Changelogs

dotCMS 3.6.2 is a maintenance release which includes a security update for a newly discovered security vulnerability.

Due to the inclusion of a fix for a known security vulnerability, it is recommended that all current customers upgrade to release 3.6.2 as soon as possible.

Important Changes

The following important changes in dotCMS 3.6.2 may impact your site security and performance. Please read the documentation sections on all of these changes before upgrading from a previous release.

• Security Update

Security Update

dotCMS 3.6.2 includes a fix to a newly discovered security vulnerability in older dotCMS releases.

• The details of this vulnerability are being temporarily withheld, to enable customers to upgrade to the new release before the nature of the vulnerability is disclosed.
• It is recommended that all customers upgrade to dotCMS 3.6.2 as soon as possible, to incorporate the fix for this vulnerability.
• Enterprise customers with active support contracts who are not able to upgrade to dotCMS 3.6.2 may request a hotfix for this vulnerability for older versions of dotCMS.
• If you are an Enterprise customer, please contact dotCMS Support (via email or the support portal) to request more information on this security upgrade or to request a hotfix for an older version of dotCMS.

Fixes

The 3.6.2 release includes fixes for a number of reported issues, including but not limited to the following:

• Fixed a license error caused by deleting an inactive server in a cluster when a specific combination of configuration properties are set (#10388).
• Fixed an incorrect redirect to a 404 page after a user accesses a resource link and logs in (#9996).

To view more information on these issues, please visit the dotCMS Github repository.

dotCMS 3.6.1 is a maintenance release to add some performance improvements and to fix a number of reported issues in the 3.6.0 release.

Performance Improvements

• Improved performance of ContainerService Code (#10101)
• Optimized the reindex process to avoid reindexing the same content more than once (#9768)

Fixes

The 3.6.1 release includes fixes for a number of reported issues, including but not limited to the following:

• Empty files are sometimes created when using Finder and WebDAV (#10003)
• File copy fallback does not work when a hardlink is not possible (#9997)
• Server license may be invalidated if dotCMS is started when the database is not running (#9849)
• Errors migrating HTML Pages to content (#9760)
• File Title is incorrectly displayed in the Site Browser instead of File Name (#10011)
• An exception may be thrown when NavTool gets the parent permissionable of a Page Asset (#9893)

To view more information on these issues, please visit the dotCMS Github repository.

Known Issues

None at this time.

dotCMS 3.6.0 includes some important new features and some improvements to our multilingual featureset. We encourage you to check out the new features and improvements in this release on the dotCMS Demo Site, and we welcome your feedback on these enhancements.

• Important Changes
• Database Upgrade Requirements
• Changes to Default Behavior
• Changes to Empty File Handling
• Cluster Autowire Scale Down Improvement
• WebDAV Pathing Has Changed
• Default Cache Behavior Has Improved
• New Default H2 Cache
• New Features
• Google Translate Workflow Sub-Action
• Multilingual Files
• Finnish Back-end Translation
• User accounts may now be deleted
• Performance Improvements
• Important Fixes
• Additional Changes and Improvements

Important Changes

Important changes in dotCMS 3.6.0 configuration may impact your performance when upgrading an existing site. Please read the documentation sections on all of these changes before upgrading from a previous release.

*Database Upgrade Requirements (Applies only to pre-dotCMS 3.5.1 upgrades)

Clients with large datasets or with a large amount of content using tags must make configuration changes to two properties in the context.xml file both prior to and after the upgrade to ensure the upgrade completes successfully.

Before Upgrade:

Before starting up the new 3.6.0 instance, change the following property values in the database configuration in your context.xml file to the values shown below:

maxWaitMillis="-1"
removeAbandonedTimeout="3600"

After Upgrade:

After the upgrade process is completed, the properties for the configuration should be reset to the default settings:

maxWaitMillis="60000"
removeAbandonedTimeout="60"

*  Disregard if you are upgrading from dotCMS version 3.5.1.

Changes to Default Behavior

Changes to Empty File Handling

Default behavior has been changed to reject the upload of empty files.

You may change the default behavior by setting the value of the CONTENT_ALLOW_ZERO_LENGTH_FILES configuration property to true:

CONTENT_ALLOW_ZERO_LENGTH_FILES=true

Note: A warning is always logged any time an empty file is found, regardless of the property setting.

IMPORTANT: Regardless of the property setting, it is highly recommended that empty files are cleaned from the assets folder of your dotCMS installation. This can be done in unix by running:

find $PATH_TO_ASSETS -size 0 -type f -delete

For more information, please see the File Configuration documentation.

Cluster Autowire Scale Down Improvement

Default cluster behavior has changed so that replicas are not considered "timed out" and dropped for 30 minutes. This allows servers to be stopped for short maintenance intervals without being dropped from the cluster.

You can change the timeout by setting the value of the HEARTBEAT_TIMEOUT property in the dotcms-config-cluster.properties file:

HEARTBEAT_TIMEOUT=30

For more information, please see the Cluster Configuration documentation.

WebDAV Pathing Has Changed

The default path when using WebDAV has changed to support multilingual files and pages.

• The default root of the WebDAV path is now /webdav/working/{language_id} or /webdav/live/{language_id}, for example:

  /webdav/working/1/about-us/index

• WebDAV pathing may be changed to Legacy WebDAV pathing (e.g. /webdav/autopub/about-us/index or /webdav/nonpub/about-us/index) by setting the WEBDAV_LEGACY_PATHING property in the dotmarketing-config.properties file to true.

Default Cache Behavior Has Improved

Cache Regions not explicitly configured in the dotmarketing-config.properties file are now divided into separate caches. In dotCMS 3.3, undefined cache regions were all combined into the default cache region. In dotCMS 3.6.0, undefined cache regions are separated into unique cache regions, each one using the cache chain specified by the cache.default.chain property and using the default region size (1000 entries).

For more information, please see dotCMS reported issue #9104.

New Default H2 Cache

A new H22 cache provider has been added to dotCMS as a replacement for the original H2 cache provider, and the H22 cache provider is now the default cache provider. The H22 cache offers an H2DB-based cache with a number of improved features over the original H2 cache provider:

• Performance: The H22 cache provides improved performance and collision avoidance.
• Configurability and Flexibility: The H22 cache provides a number of configuration properties allowing you to tune the cache database size, connection and database parameters, and error handling for your specific needs.
• Scalability: The size of the H22 cache is configurable and the cache is sharded, enabling improved scaling and improved performance with clusters.
• Fault Tolerance and Robustness: The H22 cache can tolerate many common errors and will automatically recover (creating a new database) if the number of errors exceed a configurable threshold.

Note: The original H2 cache provider is still supported for backward compatibility with older versions. For more information, please see the H22 cache provider documentation.

New Features

In addition to the Important Changes listed above, the following additional new features have been added in dotCMS 3.6.0:

• A Workflow Sub-Action has been added to automatically translate content using Google Translate (#9037)
• Multilingual files are now supported via back-end upload, WebDAV, etc. (#9162)
• A Finnish translation has been added, allowing you to use the dotCMS backend in the Finnish language (#9691)
• Users can now be deleted from the system. (#8879)

Performance Improvements

The performance of several Maintenance tasks was improved:

• Reindex has been improved to avoid multiple reindexation of the same content and nested relationships (#8836)
• Execution time when fixing a large number of orphaned identifiers has been greatly reduced (#9234)
• Execution time when fixing a large number of content items with inconsistencies in their inodes has been greatly reduced (#9229)

Important Fixes

The 3.6.0 release includes fixes for a number of reported issues, including but not limited to the following:

• Changed database to maintain compatibility with the new version of Oracle (#9277)
• Delete Push Assets History۪ functionality on Maintenance Portlet is now working when using Oracle and MS SQL Server databases (#9383)
• Push Push Actionlet works in Edit Mode (#9351)
• Push of already pushed bundled assets to multiple environments gets them sent to all selected/expected (#9289)
• Push delete properly deleting content on the receiver when adding the content to a bundle and downloading for deletion (#9053)
• Pushing content with a live version but on working state now properly reflects its working state on the receiver (#8784)
• Users can now be properly push published (#9242)
• Time machine correctly snapshots personalized content (#9097)
• Jobs not leaking database connections (#9159)
• CSV Template now has correct values for key/value fields when downloading the CSV Sample file for a content type with fields of that type (#9137)
• Pagination on the Content Type admin page is now properly working (#9133)
• Fix task for checking inconsistencies in Assets not hanging anymore (#9106)
• Binaries already selected not losing its value when another require field is missing (#9082)
• List of pages referencing a contentlet is now showing the correct ones when those are in different languages (#8996)
• User permissions are now fully cascading from All Sites (#8853)
• Delete content through the Maintenance admin screen properly deletes object (in all languages) (#8820)
• New versions of existing content in different languages are now able to be created via REST (#8775)
• User name and last name now accept unicode characters (#8750)
• Deploy static plugins from git checkout now works correctly on Windows (#8414)
• List of initial hosts for auto clustering is now building properly (#8196)
• Cluster Autowire functionality now verifies that addresses exist on a network interface (#6971)
• Tags are now included when getting content via REST (#8903)
• Tags and Categories of content are now included in the results of the ElasticSearch admin page (#8953)
• In the HTMLPage admin page, the 'Filter By Template' dropdown now properly lists options (#8901)

To view more information on these issues, please visit the dotCMS Github repository.

Additional Changes and Improvements

• Elasticsearch has been upgraded to version 1.7.
• Markdown support has been moved from a plugin into the dotCMS core via the Markdown Viewtool.
• Streamlined Source Code: A number of deprecated SQL tables, Javascript libraries, etc.
• Unmapped several deprecated servlets.
• Record startup times of different modules in the System (Overall, Cache, DB, ElastcSearch, Quartz Jobs, OSGI plugins) (#Performance Tuning - StartupTime)
• Results from Elasticseach via REST can be prettyfied (#REST-prettyfied)
• Deploy-plugins sh, bat and gradle task now runs undeploy-plugins first (#8814)
• Deploy-plugins sh, bat, and gradle task now always compile the code, even though when the build folder already exists (#8703)
• UrlRewriteFilter was moved above the CMSFilter in order to correctly process forwards (#6926)
• JSONTool now is able to handle JSON arrays (#JSONTool, #1991)
• When editing a Site, the All Sites option was removed from the tag storage field to eliminate ambiguity and confusion with System Host

Note:

Clients upgrading from older versions (especially dotCMS 1.x) may need to re-map some of these servlets to enable old migrated content to operate in dotCMS 3.6.0.

Known Issues

• Images added to WYSIWYG fields before the first push don't display on the receiving server (#8140)
• File Asset Resource Link path needs to be the same for all language versions (#9725)

dotCMS version 3.5.1 is a maintenance release to add some performance improvements and fix a number of reported issues in the 3.5 release.

Important Changes

• Postgres Upgrade Requirements
• Upgrading from a pre-3.2.4 Release

Configuration Changes

Important changes in dotCMS 3.5.1 configuration may impact your performance when upgrading an existing site. Please read the documentation sections on all of these changes before upgrading from a previous release.

Postgres Upgrade Requirements

Clients with large datasets that are using a Postgres database must make configuration changes to two properties in the context.xml file both prior to and after the upgrade to ensure the upgrade completes successfully.

Before Upgrade:

Before starting up the new 3.5.1 instance, change the following property values in your context.xml file to the values shown below:

maxWaitMillis="-1"
removeAbandonedTimeout="3600"

After Upgrade:

After the upgrade process is completed, the properties for the Postgress configuration should be reset to the default settings:

maxWaitMillis="60000"
removeAbandonedTimeout="60"

Upgrading from a pre-3.2.4 Release

There is a known issue with the upgrade tasks that will prevent a direct upgrade to version 3.5.1 from any release prior to dotCMS 3.2.4. If you are upgrading from a pre-3.2.4 release, you must first upgrade to dotCMS 3.5, and then after that upgrade is complete, upgrade from dotCMS 3.5 to dotCMS 3.5.1.

Performance Improvements

Several performance improvements have been made in this release:

• Improved cache handling of permissions: The overall system performance has been improved by reducing the number of round trips to the database server when checking permissions (#9312).
• Improved upgrade performance: Upgrade tasks for datasets with a large number of contentlets that utilize tags has been significantly optimized (#9362).
• Improved cache performance under heavy load: The cache implementation has been changed to utilize less CPU resources (#9221).

To view the details on any of these issues, please click the link in parentheses next to each issue.

Fixes

This release includes fixes for a number of reported issues, including but not limited to the following:

• Fixed critical security isssue, "Lack of user verification in the CMSMaintenanceAjax class" (SI-37).
• Changed database to maintain compatibility with the new version of Oracle (#9277).
• Improved the DB locks used in scheduled jobs when running with MS SQLServer (#9270).
• Fixed an issue when deleting a field from a Content Type with large numbers of existing records (#8793).

To view the details on any of these issues, please click the link in parentheses next to each issue.

To view more information on these issues, please visit the dotCMS Github repository.

Known Issues

• There is an issue with the upgrade tasks (#9475) when upgrading to dotCMS 3.5.1 from a version of dotCMS earlier than dotCMS 3.2.4.
• Attempts to upgrade directly from versions of dotCMS earlier than 3.2.4 to dotCMS 3.5.1 will fail.
• To upgrade from a version of dotCMS earlier than 3.2.4, you must first upgrade to dotCMS 3.5, then upgrade to dotCMS 3.5.1.

dotCMS version 3.3.2 is a maintenance release to fix security issues. Note that all fixes in the 3.3.2 release are also included in the dotCMS 3.5 release.

Fixes

This release includes fixes for the following reported security issues:

• XSS vulnerability in the Query Tool (lucene) screen.
• SQL Injection vulnerability when saving content through the REST API.
• Ability to view files on the Log Viewer outside the configured directory.
• SQL Injection vulnerability in the Workflow configuration screen.
• Header injection vulnerability in the send email functionality.
• SQL Injection vulnerability via DWR.
• Lack of user verification in the CMSMaintenanceAjax class.

To view more information on these issues, please see the Known Security Issues documentation.

dotCMS version 3.5 contains several major new features and improvements. We encourage you to evaluate the new features and improvements in this release on the dotCMS Demo Site, and we welcome your feedback.

Important Changes

The following important changes in dotCMS 3.5 may require a change in your configuration, or may impact your performance when upgrading an existing site. Please read the documentation sections on all of these changes before upgrading from a previous release.

dotCMS 3.5 no longer supports Java 7

You must use Java 8 or later versions with dotCMS 3.5.

• The MaxPermSize parameter has been removed from the dotCMS startup script.
• Java 8 no longer supports the MaxPermSize parameter.
• If you have made changes to MaxPermSize in your startup script, you must replace it with MaxMetaspaceSize for the changes to have any effect in Java 8.

The /plugins/common.xml file has Changed

When copying your static plugins to the 3.5 release, you must not copy the entire /plugins/ folder from the previous release.
Instead, copy each individual plugin folder (and the plugins.xml file if you have changed it) from the old release to the 3.5 release folder.

For more information on the proper steps to copy your plugins to 3.5, please see the Upgrading dotCMS documentation.

New Features

dotCMS 3.5 contains two major new features which enable you to customize the display of your site for different users:

1. Rules are a very powerful feature that enable you to set dotCMS properties and change how your pages are displayed based on visitor information such as visitor location and platform.
• Rules may be built from the many built-in Conditions and Actions, or you may create your own custom Conditions and custom Actions using OSGI plugins.
• Rules may be accessed and updated via the REST API.
• Rules may also be push published to other servers.
2. Personalization allows you to provide personalized content to different users that visit your site based on user preferences and browsing behavior.
• The Visitors feature provides you with information about each user who visits to your site, including current information such as user location and platform, and historical information such as the tags of content the user has visited in the past.
• The Personas feature allows you to define different types of users, and then server content to each user based on which type of user you've identified them as.
• The pullPersonalized method enables you to automatically pull and sort personalized content for different users, using the built-in personalization features of both Visitors and Personas.

In addition, dotCMS 3.5 now allows you to sort content pulls by score.

Fixes

The 3.5 release includes fixes for a number of reported issues, including but not limited to the following:

• Fixed critical security issue, "SQL Injection via REST API", SI-35
• Fixed moderate security issue, "SQL Injection from Workflow Screen III", SI-36
• Fixed moderate security issue, "Directory traversal vulnerability by Admin", SI-34
• Fixed low security issue, "XSS in Lucene Search Admin tool", SI-33
• Incorrect Logging Levels in the PluginFileMerger class.
• Image Editor image size slider doesn't display correctly.
• Copy Host -> Copy Content does not link the new content to the new host.
• When using H2 database, the Templates list is empty for non-admins when adding a page.
• A 404 exception generates an unnecessary stack trace in the log file.
• CookieUtil sometimes generates incorrect cookies or cookie syntax.
• Initial Referrer not set correctly in ClickstreamFactory.

In addition, the 3.5 release includes fixes for the following issues (which are also fixed in the 3.3.1 maintenance release):

• After migrating legacy pages, the Redirect URL value is dropped.
• Cannot add folders at root level with limited user.
• File names are not escaped when Downloading.
• Wrong language_id affects the current session.
• Error generating Integrity Checker results using MS SQL Server.
• Log4j2 log rollover stores files in incorrect location.
• FileAssetMap does not have a 'host' field anymore.
• Release aborted file handles.
• Casting exception during Push Publishing when running on MS SQL Server.
• Host Lookup in request does not work in Live Mode.
• The back-end Link to the dotCMS Support Portal is wrong.
• Integrity Checker fails when there are unpublished/archived assets.
• Cluster cache gets corrupted after receiving content.
• OSGI Framework tries to deploy bad plugins indefinitely.
• NavTool returns wrong "active" items.
• Button in Push Publish Workflow Action has misleading label.
• Files under a folder are sorted incorrectly.

To view more information on any of these issues, please visit the dotCMS Github repository.

Additional Changes and Improvements

• The Microsoft JDBC driver has been upgraded from version 4.1 to version 4.2.
• Default Password requirements have changed.
  • Please see the Password Security Configuration documentation for more information.
• The Ratings thread is now turned off (disabled) by default.
  • This deprecated functionality is no longer used except for legacy sites.
• The tagCloud macro has been removed.
  • This macro has been deprecated for some time, and is now fully removed.
  • You may replace the tag cloud macro with a tag cloud implemented using ElasticSearch aggregates.
• Multiple tag fields in a single Content Type are not supported.
  • Multiple Tag fields in a single Content Type are not supported in dotCMS 3.5.
  • Although adding multiple Tag fields in the same Content Type has never been officially supported in dotCMS, in previous versions it was possible to use multiple Tag fields for some use cases.  However Tag changes in dotCMS 3.5 effectively merge all Tag fields in a Content Type into a single Tag field, so that tags entered in one Tag field can not be entered in the other Tag field, and tags entered in all Tag fields will be retrieved when a query is performed on any of the Tag fields.
  • Customers who have implemented multiple Tag fields per Content Type in previous versions should plan accordingly, and consider using Categories instead of Tag fields to separate different taxonomies in the same Content Type, or a custom field to enter and manage keywords independent of the dotCMS tags.

Known Issues

• ContentResource does not include content tags when viewing as JSON or XML.
  • https://github.com/dotCMS/core/issues/8903
• HTMLPage Portlet
  • The HTMLPage portlet 'Filter By Template' dropdown does not list any options.
    • https://github.com/dotCMS/core/issues/8901
  • The HTMLPage portlet text filter only works for legacy HTMLPages.
    • https://github.com/dotCMS/core/issues/8904

dotCMS version 3.3.1 is a maintenance release to add some performance improvements and fix a number of reported issues in the 3.3 release.

Performance Improvements

Several performance improvements have been made in this release, including but not limited to the following:

• Push publishing has been optimized for bundles containing related items, significantly improving speed for large sites.
• Some MySQL queries have been optimized, significantly improving performance for some operations.
• Performance has been improved when viewing pages in Edit or Preview mode on servers with large numbers of Content Types.

Fixes

This release includes fixes for a number of reported issues, including but not limited to the following:

• After migrating legacy pages, the Redirect URL value is dropped.
• Cannot add folders at root level with a limited user, even when permissions should allow it.
• Filenames are not escaped when Downloading.
• In some cases, the wrong language_id affects the current session.
• The Integrity Checker sometimes generates errors when running on MS SQL Server.
• Log4j2 log rollover file locations have changed to support improved log history.
• FileAssetMap no longer has a 'host' field.
• In some specific circumstances, aborted filehandles may not be released properly.
• There is sometimes a casting exception during Push Publishing when running on MS SQL Server.
• Host Lookup in request does not work in Live Mode.
• The back-end Link to the dotCMS Support Portal is incorrect.
• Integrity Checker may sometimes fail if there are unpublished/archived assets.
• The cluster cache may sometimes become corrupted after receiving content.
• NavTool may return incorrect "active" items.
• Button in Push Publish Workflow Action has a misleading label.
• Files under a folder are sometimes sorted incorrectly.
• Pushed Containers and Templates sometimes don't go live on the receiving site.
• getContentletVersionInfo() has inconsistent behavior.
• Log messages for OSGI plugins are displayed in catalina.out instead of dotcms.log.

To view more information on these issues, please visit the dotCMS Github repository.

Important Changes

A number of important changes in dotCMS 3.3 configuration may impact your performance when upgrading an existing site. Please read the documentation sections on all of these changes before upgrading from a previous release.

Configuration Changes

The following important changes have been made to configuration in dotCMS 3.3:

• Velocity Macro Caching
• The Startup Script Has Changed
• Cache Configuration Has Changed
• Quartz Job Scheduler MisfireHandler Log Error
• The log4j.xml File is No Longer Used

Behavior Changes

In addition, the following differences in default behavior in dotCMS 3.3 may change your expectations and require a review of your administration practices. Please review all of these changes before upgrading from a previous release.

• dotCMS Messages are No Longer Written to the Console
• The Log file Rollover Pattern has Changed

Velocity Macro Caching

dotCMS 3.3 uses a new cache chain which allows you to specify multiple cache providers in a chain. Due to the need to support cache providers which handle velocity code in different ways, velocity macros can no longer be cached to disk.

If you have velocity macros in .vtl files, the velocity macros will not render properly on some servers, or after a restart.

If your velocity macros are stored in files with a .vm extension you do not need to make any changes; dotCMS will automatically cache your macros to memory only, and your applications will continue to work normally.

If you have velocity macros stored in .vtl files or files with other extensions, you have two options to prevent problems rendering your macros:

• Move all velocity macros into separate files with an extension of .vm.
• Enterprise Only: Change the Velocity cache region chain (cache.VelocityUserVTLCache.chain) to use cache providers which store data to memory only.

Please see the Cache Configuration documentation for more information.

The Startup Script Has Changed

The dot.jamm jar has been upgraded to a newer version, so the command used to startup the javaagent for the dot.jamm jar has changed. If you have implemented any changes to your startup script, you will need to copy this change to your startup script to make the following replacement:

• 3.2.4:
  

  -javaagent:$DOTCMS_HOME/WEB-INF/lib/dot.jamm-0.2.5_1.jar

• 3.3:
  

  -javaagent:$DOTCMS_HOME/WEB-INF/lib/dot.jamm-0.2.5_2.jar

Cache Configuration has Changed

dotCMS 3.3 includes a new cache chain feature which enables Enterprise customers to configure and customize cache providers. As part of this change, the cache configuration properties have changed.  How you address these changes depends on your dotCMS license version:

Community Customers:

dotCMS 3.3 still uses the cache size parameters (cache.default.size, cache.adminconfigpool.size, etc.), but dotCMS Community Edition no longer uses a disk cache.  So if you have changed your cache .size parameters you must copy them to the dotCMS 3.3 properties file, but no other changes are needed (and you do not need to copy your cache .disk parameters such as cache.default.disk).

Enterprise Customers:

dotCMS 3.3 still uses the cache size parameters (cache.default.size, cache.adminconfigpool.size, etc.), so if you've made changes to these properties you will need to copy them to your dotCMS 3.3 configuration.  However the ".disk" properties (cache.default.disk, cache.contentletcache.disk, etc.) have been replaced with the cache chain properties, so if you've made changes to the cache ".disk" cache properties, you must reconfigure your cache using the new cache chain parameters in dotCMS 3.3.  Please see the Cache Chaining documentation for more information.

Quartz Job Scheduler MisfireHandler Log Error

When upgrading from an older version, you may receive an error in the logs related to the quartz job scheduler:

CST ERROR quartz.DotJobStore: MisfireHandler: Error handling misfires: Couldn't store trigger 'trigger16' for 'CleanBlockCacheScheduledTask'

Although this causes errors to be written to the log file, it does not affect system performance.

Resolution

The CleanBlockCacheScheduledTask is a system job, so it can't be removed from the Job Scheduler tab. To remove the errors from the log file, you must manually run SQL commands against your database to remove the CleanBlockCacheScheduledTask. The following SQL commands will remove the task causing the error (these commands can be used in all databases):

DELETE FROM qrtz_excl_cron_triggers WHERE trigger_name IN (SELECT trigger_name FROM qrtz_excl_triggers WHERE job_name = 'CleanBlockCacheScheduledTask');
DELETE FROM qrtz_excl_triggers WHERE job_name = 'CleanBlockCacheScheduledTask';
DELETE FROM qrtz_excl_job_details WHERE job_name = 'CleanBlockCacheScheduledTask';

Important Logging Changes

dotCMS 3.3 has been upgraded to Log4j version 2. As part of this update, a number of changes have been made to the logging configuration and behavior.

The log4j.xml File is No Longer Used

The log4j configuration file has been renamed to log4j2.xml, and moved to the ROOT/WEB-INF/log4j folder.

If you've made changes to the log4j configuration on your site, you may still use many of your changes, but you will need to merge these changes into the log4j2.xml file provided with dotCMS 3.3.  Please see the Logging Configuration documentation for more information.

dotCMS Messages are No Longer Written to the Console

To improve performance and prevent management issues with application server log files (e.g. catalina.out), dotCMS log messages are no longer written to the console. All dotCMS log messages can still be viewed in the dotCMS log files; please see the Logging Configuration documentation for more information.

The Log file Rollover Pattern has Changed

Rolled log files are now stored in date-stamped directories under the /dotserver/Tomcat-X.xx/webapps/dotsecure/ directory (or whatever directory is specified by your DOTCMS_LOGGING_HOME variable). This means that log files from previous days will not be automatically overwritten as they were in previous versions, giving you access to older log files, but requiring you to periodically remove older log directories (manually or through a scheduled task). In addition, for large sites with significant log activity, this may cause the log files to roll over more frequently than in previous versions.

If you wish to change rolling log file behavior to store all rolled log files in a single folder (e.g. .../dotsecure/logs/archive), edit the log4j2.xml file, replacing the string $${date:yyyy-MM} in all FILENAME_PATTERN properties with the name of the folder to store the files (e.g. archive).

Fixes

• Fixed a number of reported security issues (please contact dotCMS support for more information).
• Fixed several issues with push publishing.
• Fixed a number of issues with the Integrity Checker.
• Fixed some scroll bar issues in Edit Mode in IE11.
• Fixed an issue with incorrect dates set in a .ICS file downloaded from the Calendar.
• Fixed some issues managing files and folders in the Site Browser.
• Fixed an issue preventing newly created cookies from respecting the expire parameter.
• Fixed some ordering issues with Workflow sub-actions.
• Fixed some issues running dotCMS as a WAR in JBoss and WebSphere.
• Fixed an issue with Image Editor URLs.

New Features

• Added a Stop Reindex and Make Active button to allow you to safely stop the reindexing process.
• Added the ability to use external cache providers, including Redis.
• Added the ability to chain the cache, and specify different chains for each cache region.
• Added the ability to directly push languages and add languages to bundles
• Added a User Agent viewtool plugin.

Additional Changes and Improvements

• The Reindex feature has been improved to try all records once before retrying failed records a configurable number of times, ensuring failed records will not hold up the reindex process. In addition logging and notifications of index failures have been improved, and buttons have been added to display failed records and auto switch to the new index if needed.
• Right-click functionality in the WYSIWYG field has been disabled. We now rely entirely on the user's browser for functions such as spell check.
• The JUnit framework is no longer packaged with dotCMS. If you have a plugin that requires the JUnit framework, you must repackage your plugin to include it.
• The class com.dotmarketing.cache.StructureCache was refactored to com.dotmarketing.cache.ContentTypeCache. Any references in plugins or other locations should be updated to the new class name when upgrading.
• Updated the CMIS library to version 1.3.
• The HTML code returned for page redirects has been changed from 302 (moved temporarily) to 301 (moved permanently).
• The navtool Velocity viewtool now accepts a navigation level, allowing you to display the navigation from any level in the navigation tree.
• The jsontool and importtool Velocity viewtools now accept a timeout value to prevent long waiting requests from stalling threads.
• The StructureCache class has been refactored to the ContentTypeCache class.
• Any plugins or code which imports the StructureCache must be refactored to refer to the new class.

Fixes

• Added ability to add files without extensions via webdav
• Improved 1.9 to 3.2.4 upgrade
• Improved logging for the Migrate to Content functionality
• Cut/Paste fixed on Legacy Pages
• Added config to sleep during Reindex logic
• Improved the performance for File Assets when getting their dimensions 

Issue Tracker

• https://github.com/dotCMS/core/issues?q=is%3Aissue+milestone%3A3.2.4+is%3Aclosed

Improvements

• Improvements to Reindex Logic on Failures in ElasticSearch 

Issue Tracker

• https://github.com/dotCMS/core/issues?q=is%3Aissue+milestone%3A3.2.3+is%3Aclosed

Fixes

• Fixed issues with What's Changed functionality in Edit Mode 
• Fixed some issues with Publishing content in multiple languages 
• Fixed some major performance issues with legacy pages meaning pages that are not content

Things to Know

• dotCMS  no longer supports or provides the autoupdater. dotCMS 3.2.1 was the last release with it. For upgrading refer to this document http://dotcms.com/docs/latest/upgrade-dotcms

Issue Tracker

• https://github.com/dotCMS/core/issues?q=is%3Aissue+milestone%3A3.2.2

Improvements

• Updated Spring OSGi example plugin from Spring 3 to Spring 4.
• Made multiple performance improvements.
• Sessions are no longer required and load balancer stickiness is not longer mandatory for front end site delivery in a cluster (the admin functionality and multilingual sites where languages can be toggled still require sessions).  By default, dotCMS still creates sessions for clickstream tracking.  You can turn off automatic session cookie creation by setting ENABLE_CLICKSTREAM_TRACKING to false in your dotmarketing-config.properties.

Fixes

• Fixed the key value field losing data after rendering in the UI.
• Fixed the DB pooling parameters. The context.xml shipped with 3.2 still used Tomcat 7 specific properties which no longer work with Tomcat 8, specifically the maxActive configuration option has been renamed to maxTotal and the maxWait configuration option has been renamed to maxWaitMillis.
• Fixed issues with images in a multi-lingual site
• Fixed static plugin compiling issues with Java 7 and 8
• Fixed multiple issues with the Navtool Viewtool and Multiple Languages on Pages as Content

Things to Know

• dotCMS will no longer be supporting or providing the autoupdater. dotCMS 3.2.1 will be the last release that can be updated to using it.  Moving forward, clients should follow the straightforward upgrade steps found here : http://dotcms.com/docs/latest/upgrade-dotcms
• Everyone running stock dotCMS (meaning running in Tomcat not running as a WAR) and upgrading to 3.2.1 should copy the 3.2.1 context.xml to your Config plugin and replace your connection settings with the new, tomcat 8 specific settings. It has the updated Tomcat 8 datasource properties.
• JbossRulesFilter has been commented out in the web.xml by default.

Issue Tracker

• https://github.com/dotCMS/core/issues?page=1&q=is%3Aissue+milestone%3A3.2.1+is%3Aclosed

Improvements

• Ships with updated Tomcat 8.0.18
• Java 8 now supported. You can still run Java 7 if needed
• Added 3 new out of the box Actionlets for Custom Workflows (Email, Auto Set Value, and an Auto Push)

Fixes

• Fixed the random sort on pull contents
• Fixed some issues with Weblogic
• Fixed 3.x issue where the history code fields in containers was not saved

Things to Know

• If using the Autoupdater you will need to alter any plugins that reference Tomcat as the directory is different with the new Tomcat version. ie.. server.xml, ROOT.xml or context.xml

Issue Tracker

• https://github.com/dotCMS/core/issues?page=2&q=is%3Aissue+milestone%3A3.2+is%3Aclosed

New Features

• HTML Pages are now Content
• As content, HTML Pages enjoys all of the features of content.  i.e. workflow, versioning, multilingual support, pessimistic locking etc.
• To support all the new functionality Edit Mode has been improved on the left side controls when editing an HTML Page as Content including Workflow Controls
• Pages can now exist on the root of a host. This means that if you have a page on the root of your site you no longer need the Virtual Link to map your home page
• Pages no longer require a file extension
• Pages can have UTF-8 URIs.
• Added a more secure Viewtool to query the dotCMS DB directly. The new tool is mapped to com.dotcms.rendering.velocity.viewtools.SQLResultsViewTool@777f8863. The old method in the CMSMacro Viewtool has been deprecated.
• All Enterprise versions have added the ability to pass Elasticsearch queries directly into dotCMS. This allows greater flexibility. The queries can be passed in via REST, directly to our APIs in Java, or from Velocity via a Viewtool
• There is a REST example of this using Geolocalization on the new starter site
• This opens the possibilities to using functionality like suggestion, facets, geolocalization etc…
• There is a new portlet that can be used to test queries

Overview of Fixes/Improvements

• Fixed front end issue where some special characters would use excess CPU cycles
• A number of security improvements have been made regarding how dotCMS manages cookies
• Timemachine will now copy dotAsset files
• The Activity Logger is now logging more events on content modifications
• Fixed an issue where the back end session would time out while logged in
• The CSV Content importer now accepts more date formats
• Updated to the latest ElasticSearch (v1.4.2).  This will necessitate a reindex on upgrade
• Front end forms have much improved multilingual support
• JGroups library was upgraded which should prevent a small potential memory leak when running a cluster
• Many fixes to the Integrity Checker and Push Publishing infrastructure
• Improved the SASS/LESS infrastructure.  There is still an issue with SASS on Windows which is still not working. https://github.com/dotCMS/core/issues/7236
• Improved the REST Portlet infrastructure for those creating portlets in the backend
• Fixed plugins broken from previous TinyMCE upgrade
• LDAP and WebDAV work properly now
• Date ranges are now supported from the Content Search Manager
• Worked with partner to allow them to run with Azure MSSQL database though Azure is not an officially supported dotCMS stack component

Things to Know

• Over 200 fixes have been made between 3.0 and 3.1
• This is the last release that targets Java 7.  3.1 will NOT work in Java 8.
• You can use the Autoupdater to update from 3.x to 3.1 but you cannot use it to update from any pre 3.0 release
• Because of the ElasticSearch upgrade, it is recommended that you run a full index after you upgrade dotCMS
• There is a new property in the dotmarketing-config.properties files named. CMS_INDEX_PAGE.  This setting controls what page is returned when the client requests a folder. (i.e. URL ends with “/”)  Its default setting in this release is “index” without extension.  If you are upgrading from a previous version, you should either change this to be “index.html” or you will need to change the name of the default file in every folder on every host.
• There is now a property named DEFAULT_PAGE_TO_DEFAULT_LANGUAGE which defaults to true. Because pages can now exist in many languages it is possible to hit a Page URI in a language that doesn’t exist. By default the dotCMS will return the page in the default language but render the content in the appropriate language. This mimics the functionality of pages and multilingual support in all dotCMS versions prior to 3.1.  If you set this to false then the dotCMS will return a 404 if the page doesn’t exist in the visitor’s language.
• ESAPI Filter is now turned off by default.

Issue Tracker

• https://github.com/dotCMS/core/issues?q=is%3Aissue+milestone%3A3.1+is%3Aclosed

Fixes

• Fixed some typos in the backend
• Updated some missing files in the WYSIWYG editor that was causing issues with both workflows and front end content submission
• Addressed a leak from a possible closed connection while requesting a file
• Updated the helloworld plugin for 3.0
• Improved the logic when running a full reindex.  Helps with those who run a reindex that never finishes

Things to Know

• 3.0 doesn't have support for the Autoupdater yet so users of 3.0 will have to manually update

Issue Tracker

• https://github.com/dotCMS/core/issues?q=is%3Aissue+milestone%3A3.0.1+is%3Aclosed

Improvements

• Ships with updated Tomcat 6.0.41
• Security Improvements:
• Cookies can be forced to use the Secure Flag/SSL Only to prevent session hijacking
  - http://dotcms.com/security/SI-2
• Cookies can be forced to HTTPOnly
  - http://dotcms.com/security/SI-24
• TinyMCE upgraded to version 4.1.6

Fixes

• Number of fixes to the Integrity Checker and Push Publishing
• Navtool cache fix prevents unnecessary DB queries
• Reindex Process made more robust and fault tolerant.

Things to Note

• If you have a plugin that configs TinyMCE, you will need to review the config to ensure that it is compatible with TinyMCE version 4.x
• The security improvements noted above can be turned on or off (or set to https only) in the dotmarketing-config.properties file.

Issue Tracker

• https://github.com/dotCMS/core-2.x/issues?page=1&q=is%3Aissue+is%3Aclosed+milestone%3A2.5.7

Fixes

• Addressed issue with saving containers after upgrade to 2.5.5. This was the only thing addressed in 2.5.6

Improvements

• Integrity Checker & Conflict Resolver - This is a new feature in the Publishing Environments tab (system/configuration/publishing environments) that allows users to check for and resolve conflicts that that may exist between servers. Prior to this there were some conflicts which Push Publishing was unable to handle
• Improved the Job Scheduler�۪s ability to handle errors and delete jobs which no longer exist
• To help developers build workflows, ActionID is now displayed for reference on the Workflow screen
• Significant improvement to the logging of errors while Push Publishing to help with troubleshooting
• Improved performance and stability of the Reindex process
• Improved issues with the Tag Manager when working in other languages
• Improved support for Unicode characters with File Assets

Fixes

• Fixed multiple bugs in the DB layer which caused breakdowns when saving especially during Push Publishing
• Fixed issue when adding comments that would occasionally mess up the comments count
• Fixed absolute URLs in vanity URLs when referencing a dotcms host
• Fixed issue where limited user couldn�۪t create a page using layout templates
• Fixed the help screen when logged in via HTTPS
• Fixed issues with multi lingual content and Push Publishing where titles wouldn�۪t show
• Fixed the reorder menu issue (impacted version 2.5.4 only)
• Fixed ability to reassign workflow directly from the Edit Content Screen
• Fixed Push Publishing issue when Pushing content that didn�۪t have a version in the default language
• Fixed multiple issues when using the Site Search Highlighter on a cluster
• Cleaned up duplicate references in the web.xml which prevented deploy on some app servers
• Fixed issues related to the compare method in later versions of Java

Things to Note

• The Navigation Cache would clear on startup but this doesn�۪t happen anymore
• If you run the integrity checker your DB Config needs a user which can add/delete FKs on dotcms DB Tables

Changelog

• https://github.com/dotCMS/dotCMS/issues?milestone=21&state=closed

Fixes

• Made forgotten password process more secure - now emails token for password reset.
• Increased security algorithm for generation of passwords.
• Fixed issue in Edit Mode which could resulting a 404 when clicking on a Menu Link.
• By default you cannot redirect to an external referrer. To change this default behavior, set DISABLE_EXTERNAL_REFERERS=false in dotmarketing-config.properties file of your configuration plugin.
• Increased security for comments functionality.
• Increased security to prevent header injection.
• Improved XSS prevention algorithms.
• Fixed live site caching issue when updating files.
• Fixed CSV import when importing to a host.
• Increased security of AjaxFileUploadServlet.
• Improved security for system user.
• Locked down multiple security issues.
• Turned off autocompletion of password fields.

Changelog

• https://github.com/dotCMS/dotCMS/issues?labels=bug&milestone=20&page=1&state=closed

Fixes

• Fixed multiple IE issues in the backend
• Fixed multiple errors in the browser's console in the backend
• Improved some system performance when running under load and during site search indexing
• Fixed a few Push Publishing Issues
• Fixed multiple issues for WebSphere 8
• Fixed the Auto Login Checkbox
• OSGi can now be disabled
• Tags will now be imported properly when loading users from a CSV file

Changelog

• https://github.com/dotCMS/dotCMS/issues?milestone=18&state=closed