Multiple Logon Login Issue - Movable Type 3.16 Breaks Root Installation

Submitted by Patrick Grote on Sun, 04/24/2005 - 2:40pm.

I should start a Movable Type category. Anyway, this morning I decided to upgrade my sites to Movable Type 3.16. It's been touted as a huge bug fix and that it was a simple drop in upgrade. Oh how I wish I hadn't done it ...

I updated my older sites from Movable Type 3.15 to 3.16 without any issues. Everything worked great.

The first sign of trouble was when I attempted to install a new Movable Type site on a new host. I am an old hand at installing Movable Type and have it down to a science. It takes me less than 5 minutes outside of transfer time to get it up and running.

This time it didn't work.

When I logged into Movable Type for the first time and entered the default username of Melody and password of Nelson everything looked good, but then I was bounced back to the logon screen when I went to edit the profile. Hmmm.

I logged in again. Clicked on the option to edit the profile. Same thing. At this point I thought maybe it was that option. No dice. Movable Type was forcing me to logon again no matter what I did.

I jumped onto the Movable Type Support forums and found a few threads related to this. A few complaints, but no solutions. Since I was putting this new installation on my new host I rationalized it was their issue. I spent about an hour bouncing back and forth with the new hosting support to no avail.

Then the brain really kicked in and I decided to put a fresh install of 3.16 on the other host that has my older accounts. Same issue.

So, this was the updated scorecard:

Old Host: Upgrade worked. New install didn't work.

New Host: New install didn't work.

I then opened a ticket with Six Apart and was pointed to this page where it discusses this known issue.

A new application method ("app_path") prevents the login cookie from being set when Movable Type is installed in the root folder, rather than a subfolder. The solution is to install Movable Type into a subfolder of the root instead.

It seems that Six Apart has decided to make their software more accessible to plugin authors, but at the same time break installations of their customers who installed Movable Type in the root directory. Interesting.

The issue occurs when a cookie is set when you logon to the administration panel. It works for my old sites since that cookie is already living, but if I use another browser without that cookie it reverts to the multiple logon issue.

Since this is a known issue I thought it might be addressed in the install document. I am not too proud to admit when I didn't RTFM:

The application
Choose where on your webserver you would like to install Movable Type. This is the location that you will use (from your web browser) when using the Movable Type system.

If you will be installing Movable Type into your cgi-bin directory, note that you will need to upload your static files--images, docs, styles.css, mt.js--into a directory outside of the cgi-bin. Static files cannot be left inside the cgi-bin, because the web server will try to execute them, rendering them unusable through the web interface.

A solution is to create a new directory in your web-accessible area called mt-static, then upload images, docs, styles.css, and mt.js into that directory. Note the URL corresponding to mt-static, because you will need to use it later when configuring the system in your mt.cfg file.

TIP: You can make your Movable Type installation more secure if you run the system under cgiwrap or suexec. See these tips on using cgiwrap or suexec to find out if you have either of these tools.

Ok, no mention at all of this issue in the installation document.

Does this seem like a smart move on Six Apart's side to do this? Sure, we all want more plugins, but to basically make your software unusable for a part of your installed base doesn't make sense.

Here is the bottom line:

Do not install Movable Type in the root. This isn't addressed in the documentation, so you may have already done this.
Do not lose your cookie. If you do you'll be forced to move your Movable Type installation to a subdirectory.
It is not a hosting issue. As much as folks in the Movable Type forums may suggest, this has nothing to do with hosting.

I'm a bit disappointed with this upgrade from Six Apart. How much testing was done on this and why wasn't this issue caught? Does a formal testing process exist at Six Apart?

And what about the solution? Notice on the known issues page there isn't a guide to moving your files to subdirectory. Will this be hard? Do I need a new install? Can I just copy everything?