Template changes in Movable Type 5.13, 5.07, and 4.38
As a result of security fixes in Movable Type 5.13, 5.06 and 4.38, some of the global templates and JavaScript template in each blog were updated. You need to refresh those templates to comment or to use Community features once you upgrade to Movable Type 5.13, 5.07, 4.38, or later version.
How to update your own theme ?
You need to update the JavaScript index template in your theme to make it compatible with 5.13, 5.07, and 4.38. If you have not customized the JavaScript index template, you can simply copy the JavaScript index template from Classic Blog theme bundled in 5.13, and replace the one in your theme.
The new JavaScript index template is exactly same in 5.13/5.07/4.38 and also same in the bundled themes. But it is incompatible with the earlier versions of Movable Type.
If you still see an error when commenting on your blog, please make sure that your comment form include sid parameter with input type=”hidden”.
<form method="post" action="<$mt:CGIPath$><$mt:CommentScript$>" name="comments_form" id="comments-form" onsubmit="return mtCommentOnSubmit(this)">
<input type="hidden" name="sid" value="" />
If your theme is based on Community Blog or Community Forum, you need to replace your global templates with the one bundled in 5.13.
Changes in JavaScript Index Template
JavaScript index templates in the bundled themes ( Class Website/Blog, Pico, Community Forum/Blog, Professional Website/Blog, Smart Blog) were updated.
- Updated in Movable Type 5.13, 5.07,and 4.38
- Require template refresh after upgrading.
- Updated:
- defaulttemplates/javascript.mtml
- themes/classicwebsite/templates/javascript.mtml
- themes/classicblog/templates/javascript.mtml
- themes/pico/templates/javascript.mtml
- addons/Community.pack/templates/global/javascript.mtml
- addons/Community.pack/templates/forum/javascript.mtml
- addons/Community.pack/templates/blog/javascript.mtml
- addons/Commercial.pack/templates/professional/blog/javascript.mtml
- addons/Commercial.pack/templates/professional/website/javascript.mtml
- smartblog/templates/javascript.mtml
Background
The change fixes a vulnerability in the session management. The new session management requires the following steps to get session_id safely.
- User signs-in to Movable Type with the User ID and Password.
- Movable Type returns one time token as the hash fragment in the URL.
e.g. the hash fragment is 0123456789abcdef in the following URL.
http://blog.example.com/2011/10/mypost.html#login0123456789abcdef - Browser send a request to <$mt:CommentScript$>?mode=userinfo with the one time token, and get a valid sessionid
Changes for the authentication plugins
<p>MT::Auth::handle_sign_in interface was changed. The handle_sign_in returned only a commenter object as the return value, but the new version returns commenter object AND a list of session object. If your plugin overrides handle_sign_in by inheriting MT::Auth class, you need to update the method to returns this new value. If not, Movable Type tries to maintain the compatibility by loading session object automatically, but this is not ideal from performance perspective.</p>
<h3>Changes when using Transformer to include plugin template</h3>
<p>You need to specify your plugin key with the component attribute.</p>
<pre class="prettyprint"><code class="language-html"><mt:Include name="PATH_TO_TEMPLATE_FILE" component="SamplePlugin">
Details
<div class="section" id="session_js">
<h4>session_js was obsoleted, use userinfo instead</h4>
<p>When processing sign-in with JavaScript, <strong>mode=session_js</strong> was obsoleted, and you need to use a new <strong>mode=userinfo</strong> instead. For example, this previous code should be replaced.</p>
<pre class="prettyprint"><code class="language-js">script.src = '<$mt:CGIPath$><$mt:CommentScript$>?__mode=session_js&blog_id=<$mt:BlogID$>&jsonp=' + cb + '&ts=' + ts;
</code></pre>
<p>With the new procedure, firstly, you need to get a user with mtGetUser()</p>
<pre class="prettyprint"><code class="language-js">var u = mtGetUser();
</code></pre>
<p>and then specify u.sid attribute to the mode=userinfo as following.</p>
<pre class="prettyprint"><code class="language-js">script.src = '<$mt:CGIPath$><$mt:CommentScript$>?__mode=userinfo&blog_id=<$mt:BlogID$>&jsonp=' + cb + '&ts=' + ts + '&sid=' + u.sid;
</code></pre>
Updated JavaScript methods
<p>Following methods were updated or added. Please refer to the new JavaScript index template for the changes.</p>
<ul>
<li>mtLoggedIn(ott)</li>
<li>mtRefreshUserInfo(sid)</li>
<li>mtSaveUserInfo (u)</li>
<li>mtInitCommenter ()</li>
<li>mtVerifySession(cb)</li>
</ul>
<h4>Other changes</h4>
<p>Added the following snippet in mtinit().</p>
<pre class="prettyprint"><code class="language-html"><mt:IfBlog>
<mt:IfRegistrationAllowed> mtInitCommenter(); </mt:IfRegistrationAllowed> </mt:IfBlog>
<p>In mtSignInOnClick() method, mtFetchUser() was replaced by mtSignIn().</p>
<p>In mtCommentOnSubmit() method, mtFetchUser('mtCommentSessionVerify') was replaced by mtVerifySession('mtCommentSessionVerify').</p>
<p>In mtCommentSessionVerify(), mtFetchUser('mtSetUserOrLogin') was replaced by mtSignIn(). And var u = mtGetUser(); was replaced by the following snippet.</p>
<pre class="prettyprint"><code class="language-js">if ( app_user && app_user.verified ) {
</code></pre>
<p>In mtShowGreeting(), user_link variable was updated as following.</p>
<pre class="prettyprint"><code class="language-js">user_link = '<a href="<$mt:CGIPath$><$mt:CommentScript$>?__mode=edit_profile&blog_id=<mt:BlogID>&return_url=' + encodeURIComponent( location.href );
</code></pre>
<p>In mt:IfRegistrationAllowed, The following JavaScript was removed.</p>
<pre class="prettyprint"><code class="language-js">/***
* If request contains a ‘#login’ or ‘#logout’ hash, use this to * also delete the blog-side user cookie, since we’re coming back from * a login, logout or edit profile operation. / var clearCookie = ( window.location.hash && window.location.hash.match( /^#_log(in|out)/ ) ) ? true : false; if (clearCookie) { // clear any logged in state mtClearUser(); if (RegExp.$1 == ‘in’) mtFetchUser(); } else { <mt:Ignore> /** * Uncondition this call to fetch the current user state (if available) * from MT upon page load if no user cookie is already present. * This is okay if you have a private install, such as an Intranet; * not recommended for public web sites! */ </mt:Ignore> if ( is_preview && !user ) mtFetchUser(); }
<p>In mtSetCookie() and mtGetCookie(), use encodeURIComponent() instead of escape().</p>
<pre class="prettyprint"><code class="language-js">var curCookie = name + "=" + encodeURIComponent(value) +
</code></pre>