Centralpoint Update 8.12.15

The new Admin > File Name Cleanup page finds files and folders under Uploads whose names the site cannot serve, renames them, and updates the content that links to them.

• Scan Uploads lists each name containing & % + # , ;, a character Windows does not allow, or a trailing dot or space, with its planned new name. Blocked characters become _, and a taken name gets _1, _2.
• Find links in content finds the records in site search that link to those names. Links written as a full URL are listed to fix by hand.
• Download CSV lists every rename, every linking record and field, and every full-URL link.
• Fix renames the files and saves each linking record once, with a history version and an event. A fix that stops part way is completed by the next Fix.

Only content in site search is updated. Links outside Centralpoint, such as emails and bookmarks, keep the old names. Find links and Fix require a healthy site search index. Running Fix outside business hours is recommended.

web.config change

The Console web.config gains a <location path="FileNameCleanup.aspx"> entry with httpRuntime executionTimeout="7200", so a long fix is not cut off. Only the Console web.config changes. The page exists only in the Console, so virtual directories running as their own IIS application and client custom code need no change.

Uploaded and imported files are stored with _ in place of & % + # , ;, characters Windows does not allow, and a trailing dot or space, so the site can serve them.

• The rule applies to Design > File Manager, the file upload dialog and FormUpload, the content editor's file managers, File Sharing uploads, zip extraction, the FileDownload, FileAction and ScreenCapture Data Transfer scripts, SharePoint attachments and Word Add-In saves.
• A renamed file is saved beside an existing file of that name, such as name_1.pdf, rather than overwriting it. A name that needs no change still replaces the existing file.
• The Modify File Name website property still applies on top of the rule.
• Moving a file to another folder keeps its name. Only a new file or a rename is cleaned.
• Form emails attach a file whose name contains a comma, such as Last, First.pdf.
• The WordAddInDownload link works for names containing &, # or +.

Existing files are not renamed. Admin > File Name Cleanup handles those.

A recurring Data Transfer that stored a file under a blocked or percent-encoded name, such as A&B.pdf or My%20File.pdf, downloads it once more under the cleaned name. The older copy stays on disk until Admin > File Name Cleanup removes it.

A file sync now completes when a folder it removes from the destination holds a path longer than the Windows limit of 260 characters.

• That folder is removed, and the sync continues with the remaining folders.
• The site's last sync date updates when the sync finishes.
• A folder that cannot be removed, for example because it is in use or access is denied, is skipped while the sync continues.

Built-in plugin scripts now carry a version stamp, so browsers load the updated file after a release instead of a cached copy.

• This covers the ExtDatePicker, ExtFancyBox, ExtFlyoutMenu, ExtWaterMark, ExtPasswordStrength, ExtCalculation, ExtExpandTextArea, KillerCarousel, JPlayer and TaxonomyFileExplorerView CpScripts.
• It also covers the paginator, Google Map, organization chart and thumbnail viewer scripts, and the Resources and Website Links pickers in the content editor.

Pages look and behave the same.

Visitors see the site's own error page in two more cases.

• When the database connection pool is exhausted, the error page now shows its built-in message instead of the server's generic error page.
• An expected error raised by a page, such as a missing template or an unknown feed, shows the error page without writing an ASP.NET warning (Event 1309) to the server's Application event log.

Form emails again include the generated PDF when the form's FilePath ends in /. Since 8.12.14 the email went out without the file.

• The FormManager CpScript now trims a trailing / or \ from FilePath.
• An attachment path with a doubled slash inside it is accepted.
• A form set to save to a folder (FileLoacation 01) with an empty FilePath now reports a clear error instead of sending without the file.

Attribute validators that name only their type, with no id, are recognized again everywhere a module's attributes are read.

• Data Transform > Data Transfer applies these validators when it writes a standard module, instead of skipping them.
• A form generated from a module with these validators renders its required, length, range and pattern checks, instead of failing.
• The Web API attribute selector and the module attributes page load for the Data Sources, Script Generator, Data Transfer, Manifests and System Pages modules, instead of failing.
• A pattern validator keeps its own pattern check.

Scheduled tasks no longer repeat a failure on every check.

• A web site task whose web site was deleted now records a Skipped process that names the missing site and says to point the task at a live site or disable it. Before, it failed on every run.
• A master task that fails or runs past the request time limit, such as a long Backup, now moves its next run time forward. It no longer runs again on every check and holds up Clean Up and Database Maintenance.

A form whose content contains its own form script now shows a message instead of stopping the website.

• The nested copy is replaced with "This form includes itself and cannot be displayed." The rest of the page renders normally.
• This also covers a chain, such as form A including form B, which includes form A again.
• Development > Errors records the problem once an hour and names the forms involved, so you know which form's content to fix.

Form validator errors now show the validator's own message, such as "You must provide a valid second field name.", instead of always saying the form control may not exist. That hint now appears only when a missing control is the likely cause.

The Learning Record Store (lrs.svc) now saves and returns xAPI Activity State, so a course can store the learner's place and read it back on relaunch. Previously the save was accepted and discarded, so learners always started over.

Behavior changes on every install:

• Course resume: state documents are stored per learner, course and registration, and returned with their original content type. A read of a document that was never saved answers "not found" (404) instead of an empty success (204).
• Exit saves: course players that save on tab close using the xAPI alternate request form are now accepted. They were all refused before.
• Voiding: voiding a statement keeps the original (marked as voided) and stores the voiding statement as its own record, so voiding statements now appear when statements are read.
• Duplicate statement ids: resending the same statement is accepted without creating a second record. A different statement under an id that is already used answers 409 (was 400).
• PUT /statements now reports failures instead of always answering success, and uses the statementId it is given.
• authority on new statements names the account that submitted them, not the learner.
• With an access token, a voiding statement must name the same learner as the statement it voids.
• Merging a state document with POST is not supported and answers 400. Use PUT.
• Each learner can keep at most 1000 state documents. A new one over the limit is refused (403).
• State saves are now validated. A save whose agent is not a Centralpoint user, or whose activityId, stateId, registration or Content-Type is missing or invalid, is refused with 400. Before, every save answered 204 and was thrown away. The course player treats a refused save as a failed save and keeps running, but that learner cannot resume.
• A statement whose object has no objectType is now stored, since xAPI treats it as an Activity. Before, it was refused with 400.
• Voiding a statement now returns the id of the new voiding statement, not the id of the statement it voids.

A new Learning Record Store (xAPI) option is available under Admin > Properties. Default keeps today's behavior. Enhanced shows three settings:

• LRS Learner Identity: token only, signed-in learner first (token still allowed), or signed-in learner only. When a signed-in learner is used, they can only write and read their own statements and state.
• LRS Integration Accounts: which Web API accounts may send statements with an access token (empty allows any).
• LRS Require HTTPS: refuse access token calls over plain HTTP.

The Document Content Attributes module property can now read text from scanned PDFs and image files (PNG, JPG, JPEG, TIFF, BMP and GIF) with the Tesseract OCR engine, and insert it into the destination attribute of each pair (for example FileUpload1=RTFEditor1). Previously a scanned PDF produced no text, or only the junk text a scanner had hidden in the file, and image files were skipped.

OCR is off by default and is chosen per source in the new Document Content Attributes: Read with OCR property: Images, Scanned PDFs, or both. Each costs differently, and OCR runs while the record saves at several seconds a page, so only the sources a module needs should be selected. On a module whose uploads include photographs, selecting Images would fill the attribute with stray characters or empty it, replacing anything entered there by hand.

• Scanned PDFs are PDFs that contain images where every page has fewer visible words than OCR: Minimum Visible Words (default 20). Text a scanner embeds as a hidden layer is not counted and is replaced by the OCR text. A PDF with any typed page, or longer than 25 pages, is converted as before.
• OCR: Minimum Confidence (default 60) discards OCR text the engine is unsure of. A file that falls below it, or that OCR finds no text in, is not used: a PDF keeps its normal conversion, and an image leaves the attribute empty, clearing any text from a previously uploaded file. Clean scans of typed pages score above 90; drawings, maps and handwriting score lower and are kept out.
• OCR text is always inserted as plain text. When OCR reads a scanned PDF, Insert PDFs as HTML? does not apply to it.
• The two OCR settings are shared module properties listed after OOXML Extractions, so any future OCR option uses the same pair.

Handwritten pages, drawings and maps generally do not produce usable text. Details are in the OCR help file and the updated Document Content Attributes help file. The three new properties must be added to a module's properties before use.

A site's Console could fail to start on a server that does not have .NET Framework 4.8.1 (Windows Server 2019 and older). The Console web.config targeted 4.8.1, ASP.NET refused to load it, and the site redirected to the error page with no message beyond an event 1310 in the server's event log. A new sync method, DowngradeTargetFrameworkAll, and the Centralpoint installer, repair and migrate tools now lower the setting to 4.8 where 4.8.1 is missing. Servers that have 4.8.1 are not changed, and the sync method records itself as skipped there. The method re-arms itself if a web.config that targets 4.8.1 is restored onto a server without 4.8.1, for example from a backup or a moved database.

web.config change warning. This release edits web.config files on servers without .NET Framework 4.8.1. It changes targetFramework="4.8.1" to targetFramework="4.8" on both the httpRuntime and compilation elements, in the main site (Root) web.config and the Console web.config of each website, and in the Master web.config. A secondary server in a load-balanced pair has only its Root changed. The change applies on the update that follows this release.

• Virtual directories running as their own IIS application have a separate web.config that this release does not touch. If one targets 4.8.1 on a server without 4.8.1, change both values to 4.8 by hand.
• Client custom code (App_Code/Custom, or a custom-code app with its own config) that sets targetFramework to 4.8.1 needs the same manual change on those servers.

Changes Made: Records written through the Web API now clear the cache of the modules they change, the same way saving a record in the Console does. Previously, records created, updated or deleted through the Upsert Data, Upsert Data From Site on Same Server and Delete Data methods did not clear any cache, so the change was not visible on the site until the cache expired or was cleared another way. For example, a new SiteMap page added through the API did not appear in the navigation.

The cache is now cleared once per module after all items in the request are processed, both on the site and in the Console. For the SiteMap and PreferredUrls modules this also refreshes the site navigation. Clearing applies to the module each record actually belongs to: an update by DataId into a record outside the method's configured module clears that record's module, and a Delete Data request without a module that deletes records from several modules clears each of them. No change to existing requests is required.

Upsert Data From Site on Same Server now clears the Resources cache once at the end of the request instead of once per copied resource, after each resource's file extension is updated, so a changed resource file type is picked up immediately.

If a cache cannot be cleared, the request still succeeds and the response Warning notes which module could not be cleared.

The Resource Content Attributes module property now stores the search text of an Excel workbook (.xlsx, .xls, .xlsm, .xlsb, plus .csv and .tsv) as each distinct cell value in its visible worksheets, listed once. Spreadsheets repeat the same values down every column, so this reduces the stored search text by roughly 25% to 90%, with large data workbooks seeing the largest savings. Hidden worksheets are not included. Word, PDF and other file types continue to store their full text.

A workbook attribute is now added to the record's search content even when the same attribute is also listed in the Document Content Attributes module property. Other file types continue to skip Resource Content in that case, as before. This keeps workbook text searchable, including workbooks too large to convert to HTML.

The FileReadAllText Data Transfer script has several Excel improvements.

• Prefer HTML: with preferHtml='true', a workbook is now returned as HTML with a tab for each visible worksheet, including formatting and embedded pictures. This is the same HTML the Document Content Attributes module property produces. Previously only a single-worksheet workbook returned usable HTML (without its formatting), and a workbook with several worksheets returned no worksheet data at all.
• Size limits: with preferHtml='true', a workbook over 25,000 cells across its visible worksheets, or 5,000,000 characters of HTML, returns an empty value. Plain text (the default, without preferHtml) is not limited, so large workbooks can still be read as text.
• .xlsm and .xlsb workbooks are now read as Excel, in both plain text and HTML.
• Hidden worksheets: plain text output no longer repeats the first visible worksheet's text once for every hidden worksheet in the workbook.

The script's Prefer HTML help in the Script Designer describes the workbook output and the limits.

The Document Content Attributes module property now supports Excel workbooks (.xlsx, .xls, .xlsm, .xlsb) in addition to Word, PDF and text files. The same attribute pair that converts a Word document or PDF (for example FileUpload1=RTFEditor1) now converts an uploaded workbook into HTML in the destination attribute.

• Each visible worksheet is shown as its own tab above the workbook, in workbook order. Links inside the workbook that point to another worksheet switch to that worksheet's tab. A single-worksheet workbook is shown without tabs.
• Fonts, colors, fills, borders, merged cells, column widths and row heights carry over, and pictures and charts are embedded in the HTML. Hidden worksheets are not included.
• The tab styling can be overridden from the site's stylesheet through the cpxl-wrap, cpxl-tabs, cpxl-active, cpxl-section and cpxl-sheet classes.
• Size limits: a workbook is only converted when it is within 25,000 cells across its visible worksheets (counted from the first cell to the last cell holding data on each worksheet) and 5,000,000 characters of HTML. Larger workbooks produce more HTML than a page can render and records too large to work with, so a workbook over either limit is not converted, and the destination attribute is left empty (clearing any content from a previously uploaded file). Large spreadsheets are better suited to the Excel Viewer. A workbook that is password protected or cannot be read also leaves the destination attribute empty.
• Existing mappings: a module that already maps an attribute in Document Content Attributes will begin converting Excel workbooks in that attribute on the next save of each record, replacing the destination attribute's content.

The Document Content Attributes help article has been updated with the workbook details, the limits, and how to make workbook text searchable.

The FileReadAllText CpScript can now extract text from image files (PNG, JPG, JPEG, TIFF, BMP and GIF) using the same Tesseract OCR engine as the OcrZone script. The new Read Images option (isReadingImages) under the script's Advanced properties turns it on. It is off by default, because OCR is resource intensive and increases transfer time. Transfers that already point FileReadAllText at image files keep returning an empty value until the option is enabled.

When enabled, the whole image is read, including every page of a multi-page TIFF. A new minconfidence property (0 to 100) discards the text when the engine's recognition confidence falls below the threshold, so unreadable scans return an empty value instead of junk text. To read a single region of an image, or to use the character-type and case options, continue to use the OcrZone script.

OCR requires the image file to exist on disk before the transfer runs, for example a File System source's FullName column or a Standard Module upload path. Images served from a URL or SharePoint are not read and continue to return an empty value.

The Knowledge Assistant, the Page Assistant and text summarization can now use three more AI providers, in addition to OpenAI and LLamaSharp. The AI Providers page at AI Governance > AI Providers shows a card for each one, with the vendor logo.

• Anthropic Claude activates from its card with the same agreement flow as OpenAI. Usage bills to Oxcyon at first. The activation email lists the steps to move the client onto its own Anthropic workspace and API key, so each client gets its own usage report.
• Google Gemini and Azure OpenAI use the client's own account. The client enters the API key in AI Governance > AI Properties. Azure OpenAI also needs the resource endpoint and the deployment names. These two cards show "Configure in AI Properties" instead of the agreement flow.
• The "Works with Copilot" badge now shows on the Azure OpenAI card only. The OpenAI card no longer carries it.
• ONNX Embedding is now the last card, and the last entry in the Embedding Models section, because it is embedding-only and rarely changed.
• When a provider account runs out of credit, every provider now shows the same plain message in chat. A provider that is not configured stays unavailable and does not affect the others.

Existing sites keep their current provider. Nothing changes until an administrator activates or configures one of the new providers.

Two newer local (on-premises) AI models are now available under AI Governance > AI Providers:

• Gemma 4 E2B (Google) - the fastest local model, using about half the memory of the default.
• Granite 4.2 3B (IBM) - tuned for business documents, with 12 languages including Spanish.

Gemma 3 4B and Granite 3.3 2B are now marked as superseded by these. Sites that use them keep working. The default local model is unchanged (Qwen3 4B Instruct). A new model downloads automatically the first time a site uses it.

Local AI chat now stops when its answer is complete. Previously, most local models kept generating after the answer, repeating or restating it until they reached the length limit. This affected the Knowledge Assistant, the Page Assistant and the AI Test Center chat. Answers are now shorter and arrive two to four times faster.

Local AI chat and summaries now also use each model's own tuned settings, including repetition controls that were configured but never applied. Chat answers and summaries from local models may read slightly differently after this update.

When Oxcyon schedules a hotfix for your server, the addresses in the New Update Notification Email property under Master > Admin > Properties now receive an email in advance. The email gives:

• when the hotfix starts, in the server's own time zone, with Eastern time beside it
• the server and the sites on it
• one sentence on what the hotfix changes
• the impact: sites on the server stop and restart while the hotfix installs, and are briefly unavailable

Hotfixes are normally scheduled for 11:30 PM Eastern. If the server installs a newer Centralpoint update before the start time, the hotfix is canceled. A server that only receives the hotfix once it updates to that version is not sent a notice. Until a server reports its time zone, the email shows Eastern time only. If the property is empty, no notice is sent. Separate multiple addresses with semicolons.

The third-party Telerik UI components that power several built-in features have been upgraded to the current patched release. These components sit behind the rich-text content editor, the File Manager (Design > File Manager), file and image uploads, the in-editor Image Manager and Image Editor, and the dynamic role filter builder.

This is a security and maintenance update. It closes two vulnerabilities present in the previous component version (an unauthorized file-read and a remote-code-execution risk in the editor's file dialogs). There is no change to how any of these features work for end users, and existing content is unaffected. The rich-text editor opens, renders, and saves exactly as before.

The updated license is built into the platform, so no per-server licensing step is required after deployment.

IMPORTANT - FOR INSTALLS WITH CUSTOM CODE: If a client install includes custom code that directly calls Telerik UI controls or APIs, that custom code must be tested against the new component version after deployment. All standard Centralpoint functionality has been fully regression-tested; only bespoke client customizations that reference Telerik directly carry any residual risk. If you are unsure whether an install has such custom code, flag it for review before rolling out.

A host with no routing rule can now redirect to a primary domain. A request for a host name that has no domain rule used to end in a 404, and legacy brand domains produced a steady stream of error reports. A new Web Site Primary Domain property on Admin > Properties names the host to send those requests to. The visitor is redirected permanently, with the path, a non-default port, and https behind TLS termination kept. A request made by IP address is still answered with a 404 and never reported, and an empty value, an invalid host, or the request's own host keeps the 404. Unroutable hosts are reported once an hour as a ranked list, and an audience whose home page was retired is no longer reported on every visit.

Form emails keep their attachments. In 8.12.14 an attachment whose stored path had a stray space was refused, so the form email went out without the file. Each path is now trimmed first. A file name that itself contains a comma is still split.

Admin > Settings finishes saving when the site folder does not allow new files. Saving writes the new web.config through a temporary file, which needs permission to create a file in the site folder. Where that was denied, the save stopped after the new configuration was already live and before connection strings and the console configuration were updated. It now writes in place, and writes the original content back if that write fails. The API log-level setting uses the same fallback.

Master > Content > Scheduled Tasks - long tasks reschedule instead of repeating. A web site task stopped by the request time limit (DataBroadcasts, XMLConversion, RetentionPolicies) kept a next-run time in the past and ran again on every check. It is now rescheduled first. A data transfer stops shortly before the request limit and fails as an ordinary transfer failure, so the schedule moves on instead of the task restarting for hours. The transfer's attributes and relation counts are saved together, and the module backup flag is reset on its own connection, so an aborted chained transfer no longer leaves a full module backup to run on every later transfer.

Master > Content > Scheduled Tasks - Database Maintenance reports each database once a day. One shared budget of three reports an hour per master meant a frequently maintained staging database used it up and later databases in the same sweep went unreported.

Site search records its SQL before it runs and limits repeated terms. A search that timed out never logged the statement it ran. The statement is now logged first. A term repeated many times, as crawlers send it, is de-duplicated, and a query keeps at most 25 terms.

Dates are written to SQL the same way on every server. Dates built into SQL text used the server's regional format, so on a day-first server an update could fail or, for days 1 to 12, store the wrong date. Current-time values now come from the database, and other dates use the ISO 8601 format. This affects Data Broadcast send and unsubscribe, Policies and Procedures approval, Contextual Search date filters, the console change notification on a module edit, and Ecommerce orders.

Forms > Forms Wizard keeps a Keyword List or Taxonomy Tier choice. The saved system type was loaded into the wrong dropdown, so the choice fell back to Module on the next rebind and was saved that way.

Broadcasts - the unsubscribed recipients list no longer fails when the module has no RecipientSource attribute or no data id.

Online course tests handle the question parameter safely. The value is now escaped before it is matched and encoded when it is copied into the result redirect. A signed-out visitor is stopped before grading, and the already-passed check treats %, _ and [ in the value as literal characters.

Module view pages recover from stored form state. After a Module Designer change, a form post carrying older page state could fail a Details, Results or Home page. These pages no longer restore state they rebuild on every request, which also makes the page state smaller.

Smaller fixes. The Comments control is hidden when a Site Map page has no current record, instead of returning a 500. A preview column that looks up a table once per row now counts the table once per request. Uploading a custom attributes file that repeats an attribute id is rejected with the repeated id named. When the AI provider is out of credits, summaries, chat, and the Page Assistant tell the user to contact an administrator, and an OpenAI failure names the model. The Page Assistant debug block shows server text safely. The Uploads copy during a site data update skips the generated stylesheet cache and no longer lists server paths in skipped-file entries.

Error reporting groups related failures correctly. A refused file permission write and a rejected logon no longer share one error, a closed-connection fault is reported per call site, and a failing site data copy is no longer reported with the source path.

The Centralpoint Agent and command-line tool are updated to 8.12.15.3. The Agent now probes the canonical host under the localhost scope.

When importing Module Designers through a Data Transfer, a new Module Views File Handling option controls how each module's code files (the .ascx / .ascx.cs views) are handled during the import. Three choices:

• Copy from path - copies the existing code files from a source directory (the previous behavior; the source path is entered in the Module Views Directory Source Files field, which now appears only when this option is selected).
• Data only - imports the Module Designer records only, with no code files.
• Generate files - builds the code files from the module templates during the import, so the imported Module Designers work immediately.

Previously, importing Module Designers brought in the records but required re-submitting each Module Designer by hand to create its code files. The new Generate files option removes that manual step. The option appears on a transfer whose Source and Destination are both set to Module Designers, on the Source & Destination tab.

Contextual Search query suggestions (the type-ahead list fed by AlgoliaAutocompleteIncludeQuerySuggestions) are now faster and lighter on the database, and stay that way as search statistics are rebuilt over time.

The 8.12.15 sync improves how the search statistics are stored and indexed:

• The full-text index on the search statistics is rebuilt on a new numeric key, so it no longer accumulates leftover index data. Running the sync also clears any data already accumulated on existing sites.
• The statistics rebuild now updates the existing statistics rows in place instead of deleting and re-adding all of them. New queries are added, and queries that fall outside the statistics window (90 days by default) are removed, so the suggestions and their counts are unchanged.
• The suggestions index now carries the click count and last-searched date, so ranking the suggestions no longer needs extra lookups.
• On SQL Server 2025, a search statistics index still in the older full-text format is rebuilt automatically.

The change runs once per site during the sync and needs no configuration. Like the rest of Contextual Search, it applies to SQL Server 2016 and later, and sites on SQL Server 2014 are skipped. Full-text suggestions repopulate on their own within a few minutes of the sync.

Centralpoint's own scripts no longer compile text as code at runtime. This removes Centralpoint's reliance on the 'unsafe-eval' Content-Security-Policy directive, so a site can adopt a stricter policy. Timers, JSON parsing, and the lookups that ran configured script now run as ordinary functions. Pages behave as before, with the exceptions listed below.

Custom code that may need attention

• DataTables: custom script that calls cp_DataTables.init directly must now pass Order, Columns and ColumnDefs as values, for example Order: [1, 'asc'], rather than as quoted strings such as Order: "[1, 'asc']". The standard DataTables CpScript is already updated. A call that still passes strings stops the table from loading and reports a script error in the browser console.
• CheckInButton: the SuccessJavascript property of the CheckInButton CpScript now runs as the body of a function. The same values are available as before (that, dataid, moduleid, attributeValue, checkedInValue, attributeName, checkedInText), and return can now be used to exit early. Existing success code needs no change.
• FormAutoSave: the legacy mode of the FormAutoSave CpScript has been removed. A tag that still sets IsLegacyMode now uses the current auto-save behavior, which requires the form's AutoSave attribute to be enabled.
• Page Options: each entry in the Page Options menu on Console pages now runs independently, so one malformed entry no longer affects the others.

A scheduled task that is meant to act on web sites but has none selected used to finish without doing anything and without telling anyone. This release reports it.

• Sync tasks. A Sync task whose scope is "Selected" with no sites chosen, or which has no scope at all, now logs an error that names the task and says to set its sites in the Master Console. The task still reschedules and does not run. "All sites" on a master that has no web sites yet is still valid and raises nothing.
• Other site-scoped tasks. The ClicksMerger, DataArchive, NaturalLanguageSearch and Template tasks now fail their run with a message naming the task when neither the master nor any web site is selected. Before, they ran with an empty site list. A task with the master selected and no web sites is a valid scope and is unaffected.

Masters that already have a scope on every one of these tasks see no change. A master with a task that was silently doing nothing will now show an error for it on each run until its sites are set.

The taxonomy, audience, and role selectors (shown when editing any content record, and on front-end forms that use a taxonomy selector) now render their intended formatting again - bold text, colors, and the hidden sort-order prefixes - instead of showing raw HTML tags as plain text. This closes the display regression introduced in 8.12.14 while keeping those labels safe: a shared safe-list allows a small set of formatting tags and strips anything else, including scripts, event handlers, and any style that could load or run remote content. This replaces the interim 8.12.14 patch, which restored the formatting but left the underlying security gap open.

This now also covers the radio-button selectors in the Module Designer - for example the Taxonomy Search attribute's options, where the "None" option previously showed its hidden sort-order prefix as literal text.

Behavior change to note: label styling is now limited to safe cosmetic properties (text color, bold/italic, font family and size). Any layout or positioning style stored in a label - position, display, margins, or screen-relative sizes - is dropped, which closes a way a styled label could overlay the page. The usual color and font styling on taxonomy labels is unaffected. Separately, label markup outside the allowed set (such as underline, superscript, or a class on a span) renders as plain text; if a client reports a label losing styling after this update, this is the cause, and the safe-list can be extended if a tag or property is legitimately in use.

Deployment note: this release pairs Centralpoint.dll and Centralpoint.Web.dll - the web controls use a shared component in Centralpoint.dll, and this now includes the radio-button selectors and the Console yes/no switches. Any patch or hotfix built from this must ship both files together, or the taxonomy, audience, role, and radio selectors will fail to load.

A new module property, Resolve Login via RelayState (EnableRelayStateLookup), has been added to the AuthenticationSources module (Admin > Global Login), off by default. It addresses a "No configuration found" error that can appear when several Global Logins share the same Identity Provider - for example, multiple portals under one Microsoft Entra tenant, which stamps the same Issuer on each.

When enabled, a sign-in carries the specific login's identifier through the sign-in round-trip, so if the browser session is lost (a fresh window or tab) the callback resolves the exact login that started the sign-in, instead of falling back to an Identity-Provider/audience guess that can come up empty. When off, behavior is unchanged.

This is a module-wide switch: when it is on, it applies to every SAML Global Login on the install. Only enable it when the logins that share an Identity Provider are the same trust tier, since an enabled login can be selected by any user holding a valid sign-in for that shared Identity Provider.

On a Windows Server 2025 master, an old copy of a shared library (such as Newtonsoft.Json) in the Windows Global Assembly Cache (GAC) can take precedence over the site's own copy. The Master Console then stops with a server error. Centralpoint has a repair for this, but it was recorded as done in the master database. A master built from a copied database therefore never ran the repair on its new server.

• Master > Development > Sync Methods now moves the GAC repair back to New when the server's GAC still disagrees with the site's copy. The repair then runs on the next version install, a retry from Server Hub, or a run from the Explorer view. A site sync never runs it.
• The repair now checks the server again after it finishes. If a stale copy remains, it reports Failure instead of Success, so an unsettled repair stays visible.
• The Windows version check for these methods now reads the server's real Windows version instead of a value saved at install time. A database copied from an older server no longer gates on the wrong version.
• New command Centralpoint.exe gac screens every Centralpoint site folder on the server and refreshes any stale GAC copy. It works while the Master Console is down. Use --what-if to report only, with no changes and no administrator rights. Without --what-if, the command asks for administrator rights.
• install, migrate and repair now run the same screen. A failed screen shows a warning with the command to re-run, and the run continues. repair --dry-run previews the screen without changing anything.
• When the GAC changes, gac and repair restart IIS once so no worker keeps the old copy in memory.
• If two site folders ship different builds of the same library, the screen refuses to change the GAC and names both builds. Align the folders, then run it again.

The Master web services folder used to accept calls from anyone, with no sign-in. That included methods that run updates and sync methods, create and restore backups, run scheduled tasks, and start processes. Every call to the Utilities, SyncInvokeMethods and ScheduledTasks web services now carries a signature, and Master checks it. The site Console, the site pages, the Agent, Centralpoint.exe sync-method run and Master's own update install all sign their calls. The Agent and the CLI move to 8.12.15 with this release.

How the rollout works. Sites often sync after Master updates, so Master does not refuse unsigned calls at once. While any site on the install is below 8.12.15, Master serves an unsigned call and logs it under Development > Errors with the key MasterWebServicesAuth:Unsigned. The entry names the endpoint, the method, the caller address and the reason. Master starts refusing unsigned calls (HTTP 403) when all of these are true: every site is on 8.12.15 or later, Master has verified a correctly signed Agent call in the last 24 hours, and the installed CLI is 8.12.15 or later. Master rechecks every 5 minutes. No setting turns this on or off.

Sign-in for three more services. ClientMethods, ProcessMonitoring and WebSiteBackups now need a signed-in Master session. Master admin pages already call them from a signed-in browser, so admins see no change. A script that polled ProcessMonitoring without signing in now receives the sign-in page.

SOAP 1.1 only. These endpoints now accept SOAP 1.1 only. SOAP 1.2, form posts and .asmx/Method style calls count as unsigned, because the signature binds to the SOAP 1.1 SOAPAction header.

Custom code. Custom code that builds Master.Utilities directly sends unsigned calls. Master serves and logs them now, and refuses them once the install enforces. Change such code to SignedMasterUtilities, which sets the Master address and signs the call. Page.Master in the site Console and Root already returns a signed proxy. The site cache methods RemoveCache and RemoveMemoryCache also check the signature now. These methods send no reply, so an unsigned caller sees no error. The site records the refusal in Development > Errors as "Rejected unauthenticated ... call".

Configuration change. One file changes: Master's WebServices\Web.config. It removes the folder-wide "allow all users" rule. It adds "allow all users" only for Utilities.asmx, SyncInvokeMethods.asmx, ScheduledTasks.asmx, Services.svc and DevOps.svc. It also removes the HttpSoap12 and HttpPostLocalhost protocols. The update package ships this file, so no sync method applies it. No site web.config changes, and a virtual directory that runs as its own IIS application keeps its own web.config.

Impersonation cleanup. Master now always ends administrator impersonation when an operation fails partway. Before, a failure could leave the worker thread running as the administrator for the next request.

Editing a Data Transfer record with a SQL Server source is now much faster and places far less load on the source database.

Previously, the Data Transfer form ran the full source query many times during an ordinary edit, not only when the transfer itself ran. Opening a record ran it once, and moving between the General, Source & Destination and Fields steps ran it again, up to three times per step. A typical edit session ran the source query about 12 times before anything was transferred. For a source that reads a large table, each of those runs took as long as the transfer itself, so editing one record could keep the database busy for minutes and slow down the rest of the site.

The form now only checks the source's column names and types, which SQL Server answers without running the query or reading any data. That check takes a fraction of a millisecond regardless of how large the source is. The same walk through the form that used to run the source query 12 times now runs it 0 times.

• Opening, navigating and saving a record no longer runs the source query.
• Show Source Sample on the Fields step now fetches the sample only when the button is clicked. It is the one place in the form that still runs the source query, because a sample needs real rows. Once loaded, the button shows and hides the sample without running it again. Unsaved field mappings are kept, and an unfinished mapping no longer shows validation errors when the sample is loaded.
• Scheduled and Execute Now transfers run the source query once per run, where they previously ran it twice. Statements that a source runs after its main query, such as a stored procedure that marks rows as exported, still complete as before.
• Validation messages for invalid SQL (a syntax error or a missing table) are unchanged and still appear immediately.

A small number of sources cannot be checked this way, most commonly queries that use temporary tables or build their SQL dynamically. Those continue to run the query during editing, exactly as before.

A blank Source Select Command is now rejected with the message "You must select a valid Source Select Command." (or "enter" for ODBC, OLE DB and Oracle sources) instead of a technical error. A transfer with a blank select command could never run, so no working transfer is affected.

The Centralpoint CLI repair command no longer rewrites the Agent scheduler address (Agent:SchedulerUrl) on every run. Before, repair rebuilt it from the first IIS binding and assumed https whenever a host header existed. On a Master with only an http binding, or with a certificate that does not match the default host name, this left scheduled data transfers unable to connect, and each repair put the broken address back. Now repair tests the current address from the server itself, using normal certificate checks. If it answers, repair leaves it unchanged, which also keeps a value an operator corrected by hand. If it fails, repair replaces it with the first address that does answer: the Master Api.Base.Url, then each https binding, then each http binding. An https address that fails is never downgraded to http. When nothing answers, repair keeps the current value and prints a warning that scheduled tasks will not run until the Master site is reachable. Each change prints as old -> new.

The same rule now applies to the Development site's Master and API addresses (Api.Base.Url.Master, Master.Utilities, Api.Base.Url, Cda.Utilities, Console.Utilities). Repair changes a key only when its address fails, and it backs up web.config first. If the Development appSettings section is encrypted, repair writes nothing and prints the steps: set Protected to No, re-run repair, then set Protected back to Yes. The https or http scheme now comes from the https binding that exists, not from the host header. Changing the domain with repair --domain still moves every address to the new domain.

This change is in the CLI only. It does not add a version bump or a sync method, and it ships with the 8.12.15 CLI.

The Delete button on the Errors page (Development > Errors, on the site Console and on Master) now removes any error in the list. Before, only errors marked low priority could be deleted, and the checkbox for every other error was disabled. The Delete button on an open error now deletes that error. Before, it acted on the checkboxes in the list behind it. Deleting only affects your own errors: on a site Console it covers that website's errors, and on Master it covers the errors for the whole master. If some of the selected errors could not be deleted, a message above the list says how many, for example "Not deleted: 1 of 2 selected errors. They were already deleted or cannot be deleted from this site." If the delete itself fails, the page says so, and none of the selected errors are removed. Sites on a version earlier than 8.12.15 can no longer delete errors from this page. Delete shows an error page there until the site is updated.

Security hardening: a form using FormZipFileToDirectory can now only delete the zip that was just uploaded to it, not zip files or Resources that other people uploaded earlier.

The FormZipFileToDirectory CpScript extracts the zip named by its target upload field into Uploads\FormZipFileToDirectory. With Is Deleting Zip? enabled (the default), it then deletes the zip. That deletion exists so a zip uploaded only to be unpacked does not linger on disk or in Resources: someone uploads a zip, submits the form, and only the extracted files remain.

The zip path comes from the submitted form, so a modified submission could name a different zip, such as an existing file under the site or any zip Resource, and have it deleted along with its Resource record. Two safeguards now prevent that:

• Deletion is limited to a zip written within the last 10 minutes, which covers the normal upload-then-submit flow. A zip submitted after that window, or one carrying a future file date, is still extracted but is left in place, with a trace warning recording the skipped deletion.
• A plain file path is only accepted when it points into the site's Uploads folder. Paths anywhere else on the site are ignored, so no extraction or deletion takes place for them. Zips uploaded as Resources are unaffected apart from the 10-minute deletion window.

The form itself never fails because of either safeguard. When one applies, the only effect is a zip left on disk.