Release Note

Download 7.0.9

Bug fixes

• Security fixes. Among others the used logging library was updated to the latest version. See here.
• Data sources used in selection elements are displayed correctly again in the element properties.
• Appointment calendars used in appointment finders are displayed correctly again in the element properties.

Checksums

• formcycle-checksums.txt
• formcycle.war.md5
• formcycle.war.sha1
• formcycle.war.sha256
• frontend-server.war.md5
• frontend-server.war.sha1
• frontend-server.war.sha256
• frontend-server-inbox.war.md5
• frontend-server-inbox.war.sha1
• frontend-server-inbox.war.sha256

Changes

• The used logging library has been updated to the latest version.
• Via application settings it can be specified whether information about the server should be transferred to the licensing system.

Bug fixes

• The default settings in the designer are saved correctly again.
• If there are multiple form elements with the same name then the JavaScript function getLabel() returns the label for each of the form elements.

Checksums

• formcycle-checksums.txt
• formcycle.war.md5
• formcycle.war.sha1
• formcycle.war.sha256
• frontend-server.war.md5
• frontend-server.war.sha1
• frontend-server.war.sha256
• frontend-server-inbox.war.md5
• frontend-server-inbox.war.sha1
• frontend-server-inbox.war.sha256

Download 7.0.7

Changes

• XFC_METADATA.urls now includes request & requestBase:
  • request: URL for a request to the current form with fragment and query parameter.
  • requestBase: URL for a request to the current form without fragment and query parameter.
• Dates are specified with the Export as XML action with GMT time zone.
• Enhancement of plugin API for form resources.
• In Designer, a warning message appears if the web socket connection could not be established.
• Processing forms with plugin actions results in an error if the corresponding plugin has been uninstalled.
• Forms with invalid workflow are switched directly to maintenance mode after import / after update.

Bug fixes

• The logging library has been updated to the latest version to close a security hole.
• Unify the replacement of the variable [%lang%].
• The JavaScript function getLabel() returns exactly one label even for selection elements (in checkbox/radio button form).
• The error() and errorFunc() JavaScript functions can also be used to set errors for selection elements (in question form).
• System messages can be created, edited and deleted again.
• The responsive behavior of images has been improved.
• The state of form records with new workflow is taken into account during Excel/XML export.
• Commas no longer cause incorrect table structure when exporting forms to Excel.
• Formatting of text elements is applied correctly in the form.
• Automatic height adjustment of Textarea elements works even if the element is initially hidden.
• HTML response pages can be used with additional language variations.
• The HTML attribute aria-label is set correctly for fieldset and container elements.
• Performance of forms has been improved.
• Errors in evaluating the permission to create / edit forms have been fixed.
• Data sources and counters can be requested in the form via the corresponding URL also with frid as parameter.
• Fixed minor interface errors.

Checksums

• formcycle-checksums.txt
• formcycle.war.md5
• formcycle.war.sha1
• formcycle.war.sha256
• frontend-server.war.md5
• frontend-server.war.sha1
• frontend-server.war.sha256
• frontend-server-inbox.war.md5
• frontend-server-inbox.war.sha1
• frontend-server-inbox.war.sha256

Download 7.0.6

Bug fixes

• The button action Send works correctly again on frontend servers.
• The button actions Submit no save and Submit popup not save are working correctly again.
• User defined events can be triggered correctly in the inbox again.
• The form store is now always displayed in the correct language.

Checksums

• formcycle-checksums.txt
• formcycle.war.md5
• formcycle.war.sha1
• formcycle.war.sha256
• frontend-server.war.md5
• frontend-server.war.sha1
• frontend-server.war.sha256
• frontend-server-inbox.war.md5
• frontend-server-inbox.war.sha1
• frontend-server-inbox.war.sha256

Download 7.0.6

Features

• Preconfigured forms from various application areas can be easily installed and used via a form store.
• Forms can be tagged with filterable keywords.
• With the new permission Switch to any state, form records can be moved to any state, regardless of the access configuration to the state.
• In the settings of the workflow action Compress ZIP, a format can now be specified which determines the folder structure within the ZIP file.

Changes

• Form records in states of the new workflow are not accessible via the Processlink (variable: [%$FORM_PROCESS_LINK%]) by default. To make form records accessible to external access, this must be explicitly configured in the state settings.
• Forms with incorrect but disabled actions can be saved without switching the form to maintenance mode.

Bug-Fixes

• Performance issues with form validation have been fixed.
• Validation errors in the form are positioned correctly.
• Form record data is locked during complete processing. The processing lock can be removed in the inbox if needed.
• The provided HTML templates in the workflow action HTML response page are sorted alphabetically.
• The Inbox restriction when calling forms via the ProcessLink (variable: [%$FORM_PROCESS_LINK%]) takes effect correctly again for forms with old workflow.
• When updating a form with new workflow, errors no longer occur.
• The configured file name in the element settings of upload elements is also taken into account in the attachment overview of the inbox.
• Fix minor interface and translation errors.

Checksums

• formcycle-checksums.txt
• formcycle.war.md5
• formcycle.war.sha1
• formcycle.war.sha256
• frontend-server.war.md5
• frontend-server.war.sha1
• frontend-server.war.sha256
• frontend-server-inbox.war.md5
• frontend-server-inbox.war.sha1
• frontend-server-inbox.war.sha256

Download 7.0.4

New system variables

[%$CLIENT_MAIL_SENDER%]

Returns the mail sender address of the client.

[%$CLIENT_MAIL_SENDERNAME%]

Returns the mail sender name of the client.

Both variables are used by default for the Email from and Sender name parameters, respectively, in new Email actions.

New application properties

mail.smtp.connectiontimeout

SMTP Socket connection timeout value in milliseconds.

mail.smtp.timeout

SMTP Socket I/O timeout value in milliseconds.

Bugfixes

• The use of multiple filters in form-specific inbox views works correctly again.
• The inbox editor role has all the subrights of the inbox super right by default.
• When creating a form with new workflow from a form with old workflow, the states and their references inside the form are inherited.
• Client-side performance of forms has been improved.
• Fixed some bugs in client-side validation & updating of forms.
• The JavaScript functions setRequired(...), setGroupReq(...), setMinValue(...) & setMaxValue(...) work correctly again and are applied to all selected form elements.
• The selection list of mandatory selection elements does not collapse again directly when the element is clicked.
• Form titles are no longer truncated on import.
• Form printing via the Print service no longer prints a gray line at the beginning of pages.
• When printing forms via the print service, the Mandatory fields hint is only printed if it is also enabled and the print service action does not suppress this.
• The Layout (CSS) of the form is also applied in the form preview.
• Text elements are displayed in the preview or live mode of the form exactly as they are in the form designer.
• The empty if hidden option of form elements works correctly again.
• Form elements with checkboxes that still have the checked option enabled can still disable this option. This option of checkboxes was removed in version 7.0.0.
• The action placeholder [%$<action name>.RESULT%] returns a JSON value, such as a map.
• Improved warning messages when importing forms with missing dependencies.
• Fixed a bug in the plugin interface ISearchTermHandler#triggerSearchTermNotExists.
• Deleting form versions no longer causes an error.
• Unnecessary error logs in the designer have been removed.
• Help links of endpoints in the workflow designer point to the correct help pages.
• Fixed minor UI errors.

check sums

• formcycle-checksums.txt
• formcycle.war.md5
• formcycle.war.sha1
• formcycle.war.sha256
• frontend-server.war.md5
• frontend-server.war.sha1
• frontend-server.war.sha256
• frontend-server-inbox.war.md5
• frontend-server-inbox.war.sha1
• frontend-server-inbox.war.sha256

Download 7.0.3

Changes

• Performance optimization for database updates.
• The content type of the requests of the HTTP-Request action of the new workflow is application/x-www-form-urlencoded if no files are transferred. The content type is multipart/form-data when files are transferred or when the "Always use multipart request" option is enabled.

Bug fixes

• Forms from version 5 can be opened again without errors in the form designer.
• If URLs are removed from the Look & Feel settings, an error no longer occurs on the login page.
• JavaScript change events update the dependencies of question select elements. e.g. by $("[data-name=sel1]").trigger("change").
• The JavaScript function setDataType() is applied correctly.
• Fixed an error that could occur when updating a form version.
• Performance issues with nested conditions have been fixed.
• The POST-Request action of the old workflow works again as in version 6, i.e. the content type of the request is always multipart/form-data, unless "Do not transfer files (no multipart request)" is active. Then the Content-Type is application/x-www-form-urlencoded.
• Fix minor UI errors.

Download 7.0.2

Changes

• Unified result for incorrect Counter queries via the counter servlet.
• Form variables can also be selected with the "data-name" attribute, e.g.: $("[data-name='variableName']")
• From the Modify Counter action, a new Counter can be created directly.

Bug fixes

• Appointments of form records with the old workflow are displayed again in the calendar view of the inbox.
• Fixed a bug that prevented the update to version 7 on certain systems.
• The form overview can be opened again without error on all systems.
• The form export as WORD document (.docx) with very large textareas does not cause an error anymore.
• The profile export of forms with invalid preview images no longer leads to an error.
• Users who log in to a form via Kerberos can access the form again even if no corresponding LDAP Users or LDAP groups have been configured.
• Form submissions with new workflow now show up in the statistic.
• Form log in attempts (system log ins) with invalid credentials increase the invalid log in counter by 1 again, not 2.
• Workflow events are only executed if they are available.
• Calling restricted forms from a frontend server no longer causes errors.
• Invalid CSS no longer results in an error in the form designer.
• If repeated form elements are dragged into a repeated container or fieldset, then the repetition of the inner element is disabled.
• Minor errors in the english translation have been fixed.
• Minor UI errors have been fixed.

Download 7.0.1

Features

• The POST request action of the new workflow is now called HTTP request and supports additional request methods by specifying the HTTP verb. Furthermore, it is now possible to set which status codes of the HTTP response should be considered as errors.
• The number of elements in JSON arrays in variable values can be evaluated with .length().
• Improved keyboard support in the workflow designer. The element selection dialog can be navigated with arrow keys and elements can be inserted with Enter. Escape closes the dialog.

Changes

• Access control Header are also set for HTTP OPTIONS when requesting forms.
• Spacing between paragraph elements in HTML email messages has been reduced.
• Improved client-side API for form element widget plugins.
• Type declarations for the client-side API are available in the NPM registry of FORMCYCLE.
• Form element widget plugins can specify if or when they are available in the form designer.

Bug fixes

• Fixed a bug where the wrong form was selected on the My Forms page under certain circumstances.
• Fixed a bug where disabled repeating form elements did not show the correct value.
• Certain special characters in PDF Fill no longer cause processing errors.
• Variables are no longer inserted with unnecessary HTML tags in the email message editor.
• Missing variables in the variable dialog have been added.
• Search confirmation by Enter in the designer element search box no longer results in an error.
• Improved search for installed fonts.
• In the properties of the workflow action LDAP Query, filters for return values can also be deleted again.
• The variable [%lang%] is evaluated consistently.
• The search in the form overview has been improved.
• Hints about validation errors in autocomplete input fields no longer disappear on submit attempts.
• Error messages for autocomplete input fields no longer disappear when submit buttons are clicked.
• Menu items for frontend servers are not displayed if the license does not allow this.
• Minor interface bugs have been fixed.

Download 7.0.1

New visual workflow designer

The new visual workflow designer lets you customize how form data is processed in a new and intuitive way via drag & drop. Until now, the old workflow engine was based on states and state changes. With the new workflow engine comes a new paradigm -- event-based processing. You can drag & drop events to the flowchart area and add actions that you wish to run when the event occurs. Xima® Formcycle ships with many standard events such as: an event when the form was submitted via submit button, when the user has confirmed the double opt-in, time-based events that occur at a specified point in time, and many more. More events can be added via plugins. Conditions are now representend graphically as a fork in the flowchart, and you can also add multiple conditions connected via AND and OR.

The new workflow engine and the new workflow designer represents the future of form data processing with Xima® Formcycle. Later versions of will add more events and actions. The old workflow engine and the old workflow tree still exists and can be used, but is deprecated and will be removed in an upcoming release. Whenever possible, prefer the new workflow designer, and update existing forms.

Additional features

W3C compliant mode

The new form setting W3C compliant mode, when enabled, ensures that the HTML created for the form is well-formed and complies with the W3C specifications . This settings is enabled by default for all newly created forms, and disabled for existing forms. When enabled, certain HTML attributes such as cn=... and xn=... are omitted, as these are not W3C compliant. When you enable this mode for existing forms, you may have to update JavaScript and CSS selectors. Use [data-cn=...], [data-name=...], [data-xn=...] etc. instead. These data attributes are always added, even when the W3C mode is disabled, so you can upgrade your JavaScript and CSS one step at a time.

Submit button validation

The new form setting Validate submit button prevents malicious users from manipulating the workflow. In the old workflow, it was common to check whether a certain button was used to submit the form and perform certain action if so. This presents a problem, however: Even when a submit button was not available in a certain state, users could still set the submit button name to that button's name. When the Validate submit button setting is enabled, this is no longer possible, the system now checks whether the button is truly available. This setting is enabled by default for newly created forms. We recommend you leave this setting enabled. In some cases you may have to disable it, such as when you wish to use custom submit buttons created via JavaScript.

Form element name refactoring

When you change the name of a form element, certain references may not work anymore, such as when the form element is selected via JavaScript or CSS, or via form placeholders. The new refactoring dialog lets you search for and replace these references.

Counter

The new counter feature lets you define an arbitrary number of global counters for keeping track of incremental numbers. You can change, increment and decrement counters via the new counter workflow actions. Finally, you can also access the current value of a counter via system variables.

New workflow action: Set server attribute

The new workflow action Set server attribute lets you store custom data on a form record. To read the custom attributes, you can use a special placeholder variable.

New workflow action LDAP query

Similar to the database query action, the new workflow action LDAP query lets you retrieve data from an LDAP server from within the workflow.

Headers for the POST request actions

You can now specifiy additional and custom HTTP header parameters in the workflow action POST request.
In addition to the MIME-Type specification, file attachments also contain charset information for specifying the character set

Access form record attachments in the new workflow

For workflow actions where you can select files, you can now also select attachments from the form record, such as for the  attachments of an email action or the files for the Save to file system action.

Login protection for each state

Previously, you could only select the allowed login methods globally for each form. This is now possible for each state separately. You can choose whether a login is required at all, and if so, how the user may log in.

OAuth 2.0 support for external users

You can now add OAuth 2.0 identity providers when users open a form.

Context-sensitive logging pattern parameters

Logging patterns now support several context-sensitive parameters such as the current form record ID. This may be useful when you need to analyse log files on a system with a high load.

Changes

• Locked form records can be unlocked in the inbox, such as when a form record is saved or a double opt-in is in progress. This requires a user to have a special role permission.
• Form records waiting for a double opt-in confirmation can be checked and the double opt-in email can be sent again. This requires a user to have a special role permission.
• Scheduled actions are shown in the history of a form record in the inbox. This includes timed events.
• A new role permission was added for editing the form version of a form record in the inbox.
• The action Redirect of the new workflow now lets you enter a URL directly. 
• The new form setting Add name as CSS class, when enabled, adds a CSS class with the name of the form element. This makes it easier to select form elements via JavaScript and CSS: $(".tfEmail") instead of $("[data-name='tfEmail']") This settings is enabled by default for newly created forms.
• Even when a plugin bundle is disabled, the plugins contained in the bundle are still shown.
• The HTML template system information was deprecated and should not be used anymore.
• Forms are always exported in the new format. Support for the compatibility format was dropped. Export files with the old format can still be imported. Importing forms with the new workflow requires at least Xima® Formcycle version 7.0.0. Importing forms with the old workflow requires at least  Xima® Formcycle version 6.2.0.
• The values for the terms of services, the imprint, and the privacy policy are unset by default. When you update Xima® Formcycle and these properties are set to their previous default values, these values will be cleared.
• The sadmin account no longer has access to newly created clients by default. It must be granted by a client administrator first.
• For LDAP connections, the server certificates are now validated. It may be necessary to import the root certificate with which the server certificate was issued into the Java TrustStore.
• Dependencies used by Xima® Formcycle were upgraded.
• Various bugs and issues were fixed.

New variables

[%$COUNTER_CLIENT.<name>%]

The current value of a counter. 

[%$RECORD_ATTR.<customAttrKey>%]

The current value of a custom form record attribute.

[%$STATUS_TYPE%]

The type of the current state of the form record. Either CUSTOM or RECEIVED.

[%$RECORD_READ%]

Whether the form record was marked as read.

[%$RECORD_UNREAD%]

Whether the form record was marked as unread.

[%$<AKTIONSNAME>.ERROR_CODE%]

Error code of a workflow action, when that action was not successful. 

[%$<AKTIONSNAME>.ERROR_MESSAGE%]

Error message of a workflow action, when that action was not successful. 

[%$<AKTIONSNAME>.ERROR.<JSON_PATH>%]

Error data of a workflow action, when that action was not successful. 

[%$TRIGGER.<JSON_PATH>%]

Lets you access the data of the workflow trigger of the current processing chain. For example, the double opt-in event lets you access the workflow action that initiated the workflow.

[%$LAST_ERROR_CODE%]

The error code of the most recent error that occurred in the new workflow. 

[%$LAST_ERROR_MESSAGE%]

The error message of the most recent error that occurred in the new workflow. 

[%$LAST_ERROR_NODE_NAME%]

The name of the node (action) that most recently failed.

[%$LAST_ERROR_NODE_TYPE%]

The type of the node (action) that most recently failed.

[%$LAST_ERROR.<JSON_PATH>%]

The data provided by the most recent error that occurred. This is a JSON value, you can access individual entries via a JSON path.

[%lang%]

The language used when the form was opened or submitted.

[%xf-qualifier%]

The qualifying name of the submit action, similar to [%xf-action%]. This is usually the name of the button list which contains the submit button that was pressed.

Plugins

• New plugin interfaces for nodes (actions) and triggers (events) of the new workflow.
  The interface (IPluginProcessing applies only to actions of the old workflow engine).
• The plugin interface for old workflow actions is deprecated and support will be dropped in an upcoming release. Existing workflow action plugins should be updated for the new workflow.
• Plugins that make use the de.xima.fc.entities.Status entity should be reviewed. This is the state of the old workflow engine. Form records created with the new workflow engine will not have any de.xima.fc.entities.Status. The new workflow engine uses de.xima.fc.entities.WorkflowState. 
• IPluginFormPreRespondParams#getWorkflowResponse is deprecated, you should use #getTaskExecutionResult for the result of the new workflow.
• New interface for differentiating between different plugin scopes: IPluginScopeClient & IPluginScoopeSystem
• Some dependencies were updated. If you have plugins that include these dependencies as provided, you should update the version and check whether you code is still compatible with the new version provided by Xima® Formcycle.
• Update to CDI 2.0 and JSF 2.3. Plugins with custom user interfaces (XHTML / Beans) should be reviewed. Beans should use CDI (Contexts and Dependency Injection).

Notes

• When you use MySQL, the initial setup may take a long time (up to 90 minutes, especially with MySQL 5) when the information_schema is used. You can add the parameter "useInformationSchema=false" to the JDBC-URL to reduce the required time to about 10 - 20 minutes.
• Recent browser version have introduced a new cookie policy. By default, a cookie is now set with SameSite=Lax. This breaks forms included in your page via AJAX, as browsers will reject the session cookie. Servers must now set SameSite=None. Furthermore, SameSite=None the Secure flag to be set, which in turn requires HTTPS. This means that including forms via AJAX requires HTTPS for new browsers! You can change the value of the SameSite cookie option via System -> General, see also the notes in that menu.  The default value for this option should work in most cases. The default behavior is that SameSite=None and the Secure flag is set when a form is opened via HTTPS. However, when you use a proxy server, depending on its configuration, it may not be possible to detect whether HTTPS is used. If you are certain you always use HTTPS, you can change the default setting so that SameSite=None and the Secure flag is always set.
• Please check your RSS feeds if you are subscribed, the URL may have changed.