Release notes are cumulative for all builds of v2.5

• New Features
  • VGO-2171 - Autocomplete has been disabled in password elements. However, the setting may be ignored by the browser.

• Improvements
  • VGO-2128 - Improved authentication security by removing unnecessary functions from asmx and web API controllers.
  • VGO-2172 - Implemented security headers for improved security. The URL Rewrite extension for IIS must be installed. It can be downloaded from https://www.iis.net/downloads/microsoft/url-rewrite.
  • VGO-2173 - A vulnerability was addressed were passwords were stored in the password history table in plain text.
  • VGO-2300 - Addressed an issue where a resource Forbidden message was displayed even though the user credentials were correct.

• Bug Fixes
  • VGO-2146 - Addressed a vulnerability where an attacker might bypass authentication.
  • VGO-2148 - Address a vulnerability where information was disclosed in the form of API documentation.
  • VGO-2149 - Addressed a vulnerability where access rights at the function level have been verified.
  • VGO-2150 - Addressed a vulnerability to remote code execution (RCE).
  • VGO-2151 - Addressed a vulnerability to SQL injection attacks originating from input verification.
  • VGO-2152 - Addressed CSRF vulnerability.
  • VGO-2153 - Addressed a vulnerability where the application allowed the upload of an SVG file containing HTML content.
  • VGO-2154 - Addressed a vulnerability where references to internal objects were not secure.
  • VGO-2155 - Addressed a vulnerability denominated Persistent XSS attack where an injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc.
  • VGO-2156 - Addressed a vulnerability where some sensitive data was exposed to attack.
  • VGO-2157 - Addressed a vulnerability where attacks aim at discovering non-public web services by retrieving their WSDL files.
  • VGO-2159 - Addressed a vulnerability where by using old session cookies, user profiles can be accessed.
  • VGO-2176 - HTTP is no longer permitted. HTTPS must be deployed with a valid certificate.
  • VGO-2177 - The session timeout setting for end-users and administrators have been merged. There is only one setting across the site.
  • VGO-2182 - Some ad blocker extensions to the browser may cause problems with the Admin Console. Please disable any extensions that block the Versago site.
  • VGO-2185 - Addressed an issue where the password field for a new user was not large enough. Expanded to max 32 characters. See https://wiki.twbs.com/doku.php/versago/role_profile_user_configuration#user_details_core_information for more information.
  • VGO-2192 - Addressed a vulnerability where several HTTP methods designed to aid developers in deploying and testing applications were allowed.
  • VGO-2195 - Addressed a vulnerability where a Referrer-Policy was not being used.
  • VGO-2196 - Addressed a vulnerability where HTML comments were exposed.
  • VGO-2220 - Addressed an issue with reports that allow record submission where the field's length created to store the submission was limited to 50 characters.
  • VGO-2221 - Addressed an issue where action links to an https site were not working properly.
  • VGO-2235 - Mask passwords will no longer be displayed in pages where there is a password field such as DB connections and Email settings. If the password needs to be changed, the Update Password button must be clicked first in order to enable the field.
  • VGO-2240 - Address an issue where action links did not export correctly. If a form contained multiple action links and it was imported and exported, all links would point to the same link in the new environment.
  • VGO-2247 - Addresses an issue where images in Crystal Reports were not displayed.
  • VGO-2296 - Addressed an issue where system session time out did not follow the set value.

• New Features
  • VGO-1543 - Versago now includes support for presenting images associated with records (both header and detail) displayed in Versago lists (reports) and forms. Optional sizes for thumbnails, mouse-over preview, and large images can all be associated with a single record. A typical use-scenario for images would be

adding items to an order form or materials to a production order. Less obvious applications might be images of schematics, assembly instructions, or other documents. A Bizweaver workflow is also available to aid in management of the images.

• Improvements
  • VGO-1633 - Scrolling for forms that use a detail (grid) section has been modified so that the Add, Edit, and Delete buttons for the detail section remain visible. This will make changes easier in grids where there are a large number of rows.

VGO-2000

Version of data connector (HANA Client) updated to 2.4. See https://wiki.twbs.c o m /do ku.php/bw/insta lla tio n_upgr a de _guide for information.

Bug Fixes Information on fixes to specific functionality issues reported by customers and consultants is found in this section.

• VGO-1548 Addressed an issue where report display option “Display in new browser tab” was not being included in export/import. Addressed an issue where a new instance of Versago could not be installed if Bizweaver had been previously installed on the same server. * VGO-1557

Addressed an issue where profiles for SAP Business One HANA installations could not be created.

VGO-1562

Addressed an issue where a multi-select ( or payments) report would reset the page when a value was changed. This was causing difficulties with large selection lists. Page now remains at the current position when a value change is made.

• VGO-1563 Addressed an issue where multi-select reports would fail if the data being saved contained a date. * VGO-1564

Addressed an issue where decimal values did not sort correctly when the data source is HANA.

• VGO-1565 Addressed an issue where non-displayed user-applied filters were not applied to the data result set as expected. * VGO-1570

Addressed an issue where images were not displayed in report columns greater than second.

• VGO-1572 Addressed an issue where “image hover” was not displaying in the first row of a report. * VGO-1574

Added image field to Print version export.

• VGO-1580 Addressed an issue where the option to not display a column name in a report was not working when the report is used as a sub-report. * VGO-1586

Addressed an issue where not all needed user information was being captured when an initial user is created during installation. All values normally required for a new user are presented and must be populated.

Addressed an issue where the position of a form control being “dragged” to position on the form layout was offset from the cursor.

• VGO-1590 Addressed an issue where “large” import files would not be processed. The base limit is now 100MB. A warning message is raised for files over 100MB but processing will continue. * VGO-1599

Addressed an issue where menu information was not included in an export.

• VGO-1600 Addressed an issue where menu information was not included in an export. * VGO-1601

Addressed an issue where the Home and Favorites icons did not use the theme color scheme as expected.

• VGO-1612 Addressed an issue in multi-select reports where the selection checkbox would be deselected when changing an editable value field. * VGO-1625

Addressed an issue where an entered Expiration Date value was not being displayed as expected in the Admin function.

• VGO-1627 Addressed an issue where available Categories were not displayed in sorted order in the drop-down list. * VGO-1628

Addressed an issue where mandatory drop-down fields in a form were not catching the fact that a value had not actually been selected. The normal “mandatory” message is now displayed.

• VGO-1631 Addressed an issue in Form development where the data type of a numeric database column was treated as a text column. The issue occurred when the “search” function was used to find a database field in the list of available fields. * VGO-1632

Addressed an issue where Home and Favorites icons were not displayed in MS Edge browser.

Addressed an issue where expiration dates were not being saved correctly for Banners and News & Announcement items.

• VGO-1660 Addressed an issue where Menus were not being included in the Export process, even if selected. * VGO-1661

Addressed an issue where records from a multi-select report were saved with an additional HTML tag when a text value contained an “&” character. This only occurred on the first record of this type that was selected.

• VGO-1736 Addressed an issue where cloned forms would not upen in certain, very specific, situations. * VGO-1739

Addressed an issue where the label on standard action buttons (Save & New, Save & Close, etc.) could not be changed as was possible in earlier versions.

• VGO-1741 Addressed an issue where v2 Forms called from a report where the Action Link used a condition. * VGO-1743

Resolved an issue where user-applied filters could not be selected when using Android 10

• VGO-1744 Addressed an issue where data could be incorrectly accessed in a public form. * VGO-1745

Address an issue where the “Add Day” formula in a form was not calculating correctly if the target field was NOT set to use the “MM/dd/yyyy” display format.

• VGO-1746 Address an issue where columns associated with an action link we not being displayed in an export for print. Also addressed a similar issue where KPI icons were not displayed in the same scenario. VGO-1758 Address an issue where the browser time-out values were not being reset properly when the user logged out. Addressed an issue where a new password assigned to an existing user during the upgrade process would prevent the user for logging in after the upgrade. * VGO-1765

Addressed an issue where existing report action link conditions could not be modified as expected.

• VGO-1766 Addressed an issue where the [Add Day] formula in a form was not working as expected. * VGO-1767

Addressed an issue where the Reports configuration page was being presented incorrectly in certain circumstances.

• VGO-1768 Addressed an issue where the drop-down list for User Applied filters did not display values as expected in certain circumstances. * VGO-1769

Addressed an issue where an error was being raised when a Data Source Type value was not selected in the initial report configuration field.

• VGO-1772 Addressed an issue where multi-line text boxes could not be entered when marked as Editable. * VGO-1777

Addressed an issue where a duplicate Calculated Field name in a report was not flagged as an error.

• VGO-1778 Addressed an issue where the Color Picker form was not displaying correctly in some circumstances. * VGO-1779

Addressed an issue where a new row in the KPI configuration was not being added as expected.

• VGO-1782 Addressed an issue where the database [Submit] button in a multi-select report was not being displayed in certain circumstances. * VGO-1787

Addressed an issue where binary data fields in a multi-select report would prevent the record(s) from being inserted into the database. The data from these field will no longer be inserted.

VGO-1789

Addressed an issue where a multi-select report could be configured without specifying a database for the records to be saved.

• VGO-1790 Addressed an issue where SAP Business One queries raised an issue when used as a report Data Source. * VGO-1797

Addressed an issue where eCheck input fields were not being displayed if no credit cards were also selected as available payment options as well.

• VGO-1842 Addressed an issue where extraneous text was displayed in charts when a tool tip referred to a date value. * VGO-1860

Addressed an issue where an exception error was raised when logging into Versago in certain (rare) situations.

• VGO-1862 Removed the ability to display the password in the Database Connection configuration page. * VGO-1864

Added “Mandatory” flag to DB Type field in Database Configuration page.

• VGO-1866 Change the way the “country” value is saved in a User configuration. The country will need to be reselected if the user is updated. * VGO-1871

Additional logic has been added to the login process so that if the administrator changes the user password security to a stronger level AND the user's password does not meet the required strength they will automatically be redirected to the “Reset Password” page.

• VGO-1872 Addressed an issue where spaces were not allowed in strong level user password as indicated in the notes on the setup page. * VGO-1978

Addressed an issue where a Crystal Report using a HANA database as the data source did not load correctly

• VGO-2019 Addressed an issue where the “mandatory” option was not being correctly handled on numeric form fields. * VGO-2037

Addressed an issue where text and date fields in a form were cleared when a custom_PreExecute error was encountered from the [Save and New] button.

• VGO-2046 Addressed an issue where numeric values using “.” for thousands and “,” for decimal as separators (e.g. 1.000,00) were not being accepted into form fields correctly. * VGO-2082

Addressed an issue where form attachment information was lost when a custom_preExecute error message was presented.