Commonspot 10.5.2 Release Notes
Total Page:16
File Type:pdf, Size:1020Kb
CommonSpot 10.5.2 Release Notes Copyright 1998-2020 PaperThin, Inc. All rights reserved. About this Document 4 Platform Support Updates 4 Enhancements 5 ADF 2.5 5 Group Administration 5 Hooks 5 Images 5 QuickFind 6 Reports 6 Search Engines / Full Text Search 6 Search Performance 6 Security / Custom Authentication 6 See Also Reference 7 Notable Bug Fixes 8 API 8 Base Templates 8 Bookmarks and Anchors 8 Breadcrumb Element 8 Browsers - IE 11 8 Cache 8 Chrome Browser 9 CKEditor 9 ColdFusion 9 Container 9 Content Categories 9 Content Creation API (CCAPI) 9 Custom Element 9 Custom Metadata 10 Dashboard 10 Database Conversion Tool 10 Database Migration Tool 10 Datasheet 10 Display Template 11 Documentation / Help 11 Drivers 11 Elements 11 Email Handling 11 Formatted Text Block 11 1 Forms 12 Freshness Reminders 12 Images 12 Job Definitions 12 Left Pane (L-View) 12 Link Management 12 Local Custom Element 13 Login Error 13 Manage Keywords Dialog 13 Multi-section Element 13 Multimedia 13 My CommonSpot 13 Page Copy 13 Page Move 13 Page Properties 14 Page Rename 14 Page Sets 14 Permissions 14 Pop-up Menu 14 Rebuild Link References 14 Referring Pages 14 Render Handlers 15 Reports 15 Replication 15 Saved Search 15 Scheduled Jobs 16 Security 16 Search 16 SEO 16 Shared Database 16 Short Cuts 17 Simple Forms 17 Site Administration 17 Site Creation 17 Subsite Administration 17 Tabular Layout Element 17 Tree Navigation 17 Upgrade 18 Uploaded Documents 18 User Administration 18 Utilities 18 2 Visual Diff (Compare) 18 Work In Progress 18 Work Requests 19 Important Notes 19 Removal of Cookie Login option 19 Developers Guide Update 19 Upgrading with MySQL 19 Lucee Only Settings 20 Run Upgrade & Other Utilities 20 Full-Text Search 21 Style Sheet Considerations 21 Other Notes 22 Special Upgrade Offer 22 3 About this Document This document summarizes the following for the CommonSpot 10.5.2 release: ● E nhancements ● N otable Bug Fixes ● I mportant Notes (required reading) ● Special Upgrade Offer For detailed instructions about installing CommonSpot, see the current release of the CommonSpot Installation Guide . For detailed instructions about upgrading from a previous version of CommonSpot, see the current release of the CommonSpot Upgrade Guide . Review carefully all Pre-Upgrade instructions. NOTE : Before installing or upgrading to this release, review all other Release Notes documents from your current version of CommonSpot to this version. For example if you are upgrading from version 9.0, please refer to all CommonSpot 10.0.x Release notes, as well as the 10.5.x Release Notes. Platform Support Updates Release 10.5.2 of CommonSpot now includes support for the following: ● Adobe ColdFusion 2016 with updater 13 and above ● Adobe ColdFusion 11 with updater 15 and above ● Lucee ColdFusion version 5.3.3.62 ● Microsoft SQL Server 2017 (with Adobe ColdFusion 2018 and Lucee) ● Oracle 19c & 18c (with Adobe ColdFusion 2018 and Lucee) ● MySQL 5.7 and 8.0 ● Java providers other than Oracle ● JDK 11 ● Solr 8.2.0 ● Windows Server 2019 (with Adobe 2018 and Lucee 5.3.3) The following platforms are no longer supported: ● 'Native' Full Text Search (using the search engines provided with ColdFusion and Lucee) ● Lucee 5.2.9.31 Be sure to see the current T ech-Specs page for the most up-to-date information. 4 Enhancements Release 10.5.2 of CommonSpot includes the following e nhancements. ADF 2.5 ● To complement the robust security enhancements that have been added to CommonSpot 10.5.2 and 10.6.1, we are proud to release version 2.5 of the CommonSpot ADF (Application Development Framework). This ADF release includes notable enhancements, bug fixes and security protections, as well as updates to the ADF applications. Additional security protections have been added specifically to mitigate XSS and CSRF attacks. However, due to the flexibility and customizability of the ADF and ADF Applications, not all security features are enabled by default. Parts of the CSRF attack prevention validation must be enabled for AjaxProxy requests once all customizations have been enhanced to take advantage of this security feature. Please review the ADF 2.5 release notes, install and upgrade guide for more information regarding these enhancements at https://community.paperthin.com/projects/ADF/docs/release-notes/Release-Notes-v2-5.c fm Group Administration ● 23482-HF10.5.1.23 and 10.6.0 [not public] Added Company and Organization to the filter when searching for users in Add Users to Group dialog. Added select/deselect links in the dialog to select all or deselect all. Hooks ● Two new hook files are now supported for Uploaded Documents. pre-doccreate.cfm is called after the document has been uploaded but prior to processing the file and creating the appropriate CommonSpot records. post-doccreate.cfm is called after the document has been fully processed. Place either of the hooks files in the root subsite for global application or in a specific subsite or subsites, for more selective application. More details are available in the Developers Guide section 3.4. Images ● Image rendering was updated to remove non-style attributes, such as width, height, border etc. 5 ● Added the copy-down functionality for upload image dialog. This reduces the amount of typing when most of these fields usually contain the same text. QuickFind ● Templates and inactive pages are now returned in QuickFind results. Reports ● The full path to the page is now rendered on mouseover of links. Search Engines / Full Text Search ● Due to the limited functionality of the full-text search functionality provided by Adobe ColdFusion and Lucee, CommonSpot 10.5.2 eliminates support for the 'built-in' search engines. Full-text search may be implemented by installing either the full A pache Solr search engine (recommended) or by using CommonSpot's full-text search API to implement an interface to another search engine. Search Performance ● Performance improvements for “Search Results” element with large datasets. Where the source data was 18k rows, the time to return the search results was improved by a factor of 50. Please note that the Solr schema and search engine interface have been updated, so existing full-text collections will need to be rebuilt and any other customizations will need to be reviewed. Security / Custom Authentication ● CommonSpot has been enhanced to prevent CSRF (Cross-Site Request Forgery) vulnerabilities. All forms now include a private CSRF token. If you have custom code that submits to loader.cfm it must call it with a ‘CSRF_Token’ url parameter or form field. You can access the CSRF token by calling Server.CommonSpot.UDF.Security.getCSRF_Token(). ● This update eliminates three possible XSS attack vectors. Added ‘Mange Site Search’ permission within Site Administration to control access to Site Search settings. ● The ability to set Persistent Cookies for Auto Login has been removed. ● This fix restores CommonSpot's native behavior where the user is told that their account is expired. It leaves in place the behavior that custom authentication is told that the user is not authenticated (CSauthenticated=1). It adds a new CSaccountExpired attribute that is passed into the custom authentication call, so if that code wanted to do something different in that case, it could. If CSauthenticated is 0, meaning that the user is not authenticated, CSaccountExpired will be 1 if the reason for that is that their account is expired, otherwise CSaccountExpired is 0. 6 ● The 'Apply Permissions to Inherited Pages' option in 'Template Inheritance Security' has been removed due to the risk of serious, unintended side effects. ● Errors may be logged when certain mal-formed URLs are requested. ● In some scenarios, attempting to edit a page resulted in a 'Variable PAGEEDIT is undefined' error. ● Under certain circumstances, template security updates were not reflected in downstream pages. ● An error in a custom script may expose sensitive data via JavaScript. ● In replication configurations, custom element data may be different between the authoring and read-only servers (particularly for fields such as checkboxes which may be empty). ● Updated XML processing to protect against XML External Entity Injection. ● Updated command API and public components argument validation. Improved database error handling to prevent database errors showing on rendered pages. ● Closed security issues with XML processing. ● The Custom Authentication hook module has been updated to provide more flexibility when creating new users. You can now optional specify the contributor type (none, dedicated, shared or default), company, organization and email address of the user. ● Security was enhanced by rotating CFID/CFToken and CSRF tokens after login. See Also Reference ● It is now possible to define See Also References via the Advanced Search interface. 7 Notable Bug Fixes API ● Error messages for the API method Users.delete were incorrect and confusing. Base Templates ● Corrects error seen in the New Base Template dialog below the Dependencies box. ● Base Templates may not be rendered from within CommonSpot. Removed the hover link to open a base template in a new window, as it was not applicable. Bookmarks and Anchors ● Bookmarks and Anchors to the current page remained pointed to the current page when the page was copied. The links are now page relative. Breadcrumb Element ● The Breadcrumb element Display option 2 was updated from 'Site Name' to 'Subsite Name' for clarity. ‘Site Name’ was incorrect. Browsers - IE 11 ● The reported symptom was that after the completion of a CommonSpot install, an attempt to get into Server Administration failed with a JavaScript error. In IE 11, Microsoft provides a customized name for the industry standard "crypto" function, naming it instead "mscrypto". Not finding this function prevented Dashboard access. ● Corrects an issue where the Rich Text Editor would not save when using IE 11.