Commonspot 10.6.1 Release Notes
Total Page:16
File Type:pdf, Size:1020Kb
CommonSpot 10.6.1 Release Notes Copyright 1998-2020 PaperThin, Inc. All rights reserved. About this Document 3 Platform Support Updates 3 Enhancements 4 ADF 2.5 4 Hooks 4 Images 4 Security / Custom Authentication 5 See Also Reference 5 Notable Bug Fixes 5 Accessibility 5 API 5 Approval 6 Base Templates 6 Bookmarks and Anchors 6 Breadcrumb 6 Cache 6 Chrome Browser 6 CKEditor 6 ColdFusion 7 Container 7 Content Categories 7 Custom Element 7 Custom Script 7 Database Migration Tool 7 Datasheet 7 Elements 8 Facebook Integration 8 Formatted Text Block 8 Freshness Reminders 8 Images 8 Left Pane (L-View) 8 Link Management 9 Multimedia 9 My CommonSpot 9 Page Properties 9 Page Rename 9 Page Sets 9 Permissions 10 1 Pop-up Menu 10 Referring Pages 10 Render Handlers 10 Replication 10 Saved Search 11 Security 11 Search 11 SEO 11 Shared Database 11 Short Cuts 11 Simple Forms 12 Site Administration 12 Social Media 12 Subsite Administration 12 Tabular Layout Element 12 Upgrade 12 Uploaded Documents 12 User Administration 13 Utilities 13 Work Requests 13 Important Notes 13 Removal of Cookie Login option 13 Developers Guide Update 13 Upgrading with MySQL 14 Lucee Only Settings 14 Multimedia 15 Run Upgrade & Other Utilities 15 Full-Text Search 15 Style Sheet Considerations 16 Other Notes 17 Special Upgrade Offer 17 2 About this Document This document summarizes the following for the CommonSpot 10.6.1 release: ● E nhancements ● N otable Bug Fixes ● I mportant Notes (required reading) ● Special Upgrade Offer For detailed instructions about installing CommonSpot, see the current release of the CommonSpot Installation Guide . For detailed instructions about upgrading from a previous version of CommonSpot, see the current release of the CommonSpot Upgrade Guide . Review carefully all Pre-Upgrade instructions. NOTE : Before installing or upgrading to this release, review all other Release Notes documents from your current version of CommonSpot to this version. For example if you are upgrading from version 9.0, please refer to all CommonSpot 10.0.x and 10.5.x Release notes, as well as the 10.6.0 Release Notes. Platform Support Updates Release 10.6.1 of CommonSpot now includes support for the following: ● Adobe ColdFusion 2018 with updater 7 and above ● Adobe ColdFusion 2016 with updater 13 and above ● Lucee ColdFusion version 5.3.3.62 ● Microsoft SQL Server 2017 (with Adobe ColdFusion 2018 and Lucee) ● Oracle 19c & 18c (with Adobe ColdFusion 2018 and Lucee) ● MySQL 5.7 and 8.0 ● JDK 11 ● Java providers other than Oracle ● Solr 8.2.0 ● Windows Server 2019 (with Adobe 2018 and Lucee) The following platforms are no longer supported: ● Adobe ColdFusion 11 ● Lucee 5.2.9 and 5.3.2.77 ● Windows Server 2008 ● SQL Server 2014 (for Lucee) ● MySQL 5.6.x ● Solr 5.x and 6.x ● Java JDK 8, 9 and 10 ● 'Native' Full Text Search (using the search engines provided with ColdFusion and Lucee) 3 Be sure to see the current T ech-Specs page for the most up-to-date information. Enhancements Release 10.6.1 of CommonSpot includes the following e nhancements. ADF 2.5 ● To complement the robust security enhancements that have been added to CommonSpot 10.5.2 and 10.6.1, we are proud to release version 2.5 of the CommonSpot ADF (Application Development Framework). This ADF release includes notable enhancements, bug fixes and security protections, as well as updates to the ADF applications. Additional security protections have been added specifically to mitigate XSS and CSRF attacks. However, due to the flexibility and customizability of the ADF and ADF Applications, not all security features are enabled by default. Parts of the CSRF attack prevention validation must be enabled for AjaxProxy requests once all customizations have been enhanced to take advantage of this security feature. Please review the ADF 2.5 release notes, install and upgrade guide for more information regarding these enhancements at https://community.paperthin.com/projects/ADF/docs/release-notes/Release-Notes-v2-5.c fm Hooks ● Two new hook files are now supported for Uploaded Documents. pre-doccreate.cfm is called after the document has been uploaded but prior to processing the file and creating the appropriate CommonSpot records. post-doccreate.cfm is called after the document has been fully processed. Place either of the hooks files in the root subsite for global application or in a specific subsite or subsites, for more selective application. More details are available in the Developers Guide section 3.4. Images ● Image rendering was updated to remove non-style attributes, such as width, height, border etc. ● Added the copy-down functionality for upload image dialog. This reduces the amount of typing when most of these fields usually contain the same text. 4 Security / Custom Authentication ● CommonSpot has been enhanced to prevent CSRF (Cross-Site Request Forgery) vulnerabilities. All forms now include a private CSRF token. If you have custom code that submits to loader.cfm it must call it with a ‘CSRF_Token’ url parameter or form field. You can access the CSRF token by calling Server.CommonSpot.UDF.Security.getCSRF_Token(). ● The ability to set Persistent Cookies for Auto Login has been removed. See Removal of Cookie Login in the Important Notes section below. ● Updated XML processing to protect against XML External Entity Injection. ● Updated command API and public components argument validation. Improved database error handling to prevent database errors showing on rendered pages. ● Closed security issues with XML processing. ● The Custom Authentication hook module has been updated to provide more flexibility when creating new users. You can now optional specify the contributor type (none, dedicated, shared or default), company, organization and email address of the user. ● An error in a custom script may expose sensitive data via JavaScript. ● In replication configurations, custom element data may be different between the authoring and read-only servers (particularly for fields such as checkboxes which may be empty). ● Security was enhanced by rotating CFID/CFToken and CSRF tokens after login. See Also Reference ● It is now possible to define See Also References via the Advanced Search interface. Notable Bug Fixes Accessibility ● Eliminated non lowercase values for input controls of type hidden. This complies with the WCAG 2.0 and 508 Accessibility standards. ● The submit control for Simple Form elements was updated for Accessibility standards. It is now of type=submit. API ● Error messages for the API method Users.delete were incorrect and confusing. 5 Approval ● An error may occur when rendering the "Changes Pending My Groups' Approval" section of "My CommonSpot", particularly if the site is using SQL Server. Base Templates ● Corrected an error seen in the New Base Template dialog below the Dependencies box. ● Base Templates may not be rendered from within CommonSpot. Removed the hover link to open a base template in a new window, as it was not applicable. Bookmarks and Anchors ● Bookmarks and Anchors to the current page remained pointed to the current page when the page was copied. The links are now page relative. Breadcrumb ● The Breadcrumb element Display option 2 was updated from 'Site Name' to 'Subsite Name' for clarity. ‘Site Name’ was incorrect. ● It may appear that the Breadcrumb element is rendering incorrectly if the Subsite Display Name field is chosen to render in the Breadcrumb and the” Display Name field is empty. This field is optional and may be left blank in Subsite Administration > Properties > Subsite Name. Cache ● When using the 'memCacheName' attribute with ct-render-named-element, the resulting cache was not cleared as expected when the specified element was updated. ● In some configurations, a new element added by a contributor in 'Edit' mode is not visible until published (or until the user switches to 'Author' mode). Chrome Browser ● Creating a new Registered URL did not refresh the dialog. The new item was not rendered until a manual refresh was performed. CKEditor ● Upon upgrading to CommonSpot 10.5.0,10.5.1 or 10.6.0 any customized Toolbar settings in Custom Element Formatted Textblock fields was set back to default settings upon ColdFusion or Lucee restart. 6 ColdFusion ● Rendering large pages may result in 'Failed to add HTML header' errors, particularly for Adobe ColdFusion installations. Container ● Fixed an issue where trying to edit a grid Row or grid-row-Column properties for a newly added grid row in the Container layout properties dialog was returning 'Row Index is Incorrect' error. Content Categories ● The factory description of some of the content categories was larger than was allowed to save. Adjusted maximum size of the description field so the content can be saved. Custom Element ● Custom Elements would sort numbers in some circumstances, as if they were text. ● A Custom Element cloned in Site Administration did not offer any Component Styles to customize. ● Errors may occur in element management if a custom field type name contains one or more spaces. ● Viewing custom element data in Author mode did not honor the sort of a Number column when using Adobe ColdFusion. Lucee was not affected. ● Custom Element in Reuse mode was sorting the Taxonomy field by the TaxonomyID instead of the Term name. ● Submitting a Custom Metadata form with an RTE field freezes on "Cleaning HTML..." Custom Script ● Custom script error output is now encoded to prevent any code in the custom script from running. Database Migration Tool ● Migration of data to a new database, under certain circumstances would fail to create all required tables. Datasheet ● There was an issue with the DataSheet Element > Edit Columns > DataSheet View Columns dialog. Columns added to the view were not displayed. 7 ● A Datasheet view name with an ampersand "&" in it would prevent adding or editing an action column.