victim's browser under the certain circumstances.
XSS exists in templates where the variables are not escaped properly. A remote attacker could inject client-side script into web pages viewed by other users.
XSS exists in mt-wizard.cgi. This vulnerability was reported by Trustwave (Trustwave's SpiderLabs Security Advisory TWSL2012-002)

New Features

Supported Browsers

You may have learned on your skin that movable type v5.x didn't support Internet Explorer 9 as well as the latest versions of Firefox and Safari. Movable Type v5.13 is now compatible with all these browsers.

Security Enhancements

Movable Type considers security the main priority given the more and more attempts to exploit vulnerabilities across today's technologies.

What movable type adds to v5.13 in this respect is:

Account and IP Lockout
Account lockout is a feature to protect your Movable Type account from a password-guessing attack known as a brute force attack or a dictionary attack. Movable Type locks out accounts after defined number of incorrect password attempts.
Changing Password Validation Rules
A system administrator can set password validation policies to let users to use stronger passwords.
Stronger Password Encryption
I was myself signaling that movable type was recognizing only the first 8 characters of the password and that we need to make passwords stronger, now that there are so many *jerks* trying to penetrate various resources online.

Well, I'm delighted to announce that movable type v5.13 introduces a stronger password encryption algorithm which recognizes the password in its full length.

Six Apart also mentioned:

When you upgrade your installation from the older versions to 5.13, Movable Type users still can sign-in to the installation with the old passwords, but it is recommended to update their passwords to utilize this change.

Due to this change, the database column length of author_password was changed from 60 to 124.

Other Enhancements

In total there are 65 cases detailed at http://movabletype.fogbugz.com/ which are now part of this movable type v5.13 release.

You may like to take a look at them online at:

http://tinyurl.com/mt5-13

Movable Type Upgrade Consultant

Before closing let me remind you that I'm a movable type consultant available to upgrade your movable type installation, as well do any other movable type or web development work you might need.

Contact me from the contact page if you need a quote!

P.S.

As always, I've upgraded the movable type v4.x and v5.x installations available for online demo to the latest releases and you could access any of these installations from the top navigation menu (selecting "v4x" or "v5x").

Many thanks,

Mihai Bocsaru

More Vulnerabilities Fixed: Security Updates: All Movable Type v4.x and v5.x versions!

2011-06-28T18:15:42Z

As Jun Kaneko from Six Apart KK pointed out recently, his crew is working on auditing the core of this excellent publishing platform and would continue to come up with improvements and security fixes.

On June the 22nd Six Apart KK announced movable type v5.12, v5.06 and v4.37 as mandatory security updates mentioning that these updates resolve multiple vulnerabilities discovered in Movable Type 5.x and Movable Type 4.x and that all users must upgrade to this latest release immediately.

The impact of the vulnerabilities is described as:

Under certain circumstances, a user who has "Create Entries" or "Manage Blog" pemissions may be able to read known files on the local file system.

Go ahead and upgrade your installation right away or hire me to upgrade it on your behalf.

Find these releases available under the "v4x" and "v5x" pages from the top navigation.

Happy testing!

Security Updates: All Movable Type v4.x and v5.x versions!

2011-06-09T09:43:55Z

Today Six Apart KK announced movable type v4.361, movable type v5.11 and movable type v5.051 as mandatory security updates.

These updates resolve critical vulnerabilities discovered in Movable Type 4.x and Movable Type 5.x.

The impact of the vulnerabilities is that a remote attacker could create, read or modify the contents in the system under certain circumstances.

All users must upgrade to this latest release immediately.

N.B.

If you need help on upgrading your installation(s), I'm available.

Breaking News: Movable Type v5.1 is Live!

2011-05-25T23:22:16Z

It's such a pleasure for me to announce that today Six Apart KK released movable type v5.1.

This release is full of new features and things that you wouldn't have thought before!

I would say that it is one of the strongest releases so far, if not the strongest one.

Start from the slideshow available at:

http://www.slideshare.net/sakk/introducing-movable-type-51

Or read the new features and watch the slideshow from:

http://www.movabletype.org/documentation/beta/movable-type-51-beta.html

The release notes are available at:

http://www.movabletype.org/documentation/appendices/release-notes/movable-type-51-release-notes.html

Do you want to upgrade your project to movable type v5.1? If you do and you need another pair of hands, I'm available for consultancy on upgrading your installation.

Movable Type v5.1 is available for immediate online evaluation from:

http://www.movabletypedemo.org/v5x.html

Happy Blogging,

Mihai Bocsaru

Mandatory Security Updates: Movable Type v4.36 and v5.05

2011-05-25T23:04:07Z

Dear Friends,

Today movable type released movable type v4.36 and v5.05 as mandatory security updates.

If you are running movable type v4.35 upgrade it to v4.36, and if you are using movable type v5.0x upgrade it to v5.05.

In case you need somebody to upgrade your movable type installation, I'm available.

I've also upgraded movable type v4.x to v4.36. This release is available from:

http://www.movabletypedemo.org/v4x.html

Kind Regards,

Mihai Bocsaru

v5.1 RC4

2011-05-20T11:25:57Z

Within less than 48 hours from releasing v5.1 RC3, the wonderful SAKK team launches v5.1 RC4 which addresses a bug reported by a movable type v5.x user in the forum one week ago.

Nick and I tried to help the movable type user that signaled the issue and after debating a bit what the issue was, JunKaneko joined the conversation, reproduced the issue, opened a bug ticket and passed it to the QA team.

The conclusion was:

The root of the cause was a regex bug in Perl 5.8.x which was fixed in 5.10.0

http://search.cpan.org/dist/perl-5.10.0/pod/perl5100delta.pod#Regular_expressions_optimisations

To support 5.8.x with MT5.1, we changed the category filter of "Manage Entries" to an input filed instead of a pull-down menu. We would like to improve the usability in MT 5.1.1 (case 106204 ).

I'm pleased to announce that I've made this bug fix release available for evaluation at:

http://www.movabletypedemo.org/v5x.html

v5.1 RC3

2011-05-18T16:10:17Z

Jun Kaneko just announced movable type v5.1 RC3.

This is supposed to be the last RC version before the final v5.1 release would be launched.

It's again a pleasure for me to invite you to evaluate v5.1 RC3 on this initiative for absolutely no cost.

Start from http://www.movabletypedemo.org/v5x.html

Enjoy!

v5.1 RC2 is here

2011-04-27T22:56:42Z

Today Jun announced v5.2 RC2 and shortly after I've made it available for evaluation.

According to Jun's note this release includes several minor bug fixes and an improved French localization thanks to François.

Go ahead and evaluate this version from:

http://www.movabletypedemo.org/v5x.html

v5.1 RC1 ready for evaluation

2011-04-21T22:51:42Z

Everytime there is a new version of movable type released, I feel a great joy.

This joy is even higher when it is about movable type v5.1.

Why?

Because starting from movable type v5.1, the product would allow us to be as flexible as we've used to be until v5.x change the product architecture.

While v5.1 would continue the v5.x architecture, it would allow developers and clients the option to maintain the architecture from v4.x.

What is all this about?

It is about having a parent website in order to have a blog. This is the new architecture in v5.x and it is something that many people that are already having a blog don't like.

On the other hand, I like the v5.x architecture because it could allow people to have both a website and a blog in one go, by simply installing movable type v5.x.

Would you like to take a look at this release?

Go ahead and start your evaluation from here:

http://www.movabletypedemo.org/v5x.html

v5.1 beta4

2011-04-06T23:55:43Z

Movable Type v5.1 beta4 has just been launched!

I'm happy with this approach of issuing a couple of beta releases every few weeks, so that we could see the development progress.

Those interested on this release notes, could check:

http://www.movabletype.org/documentation/appendices/release-notes/movable-type-51-release-notes.html

Those that cannot wait to give this release a look would have to start from here:

http://www.movabletypedemo.org/v5x.html

v5.1 beta3 is here!

2011-03-24T19:19:23Z

Six Apart KK just announced movable type v5.1 beta3.

Curious to see it?

http://www.movabletypedemo.org/v5x.html

v5.1 beta2 is out!

2011-03-12T20:21:35Z

This is supposed to be the last beta before releasing v5.1.

Go ahead and give it a try from:

http://www.movabletypedemo.org/v5x.html

Remember that your feedback on this project is extremely important.

Evaluate it and if you notice any kind of problem file a bug report.

Breaking News: Introducing Movable Type v5.1 beta1, the strongest release so far!

2011-02-16T18:26:52Z

In the last 24 hours Jun Kaneko from Six Apart Japan announced the 1st beta of movable type v5.1.

This version introduces a bunch of features that as a developer I've been looking for over time.

Among the features that have been introduced, I would mention the possibility to drag and drop categories and custom fields, as well as the possibility to set custom fields display on a per category basis.

Developers know that on some projects we might need to display one or more custom fields only for a specific category.

When I've seen Jun's announcement I've been really shocked about how many features have been introduced in one go and so I must say it was worth waiting for this release.

Major changes in the architecture are expected for v5.2 when we would be again able to create a blog without a parent website (this was bugging developers like me from the very first day of v5.x).

I would close thanking Jun and his team for the great that they've made with this beta.

Go and check it out for yourself at:
http://www.movabletypedemo.org/v5x.html

Happy Testing!

Mandatory Security Upgrade: Introducing v4.35 and v5.04

2010-12-08T22:12:57Z

Following Jun Kaneko's announcement about a security update to movable type v4.x and v5.x, I am happy to officialize here movable type v4.35 version and movable type v5.04.

Jun mentioned that there are mandatory security updates for all users and that these updates resolve multiple vulnerabilities discovered in the two movable type series.

Remember that as a daily movable type consultant I'm available to upgrade your movable type installation.

Depending on which series you would like to evaluate, remember to go to v4.x or v5.x from the top navigation or sidebar pages tab.

Last, but not least, two screenshots for you, one for each series.

Movable Type v4.35 Upgrade Completed!

Movable Type v5.04 Upgrade Completed!

Happy Blogging,
Mihai Bocsaru

Movable Type Demo

Movable Type v5.14

New Feature

Fixed Issues

Other Changes

Movable Type 5.13, 5.07, and 4.38 Security Updates

Vulnerabilities' Fixes

New Features

Supported Browsers

Security Enhancements

Account and IP Lockout

Changing Password Validation Rules

Stronger Password Encryption

Other Enhancements

Movable Type Upgrade Consultant

More Vulnerabilities Fixed: Security Updates: All Movable Type v4.x and v5.x versions!

Security Updates: All Movable Type v4.x and v5.x versions!

Breaking News: Movable Type v5.1 is Live!

Mandatory Security Updates: Movable Type v4.36 and v5.05

v5.1 RC4

v5.1 RC3

v5.1 RC2 is here

v5.1 RC1 ready for evaluation

v5.1 beta4

v5.1 beta3 is here!

v5.1 beta2 is out!

Breaking News: Introducing Movable Type v5.1 beta1, the strongest release so far!

Mandatory Security Upgrade: Introducing v4.35 and v5.04

Remember that as a daily movable type consultant I'm available to upgrade your movable type installation.