XperienCentral R46

Release date: December 2, 2024

Check Configuration Files

See Check Configuration Files.

jQuery Has Been Removed

In XperienCentral version R45 the Interactive Forms JavaScript files have been modified to remove the dependency on jQuery. This has a direct impact on any custom JavaScript implementations you have developed that listen for thrown events. There are two paths that you can take to rewrite your frontend code: either remove jQuery altogether from your own implementation (recommended!) or rewrite your custom code to still use jQuery. The following events are thrown by Interactive Forms which you have the ability to listen to in your own frontend code:

• IAF_ShowFormFragment

• IAF_HideFormFragment

• IAF_ShowError

• IAF_HideError

• IAF_SubmitForm

• IAF_AfterSubmit

• IAF_AjaxShowFormStep

• IAF_FormLoaded

• IAF_ClientSideFrameworkLoaded

For the following events, no changes have to be made if you keep using jQuery:

• IAF_ShowFormFragment

• IAF_HideFormFragment

• IAF_SubmitForm

• IAF_FormLoaded

• IAF_ClientSideFrameworkLoaded

If you do want to rewrite your custom JavaScript to not include jQuery, rewrite your code as follows:

Old situation:

$(document).on('IAF_ShowFormFragment, '.formfragment', function(e) { ... });

New situation without jQuery:

document.addEventListener('IAF_ShowFormFragment', (e) => {
   const fragment = e.target;
   ...
});

The same applies for the other events.

For the following events changes have to be made regardless of whether you keep using jQuery or not:

• IAF_ShowError

• IAF_HideError

• IAF_AfterSubmit

• IAF_AjaxShowFormStep

In the old case these jQuery events had specific data which was added to them, but the way you have to retrieve this data has changed.

• IAF_ShowError: passes on error div ID and the errors

• IAF_HideError: passes on error div ID

• IAF_AfterSubmit: passes on data returned by XC

• IAF_AjaxShowFormStep: passes on form step data returned by XC

For these events you can apply the following changes to your code:

IAF_ShowError

Old situation:

$(document).on('IAF_ShowError', '.wmpform div', function(e, errorDivId, errors) { ... });

New situation with jQuery:

$(document).on('IAF_ShowError', '.wmpform div', function(e) {
   const errorDivId = e.detail.id;
   const errors = e.detail.errors;
   ...
});

New situation without jQuery:

document.addEventListener('IAF_ShowError', (e) => {
   const fragment = e.target;
   const errorDivId = e.detail.id;
   const errors = e.detail.errors;
   ...
});

IAF_HideError

Old situation:

$(document).on('IAF_HideError', '.wmpform div', function(e, errorDivId) { ... });

New situation with jQuery:

$(document).on('IAF_HideError', '.wmpform div', function(e) {
   const errorDivId = e.detail.id;
   ...
});

New situation without jQuery:

document.addEventListener('IAF_HideError', (e) => {
   const fragment = e.target;
   const errorDivId = e.detail.id;
   ...
});

IAF_AfterSubmit

Old situation:

$(document).on('IAF_AfterSubmit', '.wmpform', function(e, data) { ... });

New situation with jQuery:

$(document).on('IAF_AfterSubmit', '.wmpform', function(e) {
   const data = e.detail;
   ...
});

New situation without jQuery:

document.addEventListener('IAF_AfterSubmit', (e) => {
   const form = e.target;
   const data = e.detail;
   ...
});

IAF_AjaxShowFormStep

Old situation:

$(document).on('IAF_AjaxShowFormStep', '.wmpform', function(e, formStep) { ... });

New situation with jQuery:

$(document).on('IAF_AjaxShowFormStep', '.wmpform', function(e) {
   const formStep = e.detail;
   ...
});

New situation without jQuery:

document.addEventListener('IAF_AjaxShowFormStep', (e) => {
   const form = e.target;
   const formStep = e.detail;
   ...
});

Summary

• For IAF_ShowError, the e.detail is an object where e.detail.id is the error div id and e.detail.errors contains the errors

• For IAF_HideError, the e.detail is the same object as above, where only e.detail.id should be relevant, as e.detail.errors will be empty

• For IAF_AfterSubmit, e.detail is the response data object from the Form POST (same data as the old argument)

• For IAF_AjaxShowFormStep, e.detail is the identifier of the form step (same data as the old argument)

XperienCentral R45

Release date: September 10, 2024

Check Configuration Files

See Check Configuration Files.

Check Custom Media Item Code

If you implement a custom media item, you will most likely need to modify your custom media item controller. Usually, BeanUtils.copyProperties is used to copy properties from the media item version to your form backing object in YourCustomMediaItemController#formBackingObject and vice versa in YourCustomMediaItemController#onSubmit. However, since a media item itself doesn't have a presentation, the setPresentation and setPresentationVariant on MediaItemArticleVersionImpl now throws an UnsupportedOperationException. In XperienCentral versions R44 and lower, that method didn't do anything. To prevent this runtime exception from being thrown, you must explicitly omit these properties when you use BeanUtils to copy its properties.

For example, change;

BeanUtils.copyProperties(mediaItemVersion, myFormBackingObject);

to

BeanUtils.copyProperties(mediaItemVersion, myFormBackingObject, new String[ {"presentation", "presentationVariant"});

and change

BeanUtils.copyProperties(myFormBackingObject, mediaItemVersion);

to

BeanUtils.copyProperties(myFormBackingObject, mediaItemVersion, new String[]{"presentation", "presentationVariant"});

Audit Trail Database Modifications

In some cases, the Audit Trail panel can cause the XperienCentral environment to freeze up. This is caused by the out of control growth of some database tables related to the audit information that is collected and stored. To solve this problem, the application manager or a developer must execute two queries on the database used to store the Audit Trail history. These queries create two new indices. Creating the indices is optional but GX Software recommends that you do so. You can upgrade XperienCentral to version R45 without the new indices.

Execute the following two queries on the database containing the Audit Trail:

CREATE INDEX parentContentIdIndex ON wmHistory (parentContentId);
CREATE INDEX webIdActionContenttypeIndex ON wmHistory (webId, action, contenttype);

Deprecated Components

In XperienCentral version R45, a number of deprecated components have been removed. If you have custom code that makes use of any of these components, you must modify it. The following components have been deprecated/removed:

• All references to page models
• Deprecated/unused filters in web.xml:
  • XslFoFilter
  • XSLFoTransformer
  • MobileESPFilter
  • DeviceAtlasFilter
  • DeviceRedirectFilter
• The Mobile Toolkit module

XperienCentral R44

Release date: June 17, 2024

Check Configuration Files

See Check Configuration Files.

Image Maps

In XperienCentral R44 support for image maps has been removed. Any image maps that are still present when upgrading to R44 (or later) will be removed automatically.

Solr Index Replication

In XperienCentral versions R44 and higher, replication of the Solr index over multiple nodes in a cluster can now be done via the database. This improves index consistency and performance. When you enable Solr replication on a clustered environment selecting wmasolrsearch.replication_enabled in the General tab of the Setup Tool, you should also perform the following actions:

• The masterUrl property in the solrconfig.xml points by default to 127.0.0.1. Make sure that in your hosts file the IP address 127.0.0.1 is mapped to the actual hostname of the environment or you can update the solrconfig.xml manually to point to the local machine on every node.
• If you use a custom solrconfig.xml, do a diff on your custom version and the R44 version of solrconfig.xml before upgrading, note the changes and be sure to migrate them into your custom version.

Setenv Modifications

Regardless of whether or not you will use the new Solr index replication functionality described above, you need to modify your setenv.sh or setenv.bat by adding the following Java options:

-Dsolr.disable.shardsWhitelist=true
-Dsolr.disable.allowUrls=true

GraphQL Logging

By default, the GraphQL Java dependency is logging too much information. For this reason GX Software strongly recommends that you change the log level of this logger. Follow these steps:

Tomcat

Add the following line to the logging.properties file:

notprivacysafe.graphql.level=SEVERE

JBoss

Add the following lines to standalone.xml:

<logger category="notprivacysafe.graphql">
   <level name="SEVERE"/>
</logger>

Restart Tomcat/JBoss.

Includes in Presentations

The presentation include functionality has been removed in XperienCentral R44. If you use the <include> tag in your presentation's XML files, you must remove them.

Dependencies

XperienCentral R43

Release date: March 4, 2023

Check Configuration Files

See Check Configuration Files.

WebManagerAPI.getWrapper() Method Modification

In XperienCentral versions R42 and earlier, calling WebManagerAPI.getWrapper(ID, MediaTerm.class) returned a valid MediaTerm object if the given ID did not exist.  The only way to determine whether the requested MediaTerm actually existed was to do a null check on the name of the returned object. In XperienCentral versions R43 and later, a null object is returned by the method call itself, which may lead to NullPointerExceptions. Because this method is used by the wm:object tag, you need to modify any JSPs that call the getWrapper() method. For example:

<wm:object var="tag" objectId="XXX" objectType="nl.gx.webmanager.cms.mediarepository.MediaTerm" />
<c:if test="${empty tag.name}">
    ...
</c:if> 

should be changed to

<wm:object var="tag" objectId="XXX" objectType="nl.gx.webmanager.cms.mediarepository.MediaTerm" />
<c:if test="${empty tag}">
...
</c:if>  

Delete the formupload Directory

After upgrading to R43, delete all files from the form upload directory. The form upload directory is specified by the setting form_upload_directory in the General tab of the Setup Tool.

Add New Location for Presentation JSPs

In XperienCentral R43, the XperienCentral XSL stylesheets were combined into 1 new file. In the General tab of the Setup Tool, you need to add the new location /WEB-INF/project/nl.gx.product.wmpbasepresentation to the setting presentation_jsps_url in the section backend_system_settings. If your project does yet not contain /WEB-INF/project/ in the presentation_jsps_url, add /WEB-INF/project/nl.gx.product.wmpbasepresentation.

Remove Deprecated Plugins

After upgrading, remove the following plugins manually in the Plugins Management Console:

• Console plug-in
• Console ssh plugin support plug-in
• Apache Mina SSHD :: Core

XperienCentral R42

Release date: December 4, 2023

Check Configuration Files

See Check Configuration Files.

GraphQL API

The Jackson-core and Jackson-databind XML libraries used for XML serialization are now shipped and exposed by default using springmvc-servlet.xml. If any of your plugins uses one of these libraries, you can set the scope to provide and omit the version.

Spring MVC Upgrade

Spring MVC was upgraded from 3.2.18 to 5.3.30 in this release. If any of the controllers in your project directly or indirectly extend from nl.gx.webmanager.springmvc.controller.BaseWebmanagerController.java, you need to make a few adjustments to your code. Replace all instances of BindException with BindingResult in your controllers. The easiest way to do this is using search/replace in your IDE (case sensitive). Your import statements should still be valid because the package itself has not changed. It is also possible to do a global search/replace because BindException shouldn't be used outside of a Spring MVC controller.

For example:

@Override
public void onSubmit(HttpServletRequest request, HttpServletResponse response, Object command,
BindException errors, ModelAndView modelAndView) throws Exception
{ // your code here }

should be changed to

@Override
public void onSubmit(HttpServletRequest request, HttpServletResponse response, Object command,
BindingResult errors, ModelAndView modelAndView) throws Exception
{ // your code here }

addValidators

If your project has controllers that directly or indirectly extend from BaseWemanagerController, and this controller registers a validator through binder.addValidator(new ...Validator), change this to addValidator(new ...Validator). This method is present on BaseWebmanagerController.java. 

If you experience any compilation errors or other problems, please don't hesitate to contact your GX Software consultant.

Notes for Reusables

If your project uses reusables, those might need to be upgraded as well. For each reusable that your project uses, check whether it contains any controllers that directly or indirectly extend from BaseWebmanagerController and also whether they contain any instances of BindException. If they do, check whether there already exists an XperienCentral R42 or higher compliant version for this reusable at /wiki/spaces/GX/pages/25436300 (login required). If your controllers do not extend from BaseWebmanagerController, simply replace all instances of BindException with BindingResult as explained in the first paragraph above. After doing so and verifying that your reusable still works in your environment, release a new version of the reusable and refer to it at /wiki/spaces/GX/pages/25436300 (login required). Please don't remove the old version, instead specify that the old version is specifically intended for XperienCentral versions R41 and lower and that the new version is intended for XperienCentral R42 and higher.

Updated Dependencies

The javax.servlet dependency has been updated to version 4.0.1. You need to update your reusables to use this version of the javax.servlet dependency. In versions R42 and higher, XperienCentral no longer supports Tomcat 8.x because it contains javax.servlet 3.1.

Removed Dependency

The dependency org.apache.commons.lang has been removed. Use org.apache.commons-lang3 instead.

Moved Dependencies

The Maven dependency org.apache.httpcomponents.httpclient has been moved to org.apache.httpcomponents.client5. Use your IDE or check Github (https://github.com/apache/httpcomponents-client/tree/master/httpclient5/src/main/java/org/apache/hc/client5/http and https://github.com/apache/httpcomponents-core/tree/master/httpcore5/src/main/java/org/apache/hc/core5 ) to find the current position of each class. See also the migration guide for more details at https://hc.apache.org/httpcomponents-client-5.2.x/migration-guide/index.html.

Apache Solr

When using a custom solrconfig.xml, update the Lucene Match version to 9.8.0: 

<luceneMatchVersion>9.8.0</luceneMatchVersion>

XperienCentral R42 has been updated to Apache Solr version 9. After upgrading XperienCentral, manually rebuild both the backend and frontend indexes.

Highlighting

hl.method=unified is the new highlighting default in Solr versions 9.0.0 and higher. Use hl.method=original to switch back if needed.

Custom Indexable JCR Properties

When using custom indexable JCR properties when calling the JcrIndexPropertyService.addIndexedProperty method, you could experience issues when the values used in these properties exceed the limit of 256 characters. After upgrading, remove the custom property using the JcrIndexPropertyService.removeIndexedProperty method and re-add it to make sure the contents can be longer than 256 characters.

wmpformpresentation Plugin

The following files in the form presentation plugin have been minified and renamed. If you refer to these static files in your code, you will need to update these references accordingly:

• /static/wmpformpresentation/js/plugin/jquery.form-4.3.0.patched.js --> /static/wmpformpresentation/js/plugin/jquery.form-4.3.0.patched.min.js
• /static/wmpformpresentation/js/formutil.js --> /static/wmpformpresentation/js/formutil.min.js
• /static/wmpformpresentation/js/formvalidation.js --> /static/wmpformpresentation/js/formvalidation.min.js
• /static/wmpformpresentation/js/formvalidationbindings.js --> /static/wmpformpresentation/js/formvalidationbindings.min.js

XperienCentral R41

Release date: September 20, 2023

Check Configuration Files

See Check Configuration Files.

Rebuild the Content Index

Due to a change in the Search functionality, you must rebuild the content index. To do so, manually remove the <webmanager-root>/work/contentindex directory after the upgrade and allow it to be regenerated after restarting XperienCentral. Selecting contentindex_queue_empty_reindex in the Setup Tool is not sufficient.

YourKit Java Profiler

The YourKit Java Profiler has been removed from XperienCentral in version R41. If your deployment uses a custom implementation of YourKit, search for references in your deploy<x>.xml, settings<x>.xml and pom.xml files and remove them. 

Apache Derby

Apache Derby has been removed from XperienCentral in version R41. If your deployment uses a custom implementation of Derby, you must remove all references to it from your project.

jQuery

In this version of XperienCentral, jQuery has been reverted to version 3.5.1. 

XperienCentral R40

Release date: July 20, 2023

Check Configuration Files

See Check Configuration Files.

Best Practices for Strict Content Security Policy (CSP) Configurations

It is recommended that you no longer use event attributes like onclick and onsubmit in your HTML. This applies to both the front- and backend of XperienCentral. The reason is that a strict CSP will block these methods from executing. For example, code like this:

<input onclick="doSomething()" />

should be replaced by something similar to this:

<input id="myInput" />

<!-- this can either be in a separate file or inline, as we add a CSP secure nonce to inline scripts -->

<script>

document.getElementById('myInput').addEventListener('click', function() {
    doSomething();
})

</script>

This recommendation also goes for the wmedit tags like select and button. Sometimes attributes like onclick or onkeypress are added to the include of these tags and will be rendered on the input. This strategy will also no longer work with a strict CSP policy. In some cases, the onClick is located on a table row like in the example below. For situations like this, the fix is slightly different:

<c:forEach var="tableRow" items="${tableRow}">
...
   <tr onclick="doSomething(${someParameter})">
       ....
   </tr>
...
</c:forEach>

<c:forEach var="tableRow" items="${tableRow}"> 
   ...
   <tr class="tableRow" data-some-parameter="${someParameter}">
      ...
   </tr> 
   ... 
</c:forEach> 
<script type="text/javascript">
   const tableRows = document.getElementsByClassName('tableRow');

   for (let tableRow of tableRows) {
      let someParameter = tableRow.dataset.someParameter;
      tableRow.addEventListener('click', function () {
         doSomething(someParameter);
      });
   }
</script>

Guava is Replaced by Caffeine

In R40, the Guava Java-based library has been replaced by the Google Caffeine caching library. If your deployment makes use of Guava in custom code, you must modify it to use Caffeine.

XperienCentral Online Help Component

The Online Help component has been removed from XperienCentral in version R40. You must therefore modify any custom plugins that have a dependency on this component.

solrconfig.xml

The luceneMatchVersion in any custom solrconfig.xml files should be updated to version 8.11.2.

XperienCentral R37.1

Release date: July 10, 2023

Check Configuration Files

See Check Configuration Files.

Best Practices for Strict Content Security Policy (CSP) Configurations

It is recommended that you no longer use event attributes like onclick and onsubmit in your HTML. This applies to both the front- and backend of XperienCentral. The reason is that a strict CSP will block these methods from executing. For example, code like this:

<input onclick="doSomething()" />

should be replaced by something similar to this:

<input id="myInput" />

<!-- this can either be in a separate file or inline, as we add a CSP secure nonce to inline scripts -->

<script>

document.getElementById('myInput').addEventListener('click', function() {
    doSomething();
})

</script>

This recommendation also goes for the wmedit tags like select and button. Sometimes attributes like onclick or onkeypress are added to the include of these tags and will be rendered on the input. This strategy will also no longer work with a strict CSP policy. In some cases the onClick is located on a table row like in the example below. For situations like this, the fix is slightly different:

<c:forEach var="tableRow" items="${tableRow}">
...
   <tr onclick="doSomething(${someParameter})">
       ....
   </tr>
...
</c:forEach>

<c:forEach var="tableRow" items="${tableRow}"> 
   ...
   <tr class="tableRow" data-some-parameter="${someParameter}">
      ...
   </tr> 
   ... 
</c:forEach> 
<script type="text/javascript">
   const tableRows = document.getElementsByClassName('tableRow');

   for (let tableRow of tableRows) {
      let someParameter = tableRow.dataset.someParameter;
      tableRow.addEventListener('click', function () {
         doSomething(someParameter);
      });
   }
</script>

Angular and CSS Styling

Beginning in XperienCentral R39.0, GX Software recommends that you prevent Angular panels from rendering inline CSS styling. You should configure your Content Security Policy to block this. In Angular version 12, the so called "critical CSS" is rendered inline by default. This can be changed easily by setting the inlineCritical option in your build to false. For more information see [https://0xdbe.github.io/AngularSecurity-DisableInlineCriticalCSS/].

Password Requirements

The password strength requirements have been modified in XperienCentral R39. A password must now contain 12 or more characters. While existing passwords will still work after upgrading to R39, GX Software recommends that you encourage your users to change their password after upgrading.

XperienCentral Online Help Component

The Online Help component has been removed from XperienCentral in version R37.1. You must therefore modify any custom plugins that have a dependency on this component.

XperienCentral R39

Release date: April 6, 2023

Check Configuration Files

See Check Configuration Files.

Filename Changes

The following files have been modified in this version of XperienCentral. If you have custom code that references the following files by name, you must modify your code to pick up these changes.

<xperiencentral-root>/webmanager-wcbs/webmanager-interactive-forms/wmpformpresentation/src/main/resources/presentationtype/static/wmpformpresentation/js/plugin/:

• jquery-ui-1.13.1.min.css is now jquery-ui-1.13.2.min.css
• jquery-ui-1.12.1.min.js is now jquery-ui-1.13.2.min.js
• jquery-form-4.2.0.js is now jquery.form-4.3.0.patched.js

<xperiencentral-root>/webmanager/webmanager-webapps/webmanager-backend-webapp/src/main/webapp/js/library/jquery/:

• jquery.form.js is now jquery.form-4.3.0.patched.js
• jquery-3.5.1.min.js is now jquery-3.6.1.min.js
• jquery-ui-1.13.1.min.js is now jquery-ui-1.13.2.min.js

Angular and CSS Styling

Beginning in XperienCentral R39.0, GX Software recommends that you prevent Angular panels from rendering inline CSS styling. You should configure your Content Security Policy to block this. In Angular version 12, the so called "critical CSS" is rendered inline by default. This can be changed easily by setting the inlineCritical option in your build to false. For more information see [https://0xdbe.github.io/AngularSecurity-DisableInlineCriticalCSS/].

Java Min/Max Version

In XperienCentral R39, Java 17 is the minimum and maximum supported version.

Password Requirements

The password strength requirements have been modified in XperienCentral R39. A password must now contain 12 or more characters. While existing passwords will still work after upgrading to R39, GX Software recommends that you encourage your users to change their password after upgrading.

Remove the XML Parser Plugin

After upgrading to XperienCentral R39, you should manually remove the "GX WebManager - XML Parser" plugin to avoid errors in the log. See Plugins Management Console.

The wmedit: button tag

The wmedit:button tag in JSPs now has a required id attribute. Any custom functionality that uses this tag should be updated to provide a unique ID value.

Content Security Policy configuration

A Content Security Policy is used to let the user's browser know from which location resources like Javascript or CSS can be loaded. XperienCentral now supports the configuration of a CSP within XperienCentral itself. Configuration takes places via the Content Security Configuration panel, found in the main menu under Application Tools.

Disabling the Content Security Policy Filter

The filter that adds both the CSP header and the nonces (if applicable) can be bypassed when starting XperienCentral. This can be used if the CSP is configured on Apache HTTPD for example or when you are accidentally locked out of XperienCentral due to a CSP misconfiguration.

For more information on Content Security Policy configuration see https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Changes in xslStyleSheet

In R39, an extra XSL template for wm-hostname-prefix has been added added in xslStyleSheet.jspf. If you use a custom implementation of this file, make sure to add this extra template to the stylesheet.

<xsl:template match="wm-hostname-prefix" name="wm-hostname-prefix">
   <xsl:choose>
      <xsl:when test="count(/root/system/headers/header[name = 'x-forwarded-prefix']) &gt; 0">
         <xsl:value-of disable-output-escaping="yes" select="/root/system/headers/header[name = 'x-forwarded-prefix']/value" />
      </xsl:when>
      <xsl:when test="count(/root/system/headers/header[name = 'X-Forwarded-Prefix']) &gt; 0">
         <xsl:value-of disable-output-escaping="yes" select="/root/system/headers/header[name = 'X-Forwarded-Prefix']/value" />
      </xsl:when>
   </xsl:choose>
</xsl:template>

XperienCentral R38

Release date: October 28, 2022

Check Configuration Files

See Check Configuration Files.

Interactive Forms File Name Changes

• The file static/wmpformpresentation/js/jquery.form.js was renamed to static/wmpformpresentation/js/plugin/jquery-form-4.2.0.js.
• The file static/wmpformpresentation/css/plugin/jquery-ui.min.css was renamed to static/wmpformpresentation/css/plugin/jquery-ui-1.13.1.min.css.

If you have custom code that uses these files, you need to modify your code to pick up these name changes. These name changes are only relevant for projects that do not use the default formsHeadTag.jsp.

Shared languages

In XperienCentral version R38, language labels are no longer implicitly shared between channels. When you want to keep sharing the labels of a specific language between 2 channels, perform the following steps before upgrading to R38:

1. Open the JCR Browser and navigate in the "JCR Tree" tab to the /wm:webmanager/wm:websites/wo:webinitiatif[{_}n{_}]/wo:wm_registry node where wo:webinitiatif[{_}n{_}] represents the channel that will receive the shared language labels.

2. Click [Edit] by the wo:language property and remove the language you want to share. In order to find out which of the shown UUIDs represents that language, execute the following query in the JCR Browser:
   
   

   //element(*)[@jcr:uuid='<the uuid of a language>'] 

3. Share the language between the 2 channels by following the steps on https://gxsoftware.atlassian.net/wiki/display/PD/Multiple+Channels#MultipleChannels-sharing_contentSharingContent.

Upgrading to R38 has no impact when a language was already shared in the way described above.

XperienCentral R37

Release date: August 24, 2022

Check Configuration Files

See Check Configuration Files.

Interactive Forms Form Fragment API

The API for form fragments was changed in R37. The getValue method, which retrieves the value of the form fragment itself, used to return an unescaped and therefore unsafe value of a form fragment. In R37, this method has been updated to always return a safe value. To retrieve the unescaped value of a form fragment, the new method getRawValue can now be used.

Interactive Forms form.tag file

The file form.tag has been changed in R37. If you use a custom version of form.tag in your XperienCentral deployment, you need to add the following line between the <form> tags:

<input type="hidden" name="pageid" value="${presentationcontext.page.id}" />

Search & Retrieve API

The setting contentindex_index_readonly_nodes has been added to the application_settings section of the General tab of the Setup Tool. If the Search & Retrieve API is used on a clustered environment, this setting should be enabled, otherwise the API will not return any results. When this setting is enabled the content index should also be rebuilt.

XperienCentral R36

Release date: June 15, 2022

Check Configuration Files

See Check Configuration Files.

SEO Updates

In R35 and earlier, the application_settings.friendly_url_extension setting was used to determine whether a URL is friendly. In R36 and higher, it's possible to leave the friendly URL extension empty which calculates friendly URLs without extensions. This means that the way that a URL is checked for being friendly has been changed. A new setting has been introduced in the startup_settings section of the General tab of the Setup Tool: seo_path. The value in this field is used to determine if a URL is friendly or not. For example, assume that Apache is not configured to remove /web/ from a URL. In that case a friendly URL in versions R35 or earlier would be /web/home.htm. In versions R36 and higher, it would be /web/seo/myweb.htm.

To make sure this works as intended check the following settings in the Setup tool:

website_settings.friendly_url_prefix

In R35, the default value was /${startup_settings.context}. When Apache is not used to remove the /web/ prefix, this setting should be updated to

/${startup_settings.context}/${startup_settings.seo_path}

If Apache is used, this field is usually empty and can be left as is.

startup_settings.seo_path

The value of this field should be set to seo by default. If this field is not present in the startup_settings.xml check with your hosting provider if a different startup_config.xml is used than the one shipped with the deploy of XperienCentral. In that case, the following line should be added:

<entry name="seo_path" value=$(webmanager seopath)" />

Please also make sure that all changes in settings.xml have been applied.

context_static

The setting application_settings.context_static has been removed in XperienCentral R36. You must modify any custom code that uses this setting to use application_settings.static_files_url instead.

Changes to Apache

A minor change needs to be done to the vhost configuration in Apache to make sure XperienCentral keeps working. Most installations should have something along these lines to redirect requests from Apache to XperienCentral:

RewriteCond %{REQUEST_URI} !^/web/
RewriteCond %{REQUEST_URI} !^/admin/
RewriteRule ^/(.*)\.htm$ /web/$1.htm [PT,L]

The last line should be updated to

RewriteRule ^/(.*)\.htm$ /web/seo/$1.htm [PT,L]

This applies to both the back- and frontend vhost configurations.

In order to run XperienCentral without extensions at all, see Running XperienCentral without a Friendly URL Extension.

Friendly URL Extension Setting

The setting frontend_settings.friendly_url_extension was removed in R36.

URL Transformations

When transforming a URL from a URL without a context path to one with a context path in custom code, you should now also add the SEO path to the updated URL. This kind of logic is often used in custom implementations of the MetaDataProvider interface.

Update your Solr Configuration

In R36, the Solr version has been upgraded to version 8.11.1, therefore you must make the following changes:

In solrconfig.xml, change the declaration:

<luceneMatchVersion>6.6.6</luceneMatchVersion>

to

<luceneMatchVersion>8.11.1</luceneMatchVersion>

The eDismax query parser parameter lowercaseOperators now defaults to false if the luceneMatchVersion in solrconfig.xml is 7.0.0 or above, therefore you must set the lowercaseOperators parameter explicitly to true:

<bool name="lowercaseOperators">true</bool>

The following spatial-related fields have been removed:

• LatLonType
• GeoHashField
• SpatialVectorFieldType
• SpatialTermQueryPrefixTreeFieldType

Choose one of these field types instead:

• LatLonPointSpatialField
• SpatialRecursivePrefixTreeField
• RptWithGeometrySpatialField

Extra Steps

1. Stop Tomcat if it is running.
2. Remove the directory <webmanager-root>/work/searchengine.
3. If you have a custom solrconfig.xml, you need to modify it — open it in a text editor.
4. Save your custom solrconfig.xml.
5. Start Tomcat.
6. Log in to XperienCentral.

Real-time indexing

If you use real-time indexing (the XperienCentral Realtime Indexing reusable):

1. Navigate to Configuration > Realtime Indexing.
2. Select the "Indexing" tab.
3. Select all the websites that you want to index in the top part of the panel.
4. Click [Index selected items].

No real-time indexing

If you do not use real-time indexing (the XperienCentral Realtime Indexing reusable):

1. Open the Setup Tool.
2. Select the Search Tools tab.
3. Click [Index] in the "INDEX URL" section.

Custom Solr Queries

Check the changes that have been made between Solr versions 6.6.6 and 8.11.1 in order to determine whether you need to modify your custom Solr queries. See https://solr.apache.org/guide/8_11/major-changes-in-solr-8.html.

Deprecated Functionalities

Some query functionalities have been deprecated and/or removed, so it might be necessary to rewrite custom queries. See Solr upgrade (R36/Solr 8.11.1) for specific use cases that GX Software has encountered (login required).

Rebuild the Content Index

Due to a change in the Search functionality, you must rebuild the content index. To do so, manually remove the <webmanager-root>/work/contentindex directory after the upgrade and allow it to be regenerated after restarting XperienCentral. Selecting contentindex_queue_empty_reindex in the General tab of the Setup Tool is not sufficient to trigger the regeneration of the content index.

XperienCentral R35

Release date: February 7, 2022

Check Configuration Files

See Check Configuration Files.

SSI URLs

New security measures were introduced in this version that prevent the manipulation of URLs that contain SSI object IDs and/or presentation IDs. In general the cache will still be filled with files that contain pre-upgrade SSI URLs after an upgrade, which will lead to SSIs not being loaded and to the following message being logged in the Catalina logs:

nl.gx.webmanager.servlet.ControllerServlet.checkSsiObjectIdUrlSignature Block ssiObjectId request XXXXXXX because it is not allowed in this context 

This can be prevented by either clearing the frontend cache during the upgrade or, if that is not an option, by disabling the check_url_signature option in the application_settings section of the General tab in the Setup Tool. Be sure to re-enable this option after the cache has been regenerated. This setting will be shown in Setup Tool as turned off by default. However, it's actually turned on. So in order to get the state right, toggle the option in the Setup Tool to make sure it reflects the proper state.

fragment.tag and fragmentLabel.tag

The files fragment.tag and fragmentLabel.tag have been extensively modified in this version of XperienCentral. If you have custom code that makes use of modified versions of these files, perform a diff on the XperienCentral version of these files with your own modified versions in order to see what the differences are in order to pick up the new modifications. As is the case with all upgrades, do not overwrite your versions of these files if they have been customized for your XperienCentral deployment.

Changes to fragment.tag

This file has been updated to always render the HTML for the fragment label in the IAF Panel. Additionally, an ID is added to the <div class="wm-field-helptext"> whenever it appears in the IAF Panel.

Changes to fragmentLabel.tag

If you select "Required field" for a form fragment, you see that change immediately in the Interactive Forms panel. In earlier versions, this was not the case. In order to make this possible, the HTML is now always rendered in the Interactive Forms panel.

XperienCentral R34

Release date: November 18, 2021

Check Configuration Files

See Check Configuration Files.

Deprecated Media Repository Method Removed

The following method which was deprecated in 2009 has been removed from nl.gx.webmanager.cms.mediarepository.MediaRepository:

int copyMediaItem(MediaItemVersion mediaItem);

JBoss upgrade

From R34 onwards, JBoss 7.2 EAP is the supported JBoss version. JBoss 7.2 EAP and higher incorporates JDK 11 support. In order to upgrade, download the JBoss 7.2.0 EAP application server from https://developers.redhat.com/products/eap/download. See https://access.redhat.com/articles/2026253 for the supported configurations. In order to run XC on the JBoss application platform, use the standalone.xml and standalone.conf delivered with the XC SDK. For more information, see the updated JBoss information on the Linux Server Installation page.

MySQL Connector Upgrade

• In R34, the version of the MySQL connector has been upgraded from version 5.1.23 to 8.0.26. In version 8.0.23, changes were made to the way that MySQL handles time zones and dates. The method getObject(columnindex) now returns a local date/time rather than a string for any date/time columns, therefore any custom code that implements this method should be checked and modified if necessary.
• A second change in the connector is the way time zone conversions are handled. In order to keep these settings the same as they were before the changes in version 8.0.23, the following parameter should be added to the
  connection URL in the connectionTimeZone=<server> parameter in the Tomcat server.xml . For example:
  
  Before:
  
  jdbc:mysql://localhost:3306/webmanager9?autoReconnect=true
  
  After:
  
  jdbc:mysql://localhost:3306/webmanager9?autoReconnect=true&amp:connectionTimeZone=<server>
  
  In the second example above, note that &amp: is used instead of &.

XperienCentral R33.1

Release date: September 27, 2021

Check Configuration Files

See Check Configuration Files.

CSRF Approved URL Setting

A new CSRF setting has been added that allows you to approve URLs and bypass the CSRF checks. See the setting csrf_ignore_url_paths_regex in the application_settings section of the General tab of the Setup Tool.

Minimum Java Version

Beginning in R33.1, the minimum Java version required to run XperienCentral is Java 11. The maximum Java version supported is Java 13. This is also required for the XperienCentral add-ons:

• Content API
• Monitoring Framework
• Headless Integration
• Modular Content

Add New Java Option

As a result of the minimum Java version being raised to Java 11, you must modify your Tomcat setenv.sh file. Add the following options:

For JAVA_OPTS:

-Djava.locale.providers=COMPAT,CLDR

For Catalina add:

--illegal-access=warn --add-opens java.base/java.net=ALL-UNNAMED

See also https://gxsoftware.atlassian.net/wiki/display/PD/Linux+Server+Installation#LinuxServerInstallation-TheApplicationServer(TomcatorJBoss).

XperienCentral R33

Release date: July 30, 2021

Check Configuration Files

See Check Configuration Files.

Google Sitemap Automatic Upload

In XperienCentral R33, a new setting for controlling whether XperienCentral automatically uploads generated sitemaps to Google has been introduced. The setting google_sitemap_automatic_upload can be found in the application_settings section of the General tab of the Setup Tool. When enabled, if a Google sitemap is generated, it is automatically uploaded according to the schedule configured in the setting google_sitemap_generator_schedule. When disabled, the latest generated sitemap is not uploaded.

Because it is disabled by default, when upgrading from R32, the option must be enabled manually if XperienCentral should continue to automatically submit the sitemap to Google.

New Channel for the Interactive Forms Panel

Beginning in XperienCentral version R33, the Interactive Forms panel uses the "iafpanel" channel to render forms. This mechanism makes it possible to decouple the IAF visual representations from the website presentation. New presentations should use it for all standard fragment types unless the representation inside the IAF panel must resemble the website's presentation. When upgrading, there are 3 possible options for handling this situation:

1. Add "iafpanel" (without quotes) to the channels_using_fallback setting in the application_settings section of the General tab of the Setup Tool. This will make all presentations without an explicit "iafpanel" channel declaration behave as described in option 3 below. This is the quickest fix. The notes in option 3 below also apply to this option.

2. Add the "iafpanel" channel to all custom formStep, FormSectionVersion and form fragment presentation descriptors. This will deliver the best Edit side presentation and will prevent the custom presentations from being cluttered with Edit-side logic. For a text input fragment, the channel declaration looks like this:
   
   

   <channel>
      <name>iafpanel</name>
      <presentation>FormFragmentTextInput</presentation> <!-- Name of IAF's own presentation -->
   </channel>

   
   As a result, any code in the presentation JSPs that is specific to the preview mode can be removed.
   
   

3. Add the "iafpanel" channel to all custom formStep, FormSectionVersion and form fragment presentation descriptors and have it refer to itself. The Interactive Forms panel will then continue to use the custom presentations, making it possible to have the same HTML output in the panel as on the website.
   
   

   Notes

   • Option 1 has the same effect as Option 3 but it is easier to implement. The disadvantage of using Option 1 is that it might not be obvious that an "iafpanel" channel that you want to point to the IAF's own presentation (Option 2) is missing from a presentation descriptor.
   • The IAF panel presentation(s) may look different than the pre-R33 version(s) because of changes to the CSS.
   • Option 2 or 3 can be used separately for each presentation.

fragmentDiv tag

When the fragmentDiv tag is overruled in a custom presentation plugin, the data-jcr-uuid attribute must now be added in Edit mode by the custom fragmentDiv tag.

An example how this can be implemented can be found in the standard IAF fragmentDiv tag inside the wmformelement plugin.

CSRF Settings

To better protect websites hosted by XperienCentral against CSRF attacks, a new mechanism has been introduced that uses a CSRF token that is stored in a cookie, and an SHA-256 hash of this token plus a random 16 character long nonce, postfixed with the used nonce, must be included in all non-GET requests to the server as a header or form field. This change could affect custom functionality in the following ways:

• If a custom version of the Interactive Form file formvalidationbindings.js is used, it must be updated with the anti-CSRF changes which can be found by searching for "csrf" in the upgraded formvalidationbindings.js.
• If the Interactive Form formsHeadTag presentation is not called from a custom presentation plugin, then the page presentations of this plugin must include the /<context path>/js/form/csrfprotection.js script.
• If XHR form posts are performed in custom panels, elements or widgets, the X-CSRF-Token header must be added to these posts.
• The secure_rest_against_csrf configuration setting and the mandatory use of the X-Session-Verify header when it is enabled are now only relevant for GET requests to XperienCentral's REST API. All other types of requests to the REST API are now always checked, irrespective of the secure_rest_against_csrf configuration setting, and they must contain the X-CSRF-Token header. See the application_settings section of the General tab of the Setup Tool for complete information on the secure_rest_against_csrf setting.
• If custom voting presentations are used, the X-CSRF-Token must be added to the form posts they execute. See voting.jspf in the Community Edition presentation for an example.
• External requests to /services/oembed must add a X-CSRF-Token header to the request. It can be retrieved from the X-CSRF-Token response header when the steps on /wiki/spaces/PD/pages/24718337 have been followed.
• It is not possible to submit forms to XperienCentral from other domains, even when that domain is another channel of the same XperienCentral installation, because browsers do not allow reading cookies from another domain.

See also /wiki/spaces/PD/pages/24718337 for more information.

formvalidationbindings.js

The following changes have been made to the formvalidationbindngs.js file:

• A new initCSFW function has been added that is called in the $(document).ready for all forms and from the IAF_FormLoaded event listener.
• initCSFW calls the new loadScript function which adds a script tag to load the client-side framework.
• The IAF_ShowFormFragment and IAF_HideFormFragment event listeners have been updated to prevent event propagation.
• The IAF_SubmitForm event listener has been updated to add the anti-CSRF header when submitting the form using Ajax and to support form fields that have "submit" as their identifier.
• The IAF_AjaxShowFormStep event listener now checks whether the response contains the X-CSRF-Token header. If it does, then it creates a hidden input with its value. This is done to support IAF forms on external domains.
• The formObj.submit function defined in the init function has been updated to add the anti-CSRF input field when submitting the form.
• A new showGeneralErrorMessage function has been defined that shows a general error message at the top of a form when a communication error occurs.

Interactive Forms Upload Element

The Upload element in Interactive Forms has been modified to allow multiple file uploads. You can also set a minimum and maximum number of allowed files in an Upload element. See Creating Forms for complete information.

Modular Content Tag Property change (v2.0.13)

Properties of type tag are now referenced using an ID instead of by name. For example, suppose you have the following tag property:

TemplateProperty tagProperty = modularVersion.getModularTemplateInstance().getPropertyByIdentifier("mypropertyoftypetag");

Previously, the tag name would be retrieved using tagProperty.getStringValue(). Now the (Siteworks) ID of the property must first be retrieved using getIntegerValue() and, given that, the correspronding MediaTerm can be retrieved using getWrapper. For example:

Previously in Java

TemplateProperty property = modularVersion.getModularTemplateInstance().getPropertyByIdentifier("mypropertyoftypetag");
String tagName = property.getStringValue();

Now in Java

TemplateProperty property = modularVersion.getModularTemplateInstance().getPropertyByIdentifier("mypropertyoftypetag");
Long tagId = property.getIntegerValue();
Session session = getSessionManager().getActiveSession();
MediaTerm categoryTag = (MediaTerm) session.getWrapper(tagId.intValue(), MediaTerm.class);
String tagName = categoryTag.getName();

Previously in JSP Code

<c:set var="mediaItem" value="${presentationcontext.mediaItem}" />
<c:set var="currentMV" value="${mediaItem.current}" />
<c:if test="${wmfn:instanceOf(currentMV, 'nl.gx.product.wmamodularcontent.api.ModularMediaItemArticleVersion')}">
   <c:set var="mti" value="${current.modularTemplateInstance}" />
   <c:set var="supportedContenttype" value="${mti.type.identifier eq 'examplecontenttype'}" />
</c:if>
<c:choose>
   <c:when test="${supportedContenttype && not empty mti.getPropertyByIdentifier('mypropertyoftypetag').getStringValue()}">
      <c:set var="tagName" value="${mti.getPropertyByIdentifier('mypropertyoftypetag').getStringValue()}" />
   </c:when>
   ....
</c:choose>

Now in JSP Code

<c:set var="mediaItem" value="${presentationcontext.mediaItem}" />
<c:set var="currentMV" value="${mediaItem.current}" />
<c:if test="${wmfn:instanceOf(currentMV, 'nl.gx.product.wmamodularcontent.api.ModularMediaItemArticleVersion')}">
   <c:set var="mti" value="${current.modularTemplateInstance}" />
   <c:set var="supportedContenttype" value="${mti.type.identifier eq 'examplecontenttype'}" />
</c:if>
<c:choose>
   <c:when test="${supportedContenttype && not empty mti.getPropertyByIdentifier('mypropertyoftypetag').getIntegerValue()}">
      <c:set var="tagId" value="${mti.getPropertyByIdentifier('mypropertyoftypetag').getIntegerValue()}" />
      <wm:object var="tagObject" objectId="${tagId}" objectType="nl.gx.webmanager.cms.mediarepository.MediaTerm" hideError="true" />
      <c:set var="tagName" value="${tagObject.name}" />
   </c:when>
   ....
</c:choose>

Interactive Forms Deprecated Methods

In XperienCentral versions R33 and higher, the following form methods have been deprecated.

FormScope

The following method has been deprecated:

void setUploadFragmentValue(String fragment, UploadedFile file);

use the following method instead:

void setUploadFragmentValues(String fragment, List<UploadedFile> files);

FormValuesMap

The following method has been deprecated:

public UploadedFile getUploadedFile(String key)

use the following method instead:

public List<UploadedFile> getUploadedFiles(String key)

UploadFragmentScope

All methods have been deprecated. Use the following method instead:

List<Object> files = scope.getValues();
if (files != null) {
   for (Object fileObj : files) {
      if (fileObj instanceof UploadedFile) {
         UploadedFile file = (UploadedFile) fileObj;
      
         // Now read the attributes
         File file = file.getFile();
         long size = file.getSize();
         String contentType = file.getContentType();
         ...
      }
   }
}   

XperienCentral R32

Release date: May 12, 2021

Check Configuration Files

See Check Configuration Files.

Rebuild the Content Index

Due to a change in the Search functionality, you must rebuild the content index. To do so, manually remove the <webmanager-root>/work/contentindex directory after the upgrade and allow it to be regenerated after restarting XperienCentral. Selecting contentindex_queue_empty_reindex in the Setup Tool is not sufficient.

Check Google Sitemap Generator Schedule

In R32, XperienCentral generates and uploads a Google Sitemap by default once per day. If you do not want to generate a sitemap, clear the field google_sitemap_generator_schedule in the application_settings section on the General tab of the Setup Tool in each environment where you want to disable this functionality. You can also change the schedule to something else if desired.

Changes to the XperienCentral API

Remov