New Features

1) Boilerplate

2) New Theme: "Rainier"

3) Movable Type Advanced

4) Other Features

Bug Fixes

• [104094] After changing the destination folder for published web page data, an old web page data still remains in the the old folder.
• [104665] The "maximum open cursors" occurs when using Oracle.
• [106224] An error will occur if the MT generated .htaccess file includes "SymLinksIfOwnerMatch", as multi-server hosting is not supported.
• [106534] Creation and deletion of the category archive page is not executed in appropriate timing.
• [107118] If Japanese is used with LDAPAuthURL, a user search will not work
• [108797], [108797] An error occurs on the user profile screen when building a community blog on Oracle or MS SQL Server.
• [107961] In Oracle and SQL Server, an error occurs when trying to destroy old session information.
• [107963], [107994] Request to enable use of custom field tags with archive mapping.
• [108513] If a thumbnail already exists for an image and MTAssetThumbnailURL is set to square="1", the image appearance is not updated, even after rebuilding.
• [108570] Request for the addition of an e-mail validation process when resetting a password.
• [108631], [108862] When user edit comments data from the search/replace screen, the keyword search option disappears from the input field.
• [108654] When there is a sub-domain input error, the error is displayed as originating from a different location.
• [108661] app.saveHTML() returns information currently displayed in the rich text editor.
• [108667] Please add the ecape=html value to the mt:CommentParentID tag, available for use in professional website and professional blog templates.
• [108718] The dynamic publishing MTWidgetSet tag ignores the blog_id setting.
• [108728] After upgrading from MT 3.38 to MT 5.2, users with the "send notification" option enabled will not be able to create new blog entries.
• [108730] When restoring MT from a back up file, multiple copies of the profile image will be restored as well.
• [108733] When operating in an environment running memcached, the template module cache will not be cleared at the specified time.
• [108734] The template cache will not be cleared after a new category is created.
• [108748] Incorrect HTML is generated from unlabeled item custom fields.
• [108799] When executing bulk user updates with CSV, even though the same user name is specified in the new user name input field, an error occurs.
• [108802] When Config Directive "SingleCommunity" is set to 0, the member's list in the Movable Type authenticated users folder will be displayed incorrectly
• [108803] When Config Directive "SingleCommunity" is set to 0, users with third party authentications, such as OpenID, will not be able to be removed from a blog.
• [108804] Although website administrative privileges are granted to a user group, users do not have access to blogs linked to those websites.
• [108805] When restoring from back up data, group member data is not restored.
• [108815] Code generated from custom fields with multiple lines of text will not be converted correctly
• [108824] When specifying a publishing path with BaseSitePath through Windows, an error will occur if case sensitivity is not specified.
• [108841] When using dynamic publishing, upper and lower case characters used in tag attributes are treated as completely different characters.
• [108845] If IncludeBlogs is set to "all", an error will occur in the blog search.
• [108846] An error will occur if IncludeBlogs or blog_id is not specified in the search form template.
• [108856] The error message for the Facebook commenter's plug-in should be revised
• [108858] StyleCatcher display breaks in the Apache+Starman environment.
• [108866] When using dynamic publishing, an error occurs when half-width alphanumeric characters are used to write folder or category names.
• [108872] MTArchiveTitle is output differently depending on whether dynamic or static publishing is used.
• [108876] Category and folder selection cannot be saved on FireFox16.
• [108877] An automated message should be displayed when a commenter's identity cannot be authenticated.
• [108891] Blog entries marked as "NO ENTRY" cannot be imported.
• [108901] Templates using the alt-tmpl directory, included with theme files, do not function correctly
• [108909] When ignoring the revision history, the latest blog entry author is displayed as the user who is currently logged in.
• [108920] MT doesn't hold Compose Settings when change the field basename
• [108924] Individual archive pages are not displayed when using dynamic publishing.
• [108946] Comment pagination does not work when running MT through PSGI.
• [108947] When using dynamic publishing, an error will occur if someone tries to view a website that does not have a blog.
• [108948] When using dynamic publishing with PHP5.4, the "Sign In" characters will not be displayed.
• [108953] When TAB data is inserted in the comment data, comment pagination will not work correctly.
• [108958] System privileges cannot be changed
• [108959] A template error will occur if "(" is set in a category modifier with MTEntries tags.
• [108967] The {{theme_static}} setting cannot be used in the StyleCatcher repository.
• [108982] After re-applying a theme, the theme thumbnail will not update.
• [108989] The MTMultiBlog tag does not work correctly in the blog entry list archive.
• [108999] Assets may not be correctly retrieved when importing data from WordPress.
• [109003] If a blog entry with an index template that is using the MTEntryCustomFields tag is saved and rebuilt, the value for all custom fields will be reset to the default value.
• [109004] Blog restoration can not be completed if a website does not exist.
• [109009] When specifying the BaseSitePath, case sensitivity is automatically turned on in Website Path field.
• [109022] When importing an exported blog entry that includes a blank custom field, a half-width character space is arbitrarily inserted as the value for the empty custom field.
• [109023] The user date archive (by year, month, week or day) is not displayed when using dynamic publishing.
• [109024] search_apis cannot be added through plugins.
• [109026] When using the external environment SMTP server, if an e-mail is sent to multiple recipients, the e-mail header will look strange.
• [109032] If a folder with sub-folders is deleted, the user will not be able to save changes.
• [109036] When executing bulk user updates with CSV, multi-byte e-mail addresses can be saved without error.
• [109038] When executing bulk user updates with CSV, a user name with over 85 full width characters can be saved without error.
• [109039] When executing bulk user updates with CSV, a user name with over 255 half width characters can be saved without error.
• [109055] When executing bulk user updates with CSV, even if a blog theme has not been saved, an error will not occur.
• [109097] Files that already exist cannot be renamed when using a Windows operating environment.
• [109105] When importing WordPress data, neither categories nor tags can be imported.
• [109112] The mteval modifier will work even if a value other than 1 is used.
• [109133] The numify modifier will cause output discrepancies between static and dynamic publishing.
• [109134] When the sanitize modifier is set to 0, an error will occur if dynamic publishing is used.
• [109149] When the environmental variable UserSessionCookieDomain is not set, the value for the domain of the cookie will not be generated correctly.
• [109156] An error will occur if an embedded custom field value is saved.

I'm very excited to see that Six Apart launched today Movable Type v5.2.

This release is a huge step forward from what you knew so far about movable type.

Apart from the many bug fixes introduced since v5.14, this release comes with a number of very useful new features.

The most important feature for me, my customers and the whole community is the fact that at my request Six Apart implemented an awesome feature on their new Rich Text Editor which automatically erases the garbage HTML formatting that was added so far to movable type when copy-and-pasting content from Ms Word.

Another feature that other folks, including me, insisted for is the ability to create tables, which is available as a stand along plugin for the new Rich Text Editor.

 This plugin could be found at:
https://github.com/movabletype/mt-plugin-table-feature-for-tinymce

Let me now list for you the another features that Six Apart mentioned on this new version announcement.

1. Corresponding nginx+PSGI

   Movable Type 5.2 can now be used under the nginx+PSGI environment. This allows us to provide support over a variety of server environments, such as cloud computing virtual servers, CMS servers and content servers.

2. New Rich Text Editor

   The new rich text editor is implemented based on TinyMCE; easy to use, easy to edit.

   • Creating and Publishing Entries
   • Creating and Publishing Pages

3. Sitepath restriction

   Sitepath restriction is now available. This feature is most effective for medium to large websites.

   • Sitepath restriction

4. SMTP Authentication

   In Movable Type 5.2, email notifications can now be sent using authenticated SMTP.

   • SMTP Authentication

5. Improved performance of custom fields; faster rebuilding times

   The performance of custom fields have been improved, and as a result, blog entries which have custom field's data can be rebuilt much faster than before.Along with these changes, general rebuilding rate for blog entries are now faster by 120%.

I'm glad to have contributed with feedback, perseverance and bug reports to the following features:

1. the automatic cleanup of MS Word HTML garbage after copying and pasting content from Ms Word;
2. the sitepath restriction;
3. custom fields improvements.

As always, you could evaluate movable type v5.2 on the very first day it was released by going to:
http://www.movabletypedemo.org/v5x/pro/cgi-bin/mt/mt.cgi
http://www.movabletypedemo.org/v5x/os/cgi-bin/mt/mt.cgi

Login with:
- username: demo
- password: testthis

You could find out a lot more information on Movable Type 5.2 checking out the links below.

• What's new in Movable Type 5.2
• Movable Type 5.2 Release Notes

Checking out the above resources you could discover also a bunch of new configuration directives.

Happy testing,
Mihai Bocsaru

• 108759 mt:SearchResults tag does not store localized blog_id in context stash
• 108754 Unable to sign in for commenting again once signing out
108758 Renaming basename of blog-level custom field can cause corruption of custom fields metadata
108756 Saving new custom field can result in corruption of existing custom field metadata

• 108701 Unable to sign out properly on the published page if blog domain is ip address
• 108651 Comment replies do not show up in author's profile page on mt-cp.cgi

• 108242 Sometimes unable to send a test email in wizard via SMTP Auth with SSL on Windows

New config directives

• Editor
• WYSIWYGEditor
• SourceEditor
• BulkLoadMetaObjectsLimit
• DisableMetaObjectCache
• BaseSitePath
• HideBaseSitePath

Modified config directives:

• ThemesDirectory
• AltTemplatePath
• SearchTemplatePath
• ThemeStaticFileExtensions

General Options

• Columns
• Rows
• Cell Padding
• Cell Spacing
• Alignment
• Border
• Width
• Height
• Class
• Table Caption

Advanced Options

• ID
• Summary
• Style
• Language Code
• Background Image
• Frame
• Rules
• Language Direction
• Border Color
• Background Color

1. Define Table Row Properties
2. Define Table Cell Properties
3. Insert Row Before, Insert Row After or Delete Row;
4. Insert Column Before, Insert Column After or Delete Column;
5. Merge Table Cells;
6. Split Merged Table Cells;
7. Show/Hide Guildelines/Invisible Elements.

It's a pleasure for me to announce that today Six Apart made available the 4th beta of movable type v5.2. This version contains a bunch of bug fixes.

Among them I would mention:

• Can not resize correctly when the format is "None" with IE
• Can not preserve editor height when the format is none
• Wrong order of the field on Edit Entry / Page Screen
• cms_pre_save.asset callback won't be called when items are uploaded
• Site path is set to blog path during upgrade from MT4.37 to MT5.2b2
• encode_xml doesn't handle some numeric character references correctly
• An error occurs when importing the data via WXRImporter
• Preferred archive type setting is broken when removing a template map which is marked as preferred archive type
• On listing screen, user can save filters in spite of it has wrong condtion
• Commnters disappear when an administrator unban banned them
• Config directive "SerchExcerptWords" doesn't work correctly
• An error occurs when there are unsupported image files on item dialogue
• With IE8, pubutton images on rich text editor will not back to oridnary status
• User filter will not be recovered correctly when blog's backup data is restored
• Daily archive will be rebuilt when webpages are saved
• cms_pre_save.asset will not be called when item files are uploaded
• With IE8, after pushing item isert button and cancel it, user cannot enter characters on rich text editor's screen
• Sytem information will not be displayd under the FastCGI environment
• Cannot clone blogs from system dashboard

Details on how to expand the Movable Type new Rich Text Editor are available here:

https://github.com/movabletype/Documentation/wiki/The-expansion-of-Movable-Type%E2%80%99s-Rich-Text-Editor

The table feature that I've been advocating for and that some other community members requested is now available and shipped as a plugin from:

https://github.com/movabletype/mt-plugin-table-feature-for-tinymce

Are you curious to give this beta a ride? Go ahead and test it from:

http://www.movabletypedemo.org/v5x/beta/pro/cgi-bin/mt/mt.cgi

ttp://www.movabletypedemo.org/v5x/beta/os/cgi-bin/mt/mt.cgi

Login with:

 - username: demo

 - password: testthis

More details are available here:

http://www.movabletype.org/2012/08/movable_type_52_beta_4.html

Many thanks,
Mihai Bocsaru

I'm pleased to announce and make available for you the launch of movable type v5.2 beta 1.

This version is a huge step ahead comparing to v5.14, or the other earlier versions.

I would say that it is the best version launched until now.

Why would I make such statements?

There are a bunch of reasons such as:

1) new RTE editor

Now only that this version includes a new Rich Text Editor, which is based on the popular tinyMCE editor, but this version introduces a major feature which is that it strips off the garbage that Ms Word adds to text editors when pasting text from it.

Forget about ugly stuff and garbage coding imported from Ms Word.

Forget about having to first copy from Ms Word and paste to Notepad in order to loose the formatting, then to copy from Notepad and paste to Movable Type and finally to add back the formatting from inside the movable type admin.

From now on you could safely copy and paste from Ms Word with your formatting applied to the text and what you would get on your site is a clean and beautiful HTML formatting.

I've advocated for this feature for my customers and the entire community and thanks to Six Apart this feature is now implemented.

Curious to see it with your own eyes?

Compare:

http://www.movabletypedemo.org/v5x/beta/sites/my-first-website/community_blog/2012/07/pasting-from-ms-word.html

and:

http://www.movabletypedemo.org/v5x/beta/sites/my-first-website-os/classic_blog/2012/07/pasting-from-ms-word.html

with this badly formatted text:

http://www.movabletypedemo.org/v5x/sites/demo_classic_website_pro/community_blog/2012/07/pasting-from-ms-word.html

2) site path restriction

This is another item that I've reported and advocated for and that Six Apart implemented.

I've seen it on my skin that people that create websites and blogs would need to have a base server path imposed so that they won't overwrite the root of the domain name where the movable type installation is available.

You don't want to know how many times I had to go inside the demo installations and change websites/blogs paths to point to a folder called "sites", because various users overwrote the movabletypedemo.org domain root.

If this happened to my soul project, I wanted to prevent it from happening to my customers or just to any other movable type users.

This feature was implemented on v4x and it is now implemented back from v5.2 beta1.

3) improved performance of custom fields

I've raised a good number of bug reports and of feature requests related to the custom fields feature.

Six Apart started to implement them for us. When all of them would be implemented, you would be very surprised of how many things you would be able to build up.

4) smtp authentication

You could now set movable type to send email notifications using SMTP over SSL.

5) nginx+PSGI support

Let me limit to quote what Six Apart mentioned about this:

"Nginx is a light web server which has recently come into the spotlight for its fast performance. PSGI (Perl Web Server Gateway Interface) is an interface that connects web applications and web servers. When used in combination with nginx, Movable Type can become lighter and run faster. "

Would you like to take a look at v5.2 beta 1?

Go ahead and do it from:

http://www.movabletypedemo.org/v5x/beta/pro/cgi-bin/mt/mt.cgi

http://www.movabletypedemo.org/v5x/beta/os/cgi-bin/mt/mt.cgi

Login with:

- username: demo

- password: testthis

Many thanks,

Mihai Bocsaru

Six Apart launched a new movable type release today.

This new version called v5.14 includes one new features and an important number of bug fixes.

I'm glad to share with you that 3 bug reports of me have been converted into 3 fixes includes on this new release. More fixes from my side to come in the next versions.

New Feature

HeaderCacheControl

HeaderCacheControlconfiguration directive was introduced in Movable Type 5.14. If you set this directive in your mt-config.cgi, you can define how pages should be handled by caches.

Fixed Issues

IE9 RC: Unable to move category/folder on Manage Categories/Folders screen

IE9 RC: Unable to move widgets on Manage Entries/Pages screen

Template load error occurs when a plugin calls MT::Template::load_file with an invalid file path

key and index modifier of MTGetVar tag do not work in dynamic publishing

[patch] Always output by 'png' when make thumbnail file on dynamic

[patch] Got an error when doing validation in "Manage Folders" and "Manage Categories"

Error when saving a template on Template Preview screen

encode_xml does not remove invalid characters in XML

[patch] mt:Include is not cached in "memcached" environment

[patch] mt:Include that has "key" attribute gets an error in dynamic publishing.

[patch] mt:Include that has "key" attribute cannot be used in statically and dynamically at same time.

mt-search.cgi fails with IncludeBlogs=all after upgrade to MT-5.1

MTIfMoreResults can't work in dynamic publishing.

[patch] mt:MultiBlog that has no arguments overrides "local_blog_id" in dynamic publishing.

[Patch] General Settings doesn't display "Attribution-NonCommercial-NoDerivs" license name

MT5.1 Search code regressions

URL on Registration Notification is relative path.

Search and Replace Limited to 126 entries

Theme elements order required.

Memory Leak: Reblessed objects contain cyclic ref

"Request-URI Too Large" error occurs when restoring a backup file which contains a lot of assets

Thumbnail for file-type asset is not displayed on the search results screen for asset

MTInclude tag does not work with key modifier

Duplicated cache filename when using PHP SSI

MTArchiveList archive_type="Category-Daily" doesn't work under static publishing

Browsing Select a Blog Style screen generate styles.css template

Checkbox custom fields are not saved properly on Edit Entry screen in some situations

javascript error occurs in a list which is created by listing framework

MTIf doesn't work with a hash variable under dynamic publishing

Custom fields' data can be imported by entry import even if there are no custom fields in the blog

"Create Blog + Website Administrator" permission user cannot clone blog

FF5: can not go back to WYSIWYG mode after switching to HTML mode

Chrome: Malfunction when switching mode from HTML to WYSIWYG

IE9: Malfunction of text decoration in WYSIWYG mode

IE9: Can not insert item and image when WYSIWYG mode

IE8: When setting anchor link at web page edit on IE, [editor-content.html] is added unintentionally

Original relative URL is not preserved when we click the Link button.

no author ID record in mt_category when the blog are created by custom theme

Comment author disappears from the commenter list when he is unbanned

Cannot eject value in hash, while dynamic publishing

[Customfields] If you change the basename, data you entered will disappear

Doesn't display entries correctly when include_subcategories="1" and include_blogs="all" are configured.

Can't remove multiple filters at once

Styling : the display breaks when the category name is long

Unable to cancel deleting a comment properly on Edit Comment screen

MTCalendar month="this" doesn't work on published entry archive

Editor cannot add tags at System > Manage Assets

Community Blog's 'Powered by' widget does not show 'Powered by MT' icon

Cannot move to login screen after created a new blog with French

Other Changes

Update the CodeMirror from 2.16+patch to 2.22

Blog.pm's post_save() isn't treat extended table columns.

Category name which is created when choosing theme, gets translated according to language setting

[patch] The MultiBlog's plugin-data is loaded multiple times in dynamic publishing.

You could find out more details about this release at:

http://www.movabletype.org/2012/05/movable_type_514.html

Also, let me remind you that you could access the latest version by clicking on "v5x" from this Website header. Inside that page you will find the login URLs as well as the credentials to evaluate movable type v5.14 professional and/or open source.

Last, but not least, I'm available to upgrade your installation(s) and if you need another pair of hands.

Vulnerabilities' Fixes

• OS Command Injection exists in the file management system, the most serious of which may lead to arbitrary OS command execution by a user who has a permission to sign-in to the admin script and also has a permission to upload files.
• Session Hijack and CSRF exist in the commenting and the community script. A remote attacker could hijack the user session or could execute arbitrary script code on victim's browser under the certain circumstances.
• XSS exists in templates where the variables are not escaped properly. A remote attacker could inject client-side script into web pages viewed by other users.
• XSS exists in mt-wizard.cgi. This vulnerability was reported by Trustwave (Trustwave's SpiderLabs Security Advisory TWSL2012-002)

New Features

Supported Browsers

Security Enhancements

• Account and IP Lockout

  Account lockout is a feature to protect your Movable Type account from a password-guessing attack known as a brute force attack or a dictionary attack. Movable Type locks out accounts after defined number of incorrect password attempts.
  
  

• Changing Password Validation Rules

  A system administrator can set password validation policies to let users to use stronger passwords.
  
  

• Stronger Password Encryption

  I was myself signaling that movable type was recognizing only the first 8 characters of the password and that we need to make passwords stronger, now that there are so many *jerks* trying to penetrate various resources online.

  
  

  Well, I'm delighted to announce that movable type v5.13 introduces a stronger password encryption algorithm which recognizes the password in its full length.

  
  

  Six Apart also mentioned:

  
  

  When you upgrade your installation from the older versions to 5.13, Movable Type users still can sign-in to the installation with the old passwords, but it is recommended to update their passwords to utilize this change.

  
  

  Due to this change, the database column length of author_password was changed from 60 to 124.

Other Enhancements

Movable Type Upgrade Consultant

Under certain circumstances, a user who has "Create Entries" or "Manage Blog" pemissions may be able to read known files on the local file system.