Movable Type Gets Security Update, Easier Downloads

Six Apart have announced an important security update recommended to all of its Movable Type (MT) users. Additionally, the new MT 3.35 — or MT 1.53 Enterprise — features an easier download and install process including the use of a wizard for first timers.

First and foremost, this release fixes the cross-site scripting (XSS) vulnerability that was found in the comment preview code. Specifically, default templates have been modified to include the encode_html=”1” attribute to properly escape user submitted data found in the “Comment Preview” system template. Users are required to apply this fix manually to any pre-existing blog they may have in their system.

1. Login to Movable Type
2. From the System Overview, click “Search and Replace” located in the right hand navigation menu.
3. From the search screen, click on the “Templates” tab.
4. Conduct a search for <$MTCommentPreviewAuthor$>
5. From the search results page, select the “Search and Replace” radio button
6. In the “Replace:” text field enter the following: <$MTCommentPreviewAuthor encode_html=”1”$>
7. Select all the templates displayed in the search results by clicking the checkbox next to each one.
8. Click the “Replace Checked” button.
9. Repeat steps 4-8 replacing <$MTCommentPreviewEmail$> with <$MTCommentPreviewEmail encode_html=”1”$>
10. Repeat steps 4-8 replacing <$MTCommentPreviewURL$> with <$MTCommentPreviewURL encode_html=”1”$>

Although this vulnerability affects a small percentage of MT users, it is a nasty bug and should be fixed ASAP.

Other fixes include the following:

• Fixed broken help links — Fixed an invalid documentation link found on Movable Type's “Log in to Movable Type” index.html page.

• Fixed MTDate tags to display correct timestamp under daylight savings — MTDate tags now publish properly adjusting for DST when using the “utc” attribute.

• SQLite BerkeleyDB to MySQL migration script fixed — Using the mt-db2sql.cgi and convert-db scripts to migrate from either BerkeleyDB or SQLite (respectively) to a SQL database may have resulted in garbled data. The bug has been fixed.

• 48741: convert-db sometimes garbles characters — Using convert-db to migrate from SQLite to SQL database may have resulted in garbled data. The bug has been fixed.

• Increased the size of “template_name” column — The length of the template name column has been increased to support the additional space that many localizations may need.

To compete with the other enterprise blogging platforms out there, (*cough* such as WordPress) MT has made the download and install easier for the first timer. The MT product download now doesn't require too much hunting nor does it require the user to have a TypeKey account.

Taking ease of install one step further, first time users will now be presented with the Movable Type Setup Wizard which will help them configure the platform on their web server. It asks them a few questions and then takes care of the rest, thus reducing the barrier to entry.

Keep an eye on this space as the players continue to seek out new users, and work to keep both the hackers and the spammers at bay.

Related Micro CMS Articles

• Results: Most Popular CMS in Technorati's Top 100
• Sweet Scalability: Its Memcached for .NET
• Movable Type 4.0 vs. Expression Engine 1.6
• Digitalus CMS: Open Source and (Mostly) Simple
• Silverstripe: Simple Content Management for Mum

Job Openings  View all | Post a job | RSS

• Internet Marketing Analytic Optimization at eBay
• Web Content Director at Bodybuilding.com
• New Media Manager (Social Media) at Citrix Online
• Web Graphic Artist at Cross Commerce Media
• Copywriter at Laserfiche
• Director of Mobile Applications at Barnes and Noble
• Senior IA / UX Designer at Fox Mobile Group
• Analyst, Serving Customer Intelligence Professionals at Forrester Research

Featured Events  View all | Add event | RSS

• Apr 21, 2010 – Drupalcon San Francisco 2010
• Apr 22, 2010 – AIIM International Expo 2010
• May 5, 2010 – CMS Expo 2010 (Evanston)
• May 6, 2010 – J Boye Philadelphia 2010
• May 20, 2010 – Gilbane Conference San Francisco