Upgrade Notes per Version

XperienCentral R52

Release date: June 28, 2026

XC-2458

As of R52, tables inserted on the canvas will receive a class rich-text-table when rendered on the frontend. This class can be used to style tables that were added to a content item using the inline richtext editor of XC.

XC-2726

In R52 the whole oEmbed feature has been removed. With this removal, also these API’s have been removed:

nl.gx.webmanager.cms.core.Website#getOEmbedPage,

nl.gx.webmanager.foundation.Utilities#getOEmbedService

nl.gx.webmanager.services.oembed.consumer.OEmbedConsumerService

nl.gx.webmanager.services.oembed.consumer.OEmbedException

nl.gx.webmanager.services.oembed.consumer.OEmbedProvider

nl.gx.webmanager.services.oembed.consumer.OEmbedResponse

In the upgrade notes, these instructions need to be added:

Remove the following Plugins from the Plugins panel:

• GX Webmanager - OEmbed providers

• GX WebManager - JAX-RS oEmbed Proxy

• GX WebManager - OEmbed Servlet

• GX WebManager - oEmbed Consumer Service

• GX WebManager - oEmbed Provider Service

Java 21 support

When you run on My SQL or MariaDB, you may need to change timezone settings. In Java 21 the way system timezones are handled works differently then in Java 17. When you do not explicitly set a timezone in the database configuration or JDBC URL using the connectionTimeZone parameter, XC may not start with this error in the Tomcat log:

To resolve this, there are two options;

1. Update the MySQL or MariaDB configuration to explicitly set the default timezone, using the default-time-zone parameter in your configuration file (i.e. my.ini). For example, add default-time-zone = "Europe/Amsterdam"

2. Update the JDBC URL in the Tomcat bin/server.xml. Ensure that this parameter is added to the JDBC URL: &connectionTimeZone=Europe/Amsterdam (update the timezone to your needs).

UI Redesign Custom panels

In R52, the Configuration Panels including the Spring MVC panels have been upgraded to the new UI design.

This will also affect custom panels, as changes have been made to the main.css file, which is likely also used by custom panels.

To upgrade a custom panel to the new design, follow these steps:

1. Ensure the following CSS files are imported:

NB: main.css must be imported before bui.css.

2. Review the custom panel and determine whether any UI fine-tuning is required.

Plain <script>-tags not allowed any more

Starting at R52 (and R50.1) no nonce will be added to plain <script> tags. It will only be added if the tag contains an attribute data-csp-token with a valid value, which is known server side and will be replaced by a nonce before the HTML is returned to the client. Without a nonce the client will not execute the script on the edit side. On the frontend it depends on the CSP configuration settings.

JSP(F) code

Replace <script with <wmedit:script. This will automatically add the necessary attribute and pass-on all attributes and the body (contents) of the tag.

Ensure the wmedit prefix is defined at the beginning of the file: <%@ taglib prefix="wmedit" uri="http://www.gx.nl/taglib/wmedit" %>

Attachment added by “services” (not Product Development): The attached zip file contains a Powershell and a Bash file that will execute the JSP changes for script tags as required:

Open

Java code generating HTML with <script> tags

Retrieve the token attribute using ContentSecurityPolicyFilterService.getCspToken() and add it to your tag.

Static HTML

<script> tags in static html files on disk are allowed without any token, also when served by the backend (/web).

Layouts

Plain <script> tags are still allowed in Layouts. That is the only place in the edit environment where they are allowed.

Jira issue: XC-2589

Escaping of Language Labels in <wm:text>

A new escapeTo mode <wm:text … escapeTo="richHtml" /> has been added. It will escape all sensitive characters, but keeps the following tags: <b>, <i>, <u>, <br>, <p>, <ul>, <ol>, <li>. There is no way any more to output unescaped <script> tags or other HTML apart from these tags.

Jira issue: XC-2578 (see Analysis)

XperienCentral R51

Release date: March 11, 2025

UI Redesign

The XC Edit Environment has received a complete visual overhaul in R51. With updated colors, fonts, and UI elements, XC offers a modern look and feel. To support these aesthetics, we have updated the underlying HTML and CSS architecture. These changes may impact custom elements, panels, and widgets; please follow the migration steps below to apply the new styling to your custom WCB components.

Updates for Page Presentations

To support the updated R51 UI, custom page presentations must now include two specific CSS files within the <head> section. These files ensure the Inline Editor renders correctly with the new design system and typography.

Required Assets

• design.css: Contains the updated core styling for the XC environment.

• mulish-fonts.css: Provides the Mulish typeface, the new standard font for R51.

Implementation

Append the following logic to the JSP responsible for rendering your HTML <head>. Note that these should only be loaded in incontext mode to avoid unnecessary overhead on the live site. The if was added in R50. Now link two more stylesheets in it:

Updated HTML Metadata Rendering Standards

To maintain visual consistency with the R51 design system, custom metadata (key-value pairs) must now follow a standardized table structure. By using the specific classes defined below, your labels and input values will automatically inherit the updated R51 typography, spacing, and alignment.

Required Structure

The metadata should be wrapped in a <table> with the widgetgrid class. Each row must distinguish between the label and the value using the propertiesLabel and propertiesValue classes:

Implementation Example

Icon Color Migration to R51 Palette

To maintain visual consistency with the new R51 design system, any custom icons defined for elements or content types must be updated. This ensures that custom assets align with the refined contrast and saturation levels of the core UI.

Color Mapping Table

Use the following table to map your existing R50 hex codes to their R51 equivalents:

Example

For a practical example of these R51 asset updates, refer to the wmamodularcontent bundle (included in the Modular Content Addon, version 5.0.5). The updated .png files can be audited in the following directory of the wmamodularcontent bundle: static/backend.

Updating Custom Content Type Icons

If you have defined custom icons for Modular Content Types within the Modular Content panel, these assets must be updated to maintain visual consistency with the R51 UI.

Using Default R51 Assets

If you prefer not to design custom icons, you can use the standard R51 icons found in the wmamodularcontent bundle:

• Small Icon: static/backend/modularcontenttype_small.png

• Large Icon: static/backend/modularcontenttype_large.png

Update Procedure

To apply new icons to your Modular Content Types, follow these steps:

1. Open the Modular Content panel.

2. Navigate to the Modular Content Types tab and locate your specific content type.

3. Deactivate the type by toggling the entry in the State column.

4. Select the content type to open the Details view.

5. Upload your new icons and click Save.

6. Re-activate the content type to push the changes live.

Prevent CSS Reset Collision with XC Edit Components

Global CSS resets (e.g., * { margin: 0; }) in custom components (designs, widgets, etc.) can inadvertently override the internal styling of Vaadin components within the XC Edit environment, leading to layout regressions such as collapsed margins or missing padding.

To resolve this without breaking your local design, update your global reset rule to exclude the vaadin-menu-bar-overlay tree using the :not pseudo-class. For example:

Furthermore, to prevent display issues, ensure that your custom styles do not conflict with the XperienCentral (XC) editorial environment's core CSS. You can maintain proper isolation by wrapping your custom design in a unique root ID or class and prefixing your CSS selectors accordingly to increase specificity.

Resolved: Global Scope Collisions in JavaScript

When opening a page, you might encounter a SyntaxError: Identifier 'X' has already been declared. This is caused by a namespace collision between different minified JavaScript libraries (such as Vaadin and third-party scripts) that accidentally use the same global variable names. To resolve this, we recommend isolating external scripts using ES modules (type="module") or loading them within an iframe to prevent global scope conflicts.

XperienCentral R50.1

Release date: July 3, 2026

Plain <script>-tags not allowed any more

Starting at R52 (and R50.1) no nonce will be added to plain <script> tags. It will only be added if the tag contains an attribute data-csp-token with a valid value, which is known server side and will be replaced by a nonce before the HTML is returned to the client. Without a nonce the client will not execute the script on the edit side. On the frontend it depends on the CSP configuration settings.

JSP(F) code

Replace <script with <wmedit:script. This will automatically add the necessary attribute and pass-on all attributes and the body (contents) of the tag.

Ensure the wmedit prefix is defined at the beginning of the file: <%@ taglib prefix="wmedit" uri="http://www.gx.nl/taglib/wmedit" %>

Attachment added by “services” (not Product Development): The attached zip file contains a Powershell and a Bash file that will execute the JSP changes for script tags as required:

Open

Java code generating HTML with <script> tags

Retrieve the token attribute using ContentSecurityPolicyFilterService.getCspToken() and add it to your tag.

Static HTML

<script> tags in static html files on disk are allowed without any token, also when served by the backend (/web).

Layouts

Plain <script> tags are still allowed in Layouts. That is the only place in the edit environment where they are allowed.

Jira issue: XC-2589

Escaping of Language Labels in <wm:text>

A new escapeTo mode <wm:text … escapeTo="richHtml" /> has been added. It will escape all sensitive characters, but keeps the following tags: <b>, <i>, <u>, <br>, <p>, <ul>, <ol>, <li>. There is no way any more to output unescaped <script> tags or other HTML apart from these tags.

Jira issue: XC-2578 (see Analysis)

XperienCentral R50

Release date: November 10, 2025

Anchor element removed

The Anchor element is no longer supported in the new editor and so all instances of the anchor element will be removed in the upgrade to this release. Instead, use the Heading Overview element which provides an automated anchor overview based on all existing headings. If you want to verify whether anchor elements are still being used in your deployment, run the following XPath query in the JCR Browser to retrieve all Anchor element instances:

//element(*, wo:ss_element_anchor)

Uninstall bundle “GX WebManager - Rich Text Editor”

Open Configuration / Plugis and uninstall the bundle “GX WebManager - Rich Text Editor”. This bundle is no longer used by XC.

Change CSP Directives

The new editor loads icons from an embedded font lumo-icons using a Data URL. In order to load those icons properly, the font-src directive must be updated to allow Data URLs as source. To do so, you can use the Content Security Configuration panel:

• Open Configuration / Content Security Configuration

• Select Styling / Font

• Check ‘Enabled’

• Check ‘Self’

• Check 'Data

• Press Apply

Add CSS to the head

The new editor requires a stylesheet to be added to the head of your custom presentations. Append this to your JSPs that render a full page:

Styling the new editor

The new editor automatically adds two extra <div> elements to the HTML when in Edit mode. This gives you full control over styling the inline editor’s components. For instance, if you want to change the background color of the cursor block that appears between two WCB elements, use the following CSS:

HTML differences in Edit Mode

When you edit content using the new Froala editor, the HTML used in the inline mode will slightly differ from the HTML that was used by the old editor. There are two important changes;

• Two extra div elements will be inserted inside editable areas in edit mode.

• Additionaldiv elements are placed around personalizations in edit mode.

Two extra div elements

In the new editor, two extra div elements will be inserted inside editable areas. Therefore, you may need to modify your CSS when it assumes that the rich text content being edited or rendered is a direct descendant of the editable area.

For example, consider the following editable tag in your presentation:

<wm:editable contentHolder="${contentHolder}" area="0" tag="div" class="content-wrapper"></wm:editable>

In the old editor, editing this editable area on an empty page would result in the following HTML:

However, when using the Froala editor, it results in two additional div elements like this:

These two additional div elements may affect styling. For example, when display:grid is set on the div with class content-wrapper like this:

In the old editor, display: grid was applied to the direct descendants of the outer div, which contained the rich text being edited. In the Froala editor however, the direct descendant of the outer div is the div with the fr-wrapper class, and display:grid will not be applied to the rich text being edited.

To resolve this issue, simply modify the CSS to be applied on the div with the fr-view class instead:

Known limitations in the new editor

The following limitations currently apply to the Froala editor but may be supported later on:

• Nesting quotes is currently not possible. So a quote may never have another quote inside it. The editor simply won’t allow it.

• It is currently not possible to merge two table cells, simply because you cannot select multiple table cells. The merge cells option is supported by the Froala itself, but not yet available in XC.

XperienCentral R49

Release date: August 14, 2025

This release does not include any upgrade notes; all changes are fully backward compatible.

XperienCentral R48

Release date: June 9, 2025

Update CSP header settings

During this upgrade, tighten the Content Security Policy (CSP) for styling if feasible. The following settings are recommended for most installations and will be the new defaults for future setups.

Content Security Configuration panel:

• CSS > Style: Enabled, Use nonce, Self

• CSS > Style Attribute: Enabled, Unsafe Hashes

• Integration > Object: Enabled, None - Automatically applied!

These settings will enhance the security of your installation by mitigating the risk of CSS-based attacks.

Background Information

Nonce for Style Tags: A random nonce will be included in the CSP header and injected into each <style> tag, enhancing security by preventing unauthorized style injections.

Hash for Style Attributes: A hash will be calculated for each style attribute and added to the CSP header, ensuring that only trusted styles are applied.

<object> and <embed> tags ignored: Were used in the past for embedding flash and videos.

Potential Issues

These settings may not work if libraries inject style tags and attributes. This is also why these settings are not applied to the XperienCentral edit environment.

Most Restrictive Settings

For maximum security, consider the following settings in the Content Security Configuration panel:

• CSS > Style: Enabled, Self

• CSS > Style Attribute: Disabled (uncheck all checkboxes)

• Integration > Object: Enabled, None

These settings prevent the use of all inline style tags and attributes, including those in Layouts.

Audit Trail Database Modification

In R45 we made some database modifications for the Audit Trail. In this version we make another modification to improve the loading times of the Audit Trail panel even further.

The application manager or a developer must execute one query on the database used to store the Audit Trail history. The query creates a new index. Creating the index is optional, but GX Software recommends that you do so. You can upgrade XperienCentral to version R48 without the new index.

Execute the following query on the database containing the Audit Trail:

CREATE INDEX timestmpContentIdIndex ON wmHistory (timestmp, contentId)

XperienCentral R46.1

Release date: April 18, 2025

Update CSP header settings

During this upgrade, tighten the Content Security Policy (CSP) for styling if feasible. The following settings are recommended for most installations and will be the new defaults for future setups.

Content Security Configuration panel:

• CSS > Style: Enabled, Use nonce, Self

• CSS > Style Attribute: Enabled, Unsafe Hashes

• Integration > Object: Enabled, None - Automatically applied!

These settings will enhance the security of your installation by mitigating the risk of CSS-based attacks.

Background Information

Nonce for Style Tags: A random nonce will be included in the CSP header and injected into each <style> tag, enhancing security by preventing unauthorized style injections.

Hash for Style Attributes: A hash will be calculated for each style attribute and added to the CSP header, ensuring that only trusted styles are applied.

<object> and <embed> tags ignored: Were used in the past for embedding flash and videos.

Potential Issues

These settings may not work if libraries inject style tags and attributes. This is also why these settings are not applied to the XperienCentral edit environment.

Most Restrictive Settings

For maximum security, consider the following settings in the Content Security Configuration panel:

• CSS > Style: Enabled, Self

• CSS > Style Attribute: Disabled (uncheck all checkboxes)

• Integration > Object: Enabled, None

These settings prevent the use of all inline style tags and attributes, including those in Layouts.

Note: These changes are not available in R47.

XperienCentral R47

Release date: March 3, 2025

Check Configuration Files

See Check Configuration Files.

Anchor Element

The Anchor element will be removed completely in XperienCentral R50. Instead, use the Heading Overview element which provides an automated anchor overview based on all existing headings. If you want to verify whether anchor elements are still being used in your deployment, run the following XPath query in the JCR Browser to retrieve all Anchor element instances:

//element(*, wo:ss_element_anchor)

Update License File

A new license file (usually named configuration.xml) is needed to run XperienCentral version R47. This updated license will be provided by GX Customer Services. The license file prepares your environment for the new rich text editor which will be introduced in stages in upcoming releases.

XperienCentral R46

Release date: December 2, 2024

Check Configuration Files

See Check Configuration Files.

Rebuild search index

Due to a change in the Search functionality, you must rebuild the content index and remove the work/search engine directory before starting the upgrade. Perform these steps before starting Tomcat with the new deploy:

1. Stop Tomcat if it is running.

2. Remove the directory <webmanager-root>/work/searchengine.

3. Remove the directory <webmanager-root>/work/contentindex.

As a result, the frontend search index will be empty after performing the upgrade. So make sure you rebuild the frontend index after performing the upgrade.

Solr replication

In R46 the SOLR version has changed from 9.5 to 9.7. If you are using SOLR replication this means the internal replication requests are now send via http/2 by standard. If the server running your XC environment don’t support (internal) http/2 requests you should add the -Dsolr.http1=true java option to your setenv.sh or setenv.bat.

jQuery Has Been Removed

In XperienCentral version R45 the Interactive Forms JavaScript files have been modified to remove the dependency on jQuery. This has a direct impact on any custom JavaScript implementations you have developed that listen for thrown events. There are two paths that you can take to rewrite your frontend code: either remove jQuery altogether from your own implementation (recommended!) or rewrite your custom code to still use jQuery. The following events are thrown by Interactive Forms which you have the ability to listen to in your own frontend code:

• IAF_ShowFormFragment

• IAF_HideFormFragment

• IAF_ShowError

• IAF_HideError

• IAF_SubmitForm

• IAF_AfterSubmit

• IAF_AjaxShowFormStep

• IAF_FormLoaded

• IAF_ClientSideFrameworkLoaded

For the following events, no changes have to be made if you keep using jQuery:

• IAF_ShowFormFragment

• IAF_HideFormFragment

• IAF_SubmitForm

• IAF_FormLoaded

• IAF_ClientSideFrameworkLoaded

If you do want to rewrite your custom JavaScript to not include jQuery, rewrite your code as follows:

Old situation:

New situation without jQuery:

The same applies for the other events.

For the following events changes have to be made regardless of whether you keep using jQuery or not:

• IAF_ShowError

• IAF_HideError

• IAF_AfterSubmit

• IAF_AjaxShowFormStep

In the old case these jQuery events had specific data which was added to them, but the way you have to retrieve this data has changed.