Centralpoint Update 8.12.16

The Embedder now shows only its error message when the requested record does not exist or no attribute is named. It no longer goes on to render content after the error.

The page that blocked visitors see now shows a message only for an active IP Manager block rule. Any other record returns an empty page, so the page can no longer be used to read other records.

The Excel export of a data source now checks that the data source is enabled, the same check every DataSource CpScript makes. A disabled data source returns an error instead of its rows. If an Excel export stops working after the update, enable the data source in Design > Data Sources.

The comments RSS feed (/Modules/Comments/Rss.aspx) now shows only comments on records the visitor can see.

• A feed for one record (?did=) is empty when the record is disabled, out of date range, or outside the visitor's audience or roles.
• The site-wide feed leaves out comments on records the visitor cannot see, and respects tenant filtering.

The approve-and-notify and decline-and-notify buttons in form approval emails now work only from a link the site issued. The site refuses a link that was changed.

• The same applies to approval emails from Procedure Manuals > Policies.
• Approval emails sent before this update lose those two buttons. Approve or decline those records in the Console.
• The plain Approve button, which opens the record in the Console, works as before.

The script preview page that Forms > Forms Wizard opens for View Preview and View Reports now shows content only to a Console user signed in on the website.

• A visitor who is not signed in, or who has no Console access, sees a sign-in message and a Login link. The page shows no record content.
• A Console sign-in does not carry over to the website. Editors sign in on the website once, then View Preview and View Reports work as before.
• The Web Site Script Preview property in Admin > Properties now reads Enabled (Console users only) and Disabled. Its value does not change.

Centralpoint Agent 8.12.16.19 adds four security checks that report signs of a breach to Oxcyon.

• Reports whether each site's JWT.Signing.Key.Secret is the default that ships with every install, including a key set only in Local.config. It sends a fingerprint, never the key.
• Reports System-token and admin calls to the Master API from an address that is not this server, Oxcyon, or an allowed address. A load-balanced install lists its balancer in the Agent setting Agent:SecurityChecks:ApiCallerAllowedAddresses.
• Counts request validation, ViewState, cryptographic and session-queue events in the Application log each hour.
• Reports backup, source, database, log and SQL files under each site's Uploads folder.

The Master API keeps a short in-memory list of privileged calls for the Agent, and answers it only to the server itself. Each check can be turned off with the Agent setting Agent:SecurityChecks:<Name>Enabled.

Centralpoint Agent 8.12.16.14 counts the accounts locked out on each site and reports the count to the Uber with its hourly sign-in check.

• A hard lockout and a timed lockout both count.
• Failed attempts are added up for each user, so one user's successful sign-in no longer hides another user's failed attempts.
• A start date moved by an import or an administrator, outside the lockout window, does not count as a lockout.
• The first check after the Agent restarts records the current state and reports nothing.

Centralpoint Agent 8.12.16.13 checks each server for signs of a breach and reports them to Oxcyon's Server Hub.

• Script files added under a site's Uploads or Temp folder, or at the top of its Root folder.
• SQL Server changes: risky options such as xp_cmdshell turned on, the sa login enabled, and new logins, sysadmins, databases and SQL Agent jobs.
• web.config changes made outside an Oxcyon update or command, public Trace.axd, and machine or Telerik keys shared with another server.
• New API keys, sign-ins by deleted or long-idle accounts, and bursts of failed sign-ins.
• An IIS worker process starting a command shell.

The Agent sends key fingerprints only, never the keys. It changes nothing on the server. Each check can be turned off in the Agent's appsettings.json with Agent:SecurityChecks:<Check>Enabled, and Agent:SecurityChecks:ProcessSpawnAllow lists custom code that starts a shell on purpose.

The Data Broadcast Subscriptions page now changes subscriptions only for the member who is signed in. A request that names another member, or comes from a visitor who is not signed in, is refused. Subscribing, unsubscribing from one broadcast, and unsubscribing from all work as before.

The Master API's database export, which the Centralpoint Agent runs for a database backup, now writes only a .bacpac file to a local drive of the server. A network-share path or any other file type is refused, so an export cannot leave the server or replace another file.

On the AI test page, Restart and the batch performance test now work only for an administrator of the site (or an ancestor site) or a member of the Developers role. Other users get a permission message.

• The API test page no longer shows the site's connection string.
• Its Restart button works only for an administrator of the site (or an ancestor site) or a member of the Developers role.

The Restart button on Development > Query Analyzer now works only for an administrator of the site (or an ancestor site) or a member of the Developers role. Other users get a permission message and the site keeps running.

The Master and website Console web.config files no longer allow anonymous access to Trace.axd. Their sign-in requirement now covers it like every other page.

The update removes the override from installed sites, and removes it again if a later deployment brings it back.

web.config change: the update removes this block from the Master Root web.config and the website Console web.config:

<location path="Trace.axd"> with <authorization><allow users="*" /></authorization>.

Client impact: a virtual directory that runs as its own IIS application with its own web.config keeps the override if it has one. Remove the block there by hand.

The website now refuses uploads sent to Telerik's default upload handler, Telerik.Web.UI.WebResource.axd?type=rau, which accepted a copied upload from any visitor. The Console is not affected.

• Every built-in website upload already uses its own checked handler.
• The rich text editor's Image, Document, Media, Flash and Template managers on website pages now upload through the editor's dialog instead.

web.config change: the update adds this block to the website's Root web.config only. It does not touch the Console's web.config:

<location path="Telerik.Web.UI.WebResource.axd" inheritInChildApplications="false"> with requestFiltering > denyQueryStringSequences > add sequence="type=rau".

Client impact:

1. A virtual directory that runs as its own IIS application has its own web.config, which the update does not change. It keeps the default handler until the same block is added by hand.
2. Custom code with a RadAsyncUpload on a website page and no HttpHandlerUrl stops uploading. Point its HttpHandlerUrl at a checked handler that registers an upload context, as described in the upload dialog note in this version.

The DragAndDropFileUpload CpScript now accepts a dropped file only from the page that rendered it, and stores it only where its tag says.

• The module, record, folder and title now come from the tag. A changed request can no longer redirect them.
• Each field in attributesToUploadTo takes one file per page load.
• Only document, image and media file types are accepted.
• A refused or failed upload now shows a message instead of counting as uploaded.
• An uploadToFolder value without a trailing slash now stores a correct path.
• The page must have session state. Without it, the tag shows a message instead of the drop area.

Custom code impact: custom code that posts directly to Modules/FileSharing/Telerik_RadAsyncUpload.ashx is refused with 403 after this update. Use the CpScript instead.

The file upload dialog now saves only to the folder, and only the file types, that the page which opened it allowed.

• With overwrite protection on, an upload goes to the dialog's own folder. A folder named in the request is ignored.
• A file whose type the dialog does not allow is refused with "This file type is not allowed."
• With overwrite protection off, and in the File Explorer view on website pages, uploads now also need the dialog's upload token. An upload without it is refused with 403.
• No setting changes. The dialog sends the token itself.

Custom code impact: this extends the overwrite-protection note in this version. A custom page that uses Telerik_RadAsyncUpload_OverwriteProtection.ashx with cpType file must register a Centralpoint.Web.FormUploadContext of kind file that sets TargetFolder to the mapped folder and Extensions to its allowed list (comma-separated, for example .pdf,.docx). Without both, its uploads are refused. A page with cpType resource registers kind resource.

Data Transfer files now download through the Console, because they are no longer reachable by URL.

• Source file, Excel Sheet Consolidator and Process Monitor download links in the Console keep working for administrators.
• The upload control lists each configured destination file that exists, as a download link.
• Only administrators (Admins and LimitedAdmins) can download these files. Other users see a message instead.
• Custom attribute files linked from the Console, such as the Form Wizard's generated XML, download the same way.
• If your site's Uploads folder is an IIS virtual directory, add a VirtualDirectories entry for /Uploads to the site's Api appsettings.json. Without it, these downloads report that the file no longer exists.

Files under /Uploads/DataTransfer/ and /Uploads/CustomAttributes/ are no longer served to browsers or outside systems. Administrators download them from the Console instead.

• Data Transfer imports and exports, and module custom attribute files, return "not found" when requested by URL.
• An outside system that fetches a Data Transfer export by URL stops working. Move that feed to a secure destination such as SFTP, OneDrive or SharePoint.
• An export configured outside /Uploads/DataTransfer/, such as /Uploads/Public/, stays reachable by URL until you move it.
• Resized images under Uploads (/Uploads/.../photo.jpg/600/0/false/Image.ashx) keep working. Image.ashx now serves image files only.

web.config change

The sync updates the site's Root web.config:

• It adds a locked <location path="Uploads/DataTransfer"> and <location path="Uploads/CustomAttributes">, each denying every file.
• It adds a locked handlers section to <location path="Uploads"> and <location path="PrivateLabeling">. It maps Image.ashx to the image resizer and refuses every other .ashx file.

Check two cases after the sync:

1. A web.config you placed in a folder under Uploads that sets handlers now fails for that whole folder (HTTP 500.19). Move those handler settings into the Root web.config.
2. Custom code that links to a file under these two folders by URL must send administrators to the Console download instead.

The overwrite-protection upload handler, used by the file upload dialog and the Resource upload window when overwrite protection is on, now accepts an upload only from a dialog this site opened in the same session.

• A request that does not carry the dialog's upload token is refused with 403 before any file is written.
• The dialog and the Resource window send the token themselves; no setting changes.
• Custom code impact: a custom page that sets Telerik_RadAsyncUpload_OverwriteProtection.ashx as its RadAsyncUpload handler must register an upload context in Page_Load (Centralpoint.Web.FormUploadContext.Register, kind file or resource) and send its token as ctx from its uploading script, or its uploads are refused after this update.

The Resource upload window and the Bulk File Upload window of a FormUpload field now accept an upload only from the form that rendered the field.

• A direct visit to either window, or an upload sent to its handler from outside the form, is refused with "This upload page must be opened from a form. Reload the form and open the upload window again."
• Each field gets its own upload context when the form renders, so the roles, size limit, folder and file count come from the field's settings, not from the window's address.
• Public forms with a Resource or bulk-upload field keep working for signed-out visitors.
• A signed-in Console or Master user can still open either window by address.
• A visitor who leaves a form open past the session timeout, 20 minutes by default, is refused and told to reload the form.
• Custom code that opens /Modules/Forms/FileUpload/Resource.aspx or /Modules/Forms/FileUpload/TelerikBulkUpload/Default.aspx by address, without the FormUpload field, no longer works for a signed-out visitor.

Centralpoint Agent 8.12.16.12 keeps Trace.axd local-only when a remote trace session started by Oxcyon support ends. The Agent restores the site's earlier trace setting, always with localOnly="true", so a session opened before this update cannot undo the site-wide trace fix.

Trace.axd now answers only requests made on the web server itself, on every site, so trace output is never readable from another machine.

• Trace is turned off on the Development, Master and child sites.
• Turning trace on from Development > Utilities still works. The output is readable only from a browser on the web server.
• If a later deployment brings back a web.config that allows remote trace, the next sync closes it again.

web.config change

The update edits the <trace> element in each site's Root and Console web.config. It sets localOnly="true" and enabled="false".

• A virtual directory that runs as its own IIS application has its own web.config, which the update does not touch. If it carries localOnly="false" on its <trace> element, set it to true by hand.
• No assemblies, handlers or modules change, so custom code is not affected.

Centralpoint Agent 8.12.16.11 and Centralpoint CLI 8.12.16.10 sign their calls to the Uber and the Master with the Master's own key once the Uber has accepted it.

• New centralpoint signing-key show lists the fingerprint of each site's key on the server.
• New centralpoint signing-key rotate --compromised replaces every key on the server after a security incident.
• centralpoint install --enrollment-code installs a new Master with a one-time code from the Uber.
• Both still fall back to the shared signing secret while the Uber accepts it for your Master.

Admin > Settings now shows a Signing Key Fingerprint below Windows Identity. It names this server and the fingerprint of its signing key. Compare it with the fingerprint in Server Hub before a key is approved there.

Each Master and web site now signs its system calls with a key of its own, so one site's key can no longer act as another site.

• Every server creates its own signing key the first time it runs this version. Updates, repairs and load-balancing copies keep each server's key.
• Your Master registers its keys with the Uber, and keeps a list of its web sites' keys.
• The shared signing secret still works on every site, so nothing changes until the Uber turns it off for your Master.
• Admin sign-in now keeps its site type in a cookie protected by your site's own machine key. An administrator from the Master or Uber may be asked to sign in again once.

The Api no longer stores the value of a request header whose name looks like a credential in an error record.

• Headers such as X-API-Key show as redacted on Development > Errors. The fixed list of redacted headers still applies.
• Other headers are stored as before.

Every page load gives a visitor a Web API token, including anonymous visitors. Endpoints that list no roles used to accept that token. They now return 401.

• Five Page Assistant endpoints still accept anonymous visitors on a Web Site: SummarizeText, GetCapabilities, ChatStream, DataSourceRender and RagRetrieve. Master and Uber never accept the anonymous token.
• Admin-only endpoints now check the role: the RAG chunk, inspect and benchmark tools, the embedding test, and the Process Monitor (LimitedAdmins and Admins).
• Signed-in users who are not Admins lose the RAG and embedding diagnostics on API > AI Test Center.
• Word Add-In and other signed-in callers are unchanged. Custom code that calls the Web API with an anonymous token must sign in first.

A Web API key that has no module grants now reads nothing, and only the Admins role can manage keys.

• /data/query returns data only from modules the key has a Query grant for. /data/files downloads only from modules the key has a Download grant for.
• A key missing the grant it needs gets a 403 response. Before this release, a key with no grants read every module.
• API > API Keys marks each key that has no module access, no query grants or no download grants. The create dialog says a new key reads nothing until you grant it modules.
• Only the Admins role can open API > API Keys or call the key endpoints. LimitedAdmins and Developers lose this page.

Before you update: open API > API Keys and grant modules to every key in use. Give Query for /data/query and Download for /data/files. A key without the grant it needs stops working when the update installs.

Centralpoint CLI 8.12.16.9 gives each new install its own machine key and Telerik dialog key.

• The install writes new keys into the Master and Development web.config files. It no longer keeps the keys from the install package.
• When the CLI cannot write the keys, it says so and the install goes on. Generate the keys afterward in Admin > Settings for the Development site, or Master > Admin > Settings for the Master.

Load Balancing Verify now compares the secondary server's machine key with the primary's. Configure copies the full key set.

• Verify shows "Differs from the primary" when the keys do not match. It also flags a key that shipped with Centralpoint. It never shows a key value.
• Configure copies the machine key and the Telerik dialog key to the secondary.
• Windows data protection can encrypt the secondary's appSettings. The primary cannot read that section, so Configure copies the machine key only and reports that it did not copy the Telerik key. Copy the Telerik key by hand.

Creating a web site now gives the new site its own machine key and Telerik dialog key, not its parent's.

• The new site no longer starts with the parent's keys.
• The warning that asked you to generate keys by hand is removed.
• When the parent's key section is encrypted, the update cannot rewrite it, and the new site keeps the parent's keys. The site's RotateKnownSiteKeys entry on the Sync Methods page shows that. You can then generate keys in the new site's Admin > Settings.

Master > Admin > Settings now saves on a master that has no machine key, and it hides the Telerik dialog key.

• A master with no machineKey in web.config shows AutoGenerate. You can save other settings without entering a key, and Save leaves the key out of web.config.
• Generate Keys no longer fails when the master has no Telerik dialog key.
• The Telerik dialog key is a password box, like the machine key fields. Its value is not shown.

Admin > Settings now saves on a site that has no machine key, and it hides the Telerik dialog key.

• A site with no machineKey in web.config shows AutoGenerate. You can save other settings without entering a key, and Save leaves the key out of web.config.
• Generate Keys no longer fails when the site has no Telerik dialog key.
• The Telerik dialog key is a password box, like the machine key fields. Its value is not shown.

Every site now runs on its own machine key and Telerik dialog key, so a key copied from another site no longer works.

• The update replaces a key that shipped with Centralpoint, a key shared with another site on the same master, and keys that differ between two load-balanced servers.
• A site that already has its own keys keeps them.
• Users sign in again once after the update. Open forms and Word Autofill links fail once.
• New sites and new installs generate their own keys. The shipped web.config no longer carries any key.
• A key the update cannot rewrite is left as it is. An example is a Telerik key in an appSettings section that a provider other than Windows data protection encrypts. The Sync Methods page shows that site as partly done.

web.config change warning

What changes. In the Root web.config of each site, the update replaces validationKey and decryptionKey in <machineKey> and sets validation="HMACSHA256" and decryption="AES". It replaces the Telerik.Web.UI.DialogParametersEncryptionKey value in Local.config when the entry is there, and in the web.config appSettings when it is not. It touches the Root web.config and Local.config only. The Console is a nested application under Root and uses Root's machine key, so Console users sign in again too.

Check these after the update.

1. A virtual directory that runs as its own IIS application and shares sign-in with the site through its own machineKey keeps the old key. Copy the new Root machine key into its web.config by hand.
2. A second server that you load-balance by hand is not changed. Copy the Root machine key and the Telerik key to it right after the update. Otherwise the two servers reject each other's sign-in cookies.
3. Custom code that shares forms tickets or MachineKey data with another application needs a new shared pair. Set the same pair by hand in both applications.

QC: after the update, open a page in each virtual directory that runs as its own application. Open a page in each custom application that shares sign-in with the site. Each page must load and accept the sign-in.

Creating a user or resetting a password on Master > Admin > Users now emails a link to set a password. The email no longer contains a password.

• The link works once. It expires after 24 hours for a reset and after 72 hours for a new account.
• A new reset replaces the earlier link.
• A password changed any other way also retires an open link.
• Trace output no longer includes the new password.
• If the link cannot be sent, the page says so.

web.config change

The version's sync adds one location to the Master web.config: <location path="SetPassword.aspx"> with <allow users="*" />. This opens the set-password page without a sign-in.

• A Master that runs as its own IIS application with a separate web.config that the sync does not touch needs the same location added by hand.

Creating a member or resetting a password on Members now emails a link to set a password. The email no longer contains a password.

• The link works once. It expires after 24 hours for a reset and after 72 hours for a new account.
• A new reset replaces the earlier link.
• A password changed any other way also retires an open link.
• The Password placeholder in a custom email template now holds the link, so custom templates keep working.
• If the link cannot be sent, the page says so.

web.config change

The version's sync adds one location to the Console web.config: <location path="SetPassword.aspx"> with <allow users="*" />. This opens the set-password page without a sign-in. It adds nothing to the Root web.config.

• A Console that runs as its own IIS application with a separate web.config that the sync does not touch needs the same location added by hand.

The Console and Master sign-in pages now lock a username for 15 minutes after 10 failed attempts in a row.

• During the lock, even the correct password is refused with "Too many failed sign-in attempts. Try again in 15 minutes."
• The count is kept per username, so a name that does not exist locks the same way.
• A successful sign-in clears the count. The count also resets after 15 minutes with no attempt.
• Setting a new password from a set-password link clears the lock.
• A site that turned on member lockout in its properties now has that lockout apply to Console sign-ins too.
• If the lockout table is missing, sign-in works as before.

SAML sign-in now checks the identity provider's signing certificate before anyone is signed in, for any Global Login record that has a certificate pinned, closing a hole where a response signed by any certificate was accepted.

• When SAML Use Embedded Certificate = Yes, the certificate in the sign-in response must match a thumbprint in the new SAML Trusted Certificate Thumbprints field on the Global Login record (SHA-1 or SHA-256, separate multiple with commas), or the uploaded SAML Partner Certificate File.
• When SAML Use Embedded Certificate = No, the response is verified against the SAML Partner Certificate File as before.
• A record with no thumbprint and no certificate file still signs users in, exactly as before, and is listed in a report so you can secure it. It is not blocked.
• Saving a new Global Login record with Use Embedded Certificate = Yes and no thumbprint and no certificate file is refused. An existing unpinned record can still be edited and saved, and stays in the report until you pin it.

What to do

• After your identity provider rotates its signing certificate, update the thumbprint on any record that has one pinned, or sign-in for that record will fail until you do.
• If a record uses a SAML Partner Certificate File and was set to accept unsigned responses, confirm your identity provider signs its responses: an unsigned response to a record with a certificate file is now rejected.
• Review the report of records that still need a certificate and pin the suggested thumbprint for each. Until you do, that record keeps signing users in without checking the certificate.

Development > Query Analyzer now signs every request that saves, lists or deletes a saved query.

• The signature covers the user and the query being saved, listed or deleted. A changed request fails the check.
• The Uber accepts an unsigned request until its Uber Utilities Require Signature property lists QueryAnalyzer.
• Saved queries keep working on a site that has this update.

Your site, the Master and UberControl now sign every call they make to the Uber and to the parent UberControl.

• The signature uses the same JWT.Signing.Key.Secret as the Console service signing. A call from a site on an older version carries no signature.
• The Uber and UberControl serve an unsigned call for now and record it. Only update uploads to the Uber need a signature.
• Custom code that builds its own Uber.Utilities or UberControl.Utilities proxy sends unsigned calls. Change it to SignedUberUtilities or SignedUberControlUtilities.
• A custom page in Integrations that declares the Uber proxy as Uber.Utilities must declare Centralpoint.Web.Uber.Utilities instead, or it keeps its own unsigned proxy.

Every Development > Web API method set to Security Mode Disabled now uses Access Token, so a caller without a token gets 403 Invalid Access Token.

• cp-interstitials stays Disabled, because the interstitials feature calls it without a token.
• The Development site switches during the update. QA and Production sites switch at their next sync from the parent.
• Integrations, scheduled tasks and custom code that call a switched method must send an access token over HTTPS.
• Each site writes the methods it switched to Backups\WebApiSecurityModeHold-<date>.csv in the site's folder.
• To keep a method public, set its Security Mode back to Disabled. The update does not switch it again.

Inserting an mp4 video or mp3 audio file from the editor's Media Manager works again in every module that uses the rich text editor.

• After a recent update to the editor, Media Manager started creating modern video and audio players for these files. The older code that prepared inserted media did not recognize them, so clicking Insert closed the window and nothing was added.
• Video and audio files now insert as a player you can preview in the Design view and save with the record.
• Other file types insert from Media Manager the same as before.

Saving a search page now lets that page run from the Uploads folder, and deleting it removes the exception, so saved pages keep working under the new Uploads script block.

• Existing saved pages get their exception when the update runs.
• Another .aspx file in the same folder stays blocked.
• If the site web.config cannot be written, the save shows a warning, and the page returns a 404 until a save succeeds.
• On a load-balanced site, a save writes the primary server's web.config only. To reach the secondary server, run BlockHandlerFilesUnderUploads again from Master > Development > Sync Methods.

Script files in the Uploads folder no longer run on any site, so a file written there cannot execute. This is a security change.

• Blocked: .aspx, .ashx, .asmx, .svc, .asp, .cshtml, .vbhtml, .php, .axd, .rem, .soap, .xamlx, .xoml, .rules, .asa, .cer, .cdx, .idc, .shtml, .shtm and .stm. The same block covers the /PrivateLabeling folder.
• Not affected: images, .js, .css, .pdf and other static files, and module views under Uploads/ModuleViews.
• Product pages that live in Uploads keep working: Sync Notes, Gist and File Picker on the Development site, the Utility page on Master, and every Search Page Designer page.
• Pages or web services that your own custom code placed in Uploads now return a 404. We expect a few. We fix each one as it surfaces with a one-file exception, and we do not reopen the folder.
• The Master Errors list shows one report per install. It names every blocked file, every file an exception still serves, and every web.config under Uploads.

web.config change warning

The update edits the Root web.config of Master and of each site, including a registered secondary server. It adds a <location path="Uploads"> block and a <location path="PrivateLabeling"> block. Each block removes, then denies, the blocked extensions in requestFiltering. The block is locked, so a web.config under Uploads cannot allow them again. It also adds one exact-file <location> for each excepted page.

• A virtual directory that runs as its own IIS application has its own web.config, which the update does not touch. Check that script files in it are still blocked, or add the same block by hand.
• Custom code: a web.config under Uploads that sets requestFiltering (for example maxAllowedContentLength) now returns 500.19 for its folder. Move that setting into the Root web.config. A server whose applicationHost.config locks requestFiltering also returns 500.19 under Uploads, so check that before you update.
• QC step: load one page of your own custom code under Uploads. Confirm it works through an exception or returns 404, and that no folder under Uploads returns 500.19.

Tools > Extract Sharepoint Documents now saves files only inside its Parent Folder under Uploads, and only with the file types you select.

• A Parent Folder Name that points outside Uploads, such as ..\Files, is refused before the extract starts.
• A file whose folder or name from your query leads outside the Parent Folder is skipped.
• A file whose type is not selected under Extensions To Retrieve is skipped, even when your query returns it.
• The result shows how many files were skipped.
• You must select an extension before the extract runs.
• An error now shows only its message, without technical details.

A utility on Development > Utilities or Development > Import Utilities now opens and runs only for users who hold that utility's navigation item.

• The page shows the panel that its navigation item names. A display value in the address no longer opens a different panel.
• Utilities.aspx?format=3 now needs a navigation item like any other Console page.
• The actions behind each panel, such as Restart Web Site and Database Backup, check the same navigation item.
• A link that used format=3 stops working. Use the navigation item's own link.

The Master and your site's front end now sign every call to the Console Utilities service, and the Console checks the signature.

• New property Console Utilities Require Signature in Admin > Properties. It is No by default.
• When it is No, the Console still serves an unsigned call and records it in Development > Errors as ConsoleWebServicesAuth:Unsigned, with the caller's address and the likely cause.
• When it is Yes, the Console refuses unsigned calls.
• Choose Yes once the error stops appearing. Leave it No while an outside system still posts to the service, because that system cannot sign.
• Custom code that builds its own Console.Utilities proxy sends unsigned calls. Change it to SignedConsoleUtilities.
• The Master and the site must use the same JWT.Signing.Key.Secret value. If they differ, every call is recorded as unsigned.

Console web methods now run only for a signed-in Console user who has access to at least one audience.

• This covers the Console ClientMethods service (Toolbox, CpEditor filters, Webhooks, Data Triggers, Data Transfer restore and Change Upload Directory), the SolrExport service, the Form Wizard service, and the methods behind each Console page.
• A method behind a Console page also needs the navigation item of that page.
• Any other caller gets an error, and the method does no work. A Console page you can open keeps working.
• Warning: anything that called one of these methods without a Console session stops working. Client custom code is the most likely case. We fix each case one at a time as it appears, and we do not reopen the gap.
• Calls to the Console Utilities service are not affected by this change.

The ExtChangeValueOnJavascriptAction CpScript now does nothing for visitors who are not signed in, unless an admin allows them.

• It saves through the same service as the check-in button, so it follows the same setting: Check In Button (ButtonClick, ButtonClick_v2) in Admin > Properties > Anonymous Client Methods.
• Before, signed-out visitors on a page using it saw an error popup, because the server already refused them.
• The same field rule applies: only an admin can set Roles, Audiences, IsEnabled, StartDate or EndDate through it.

The FormAutoSave CpScript now refuses a signed-out visitor's save that sets Roles, Audiences, IsEnabled, StartDate or EndDate.

• The message "This form cannot set that field." appears next to the checkbox, and nothing is saved.
• When a save fails for any reason, the form now shows "Error" instead of technical details about the server.
• Signed-in users, and forms that set other fields, see no change.

The CheckInButton CpScript can no longer change the fields that decide who sees a record, unless the user is an admin.

• A check-in that sets Roles, Audiences, IsEnabled, StartDate or EndDate is refused and nothing is saved.
• Check-ins that set other fields, such as a Yes/No or text field, work as before.
• This also applies when Check In Button (ButtonClick, ButtonClick_v2) is selected for signed-out visitors in Admin > Properties > Anonymous Client Methods.

Web API methods now change only records in the module they are set up for.

• UpsertData and Upsert Data From Site On Same Server no longer move or change a record from another module when a request names its DataId. The item is skipped with the warning "the provided DataId is not available".
• Upserts by DataId, AutoNumber or IntegrationId in the method's own module work as before.
• Breaking change: a DeleteData method with no DeleteData Module now returns "DeleteData Module Required" and deletes nothing. Open each DeleteData method in Development > Web API, choose its module and save. The field is now required on the form.

Centralpoint Agent 8.12.16.10 reads the Windows Setup log and skips the event sources you name when it captures an event log.

• A Setup log capture shows Windows servicing installs, so you can tell when Windows patched a server.
• A capture can name up to 10 event sources to leave out. Their events no longer use up the capture's event limit.
• A source name that contains & or ' now matches. It matched nothing before, for the source filter as well.
• A capture that asks for the Information level now also returns events that Windows logs with no level, which Event Viewer shows as Information. An "All levels" capture of System or Application can therefore reach its event limit sooner.
• The Security log is still not available to the Agent.

The UserSubscriptions CpScript now saves a favorite, subscription or vote only on a record the signed-in user's roles allow them to see.

• A request for a record hidden from the user by its roles is refused, and nothing is saved.
• Admins are not affected.
• Users saving favorites, subscriptions and votes on records they can see notice no change.

The DesignSwitch CpScript now switches the design only for signed-in users, unless an admin allows signed-out visitors.

• Breaking change: the OverrideAuthenticatedUsers attribute alone no longer shows the dropdown to visitors who are not signed in. They see an alert naming the site property until an admin allows it.
• To allow signed-out visitors, go to Admin > Properties, find Anonymous Client Methods, select Design Switch (ReturnDesignSwitchOptions) and save. Picking a design changes it for every visitor to that audience.
• A switch now applies only from the design the audience is currently shown, to an enabled design that is not tagged to All Audiences.
• Picking the design that is already shown no longer saves anything.

The FormAutoSave CpScript now saves only for signed-in users, unless an admin allows signed-out visitors.

• Breaking change: visitors who are not signed in no longer see the Auto Save checkbox, and the server refuses their saves.
• To allow signed-out visitors, go to Admin > Properties, find Anonymous Client Methods, select Auto Save Form (FormAutoSave) and save. A signed-out visitor can then keep saving only the record their own visit created.
• Auto Save no longer overwrites an existing record from another module, or one the user's roles hide. The message "This record cannot be saved from this form." appears next to the checkbox instead.
• Signed-in users saving their own form see no other change.

The CheckInButton CpScript now saves only for signed-in users, unless an admin allows signed-out visitors.

• Breaking change: visitors who are not signed in no longer see the button, and the server refuses their clicks. Custom pages or integrations that call the check-in service without signing in are refused too.
• To allow signed-out visitors, go to Admin > Properties, find Anonymous Client Methods, select Check In Button (ButtonClick, ButtonClick_v2) and save. Selecting it lets anyone change that value on any record visitors can see.
• The button now saves only on records the user's roles allow them to see. Admins are not affected.
• Signed-in users see no other change.

The FormKeywordManager CpScript's Add New service now requires sign-in, the same as its Create button, unless an admin allows signed-out visitors.

• Breaking change for custom code: a custom page or integration that calls the Add New service without signing in is now refused until an admin allows it. The picker's Create button was already disabled for signed-out visitors, so picker users see no change.
• To let signed-out visitors add keywords, for example on a public form, go to Admin > Properties, find Anonymous Client Methods, select Keyword Picker: Add New Keyword (CreateNewKeywords) and save. The Create button is then enabled for them. Selecting it lets anyone add keywords to any keyword list on the site, not only the list the form shows.
• Anonymous Client Methods is a new property that lists front-end services that change data. Each one requires sign-in unless you select it here. Later releases will add more services to this list, and each release that adds one will say so.
• Keywords with an apostrophe, such as O'Brien, are now saved with a single apostrophe.

The UserSubscriptions CpScript now saves favorites, subscriptions and votes only for the signed-in user who clicked them.

• Visitors who are not signed in, and ancestor admins, can no longer save one. The button already showed them an alert, and the server now refuses them too.
• A request that names a different user is refused, so no one can save a favorite, subscription or vote for someone else.
• Votes accept only the up and down values the button sends.
• Voting the same way twice no longer shows an error, and a favorite, subscription or vote can no longer be saved for a record that does not exist.
• Signed-in users see no other change: saving and removing work as before.

The Policies Word download now honors the PreventDownloadifLocked property.

• With the property on, a locked policy document is refused instead of opening.
• A missing document is refused instead of failing later in the download.
• A version link opens only a version of the same document.

With the property off, downloads work as before.

/data/query and /data/files no longer return Web API records, which hold credentials.

• This applies to every API key, including a key granted access to the Web API module.
• Queries for every other module return the same results as before.

If an integration reads Web API records through the Data API, it now gets no rows for them.

Web API records hold credentials, so more site features now treat them as not found.

• The FormAutoSave CpScript, keyword fields, version restore links and the design switch cannot save over a Web API record.
• The DocCreation document builder, the ModuleResults zip export and DataDiffs history skip Web API records.
• The Word add-in cannot open, lock or save a Web API record.
• FormAutoSave in review mode and Word add-in saves accept only a version of the record being edited.

Normal records work as before.

The backup history in Master > Development > Health Monitor now labels differential backups as Differential instead of leaving the type blank. Azure SQL Managed Instance takes differential backups on its own schedule, so they appear often there.

On Azure SQL Managed Instance, the SQL Server 2025 features sync method completes as not applicable instead of failing. Azure manages those server settings there. SQL Server installs run it as before.

Database maintenance runs without errors on Azure SQL Managed Instance and skips the steps Azure manages.

• On a Managed Instance, maintenance updates space usage, then stops. Azure controls the recovery model and log backups there.
• The daily warning about a large transaction log no longer appears on a Managed Instance, where nobody can act on it.
• Site and Master databases can again be exported to a BACPAC file with SqlPackage.

Other SQL Servers run the same maintenance as before.

Centralpoint CLI 8.12.16.8 and Centralpoint Agent 8.12.16.9 can install and manage a Centralpoint site whose databases run on Azure SQL Managed Instance.

• The CLI detects a Managed Instance and encrypts every connection to it. It checks the server certificate first, and asks before trusting a self-signed certificate on an on-premises SQL Server.
• On a Managed Instance, the CLI skips the steps Azure manages: SQL folder prompts, server settings and database file layout. Databases are imported from the install package, not from a local backup file.
• The installer account on a Managed Instance needs dbcreator, ALTER ANY LOGIN and VIEW SERVER STATE, not sa.
• On any SQL Server that shares the web server, a new install caps SQL Server's maximum memory at 60% of the server's memory when it is still unlimited.
• The Agent reports a Managed Instance as one and does not try to change its memory setting.

Web API records hold access tokens and passwords, so the site's button and keyword services now treat them as records that do not exist.

• The CheckInButton and ExtChangeValueOnJavascriptAction CpScripts can no longer change a Web API record, or save any record into the Web API module.
• Keyword Manager fields can no longer read a value from a Web API record.
• Buttons and keyword fields on every other record work as before, including custom code that calls the button service directly.

Sites using Multi-tenant Audiences filtration (Admin > Properties > Audience Filtration and Security) load module results, searches and listings faster on large modules.

• The TenantsA and TenantsB checks look up each record directly instead of reading the full tenant list for every row.
• Which records each user sees does not change: untagged content stays visible to everyone, and tagged content shows only to users in a matching tenant.
• Custom tenant providers that call the built-in tenant filter get the same improvement with no code change.

Paged lists across the site open each page faster on modules with many records or large text fields, such as rich text or extracted document content. This covers module results pages, site search and Console module lists.

• The page of records is chosen first, then only those records' full content is loaded.
• Results, sort order and record counts do not change.
• Lists that use a window function or a wildcard field list in their fields keep the previous query.

Web API methods now refuse a request Filter or sort that could read other data, and a live site no longer returns database error text.

• A Filter on Read Details, Read Results or Get Users that contains a subquery or a database function call, such as dbo.IsInRole(...), returns a 400: "Filter cannot contain a subquery or a database function call." Invalid Filter is now a 400 too, instead of a 200.
• A Read Results OrderBy must be a list of columns, each with an optional ASC or DESC. A DataTables OrderByDirection must be ASC or DESC, and a sort header the grid did not show is ignored.
• With debugging off, a server error returns "The server could not complete this request. Reference: " and the full error goes to Development > Errors. Errors caused by the request itself keep their message.
• A custom method that throws an ArgumentException returns a 400 with its message instead of a 500. A plain Exception still shows its own message; any other exception returns the message above.
• DataTables encodes [cp:placeholders] values before using them in DataTablesWhere. Keep a placeholder inside quotes. One outside quotes, or inside a LIKE pattern, is not protected.

Development > Web API answers two kinds of errors more clearly and gives away less.

• A request whose JSON is broken, for example cut off partway, now gets a 400 with "The request is not valid JSON." on every method, instead of a 500 with a technical parser message.
• Errors from Process Log, Error Log, Natural Language Search and custom code methods include the stack trace only when debugging is on. A live site returns the error message without it, the same as the other methods.

Opening a run in Master > Development > Process Log now checks that the run's ID is valid before looking it up, so only a real ID ever reaches the database. The page looks and works the same.

Opening a run in Development > Process Log now checks that the run's ID is valid before looking it up, so only a real ID ever reaches the database. The page looks and works the same.

Development > Web API has two new methods, Process Log and Error Log, that return this site's process runs and errors as JSON.

• Both return only the calling site's records. Nothing in the request can widen that.
• Process Log filters by Type, HasErrors and Since, and IncludeSteps adds each run's steps. Send a ProcessId to get one run with its steps and errors.
• Error Log filters by Since. Send an ErrorId to get one error with its stack trace and page details.
• Both page with PageIndex and PageSize, up to 200 per page.
• Both are for admins only. Set Security Mode to Access Token and User Mode to Access Token User, and use a token whose user is in the Admins role. Any other setup gets a 403 that says what to change.
• Error Log is not available on isolated installs.
• A request that is not valid JSON now gets a 400 instead of a server error, on these methods and on Natural Language Search.

The Excel Viewer opened by the FileViewer CpScript loads each sheet with one request and reads only the selected sheet of the workbook.

• Sheets with few rows in a large workbook open about 8 to 20 times faster.
• Sheets over 5,000 rows open 15 to 30 percent faster. They still show the first 5,000 rows and the full row count.
• Switching sheets quickly shows the sheet picked last.
• Merged cells that reach the 5,000-row limit end on the last shown row instead of one row short.
• A damaged cached copy of a workbook is rebuilt instead of showing a partial sheet.

Two third-party libraries are updated to their latest patch releases:

• System.DirectoryServices 10.0.13, used by the API, the Centralpoint Agent and the Centralpoint CLI.
• marked 18.1.1, used to display formatted text in the AI and API pages.

When a file is deleted while an update install, patch, repair or Data Update is copying it, the copy now stops for that file at once.

• The file already in place is left untouched, instead of being renamed aside and back on each of three retries.
• The missing file is still listed in the result.
• A copy blocked for any other reason still retries as before.

This ships in Centralpoint Agent 8.12.16.8 and Centralpoint CLI 8.12.16.7, and in the Master update install and Data Update.

Error entries in Development > Errors carry more of what is needed to find the cause.

• A failed site search records the search query it ran, even when site logging is off.
• A canceled request no longer records a site search failure.
• Repeated log entries in an error's details show as a list instead of a type name.
• Scanner probes against the file upload handler are grouped with other invalid requests.
• Query timeouts from background work, and a relation population failure on document data, are grouped and labeled more precisely.

Clearing or rebuilding a large Contextual Search index now deletes its stored search rows in batches, so the clear finishes instead of failing on a time limit.

The Word add-in now loads a module's required relation fields in a single database request instead of one per relation, so it opens faster on modules with many relations.

The Data API's Contains, Starts With and Ends With filters, and its attribute Contains filter, now match the value literally. A filter value with %, _ or [ no longer returns records it should not.

Contextual Search query suggestions now match the typed text literally, so %, _ and [ no longer act as wildcards and no longer return unrelated suggestions.

The search boxes in the Query Analyzer's data source, query and report lists now match the typed text literally, so %, _ and [ no longer act as wildcards.

The ResourceDragAccordion CpScript's name and group search now matches the typed text literally. A name such as file_1 no longer also matches file11.

Typing *, %, _ or [ into an autocomplete now searches for that character, instead of treating it as a wildcard.

• The site search autocomplete no longer returns an empty list when the typed text contains * or % in the middle, such as te*x.
• Module autocomplete fields that search with SQL LIKE return only literal matches.

A page that has no navigation item behind it, such as a custom page reached by its own URL, now loads instead of failing with an error. The navigation groups and the content filter treat such a page as having no navigation item.

• A Console module list whose read is interrupted by SQL Server while data moves underneath it now retries, the same way it already retries a deadlock, instead of showing an error.
• A list column configured with a quoted or bracketed alias, such as [Title] AS 'Page Title', now displays and sorts correctly.

The update removes the ChartImage.axd handler from the site and Master web.config files. The current Telerik version no longer includes it, so every request to it failed with an error.

web.config change. This line is removed from <system.webServer><handlers> in the site Root\Web.config (primary and secondary servers of a load-balanced site) and the Master Web.config:

<add name="ChartImage.axd" path="ChartImage.axd" verb="*" type="Telerik.Web.UI.ChartHttpHandler, Telerik.Web.UI, ..." />

• A virtual directory that runs as its own IIS application keeps its own web.config. Remove the same line there by hand if it is present.
• Custom code that still draws charts through Telerik RadChart and ChartImage.axd was already failing, and needs a different chart control.

The File Manager now accepts uploads up to 1 GB, the size its uploader already allows. Before, a file over 4 MB failed with "Maximum request length exceeded."

web.config change. The update adds this block to the Console web.config (Console\Web.config) on the primary server:

<location path="FileManager.aspx">
  <system.web>
    <httpRuntime maxRequestLength="1048576" executionTimeout="3600" />
  </system.web>
  <system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="1073741824" />
      </requestFiltering>
    </security>
  </system.webServer>
</location>

• A value already higher than these is kept.
• A virtual directory that runs as its own IIS application has its own web.config, which the update does not change. If it hosts the File Manager, add the same block there by hand.

• The "Scheduled task is running late" warning now measures from the time the task was scheduled for, so a task that runs on time after an update install is no longer reported as late.
• The Forecast view now estimates the run time of a task set to run after another task (Following) from that task's own history.

The CleanUp task now deletes API log records older than 30 days, which it had not been doing, so the API log no longer grows without limit.

• The logging records that step already removed are still kept to 30 days.
• A first run on a large API log deletes it in batches, over several nights if needed, so one run never holds the database for long.

A failed Data Update now says what failed in terms you can act on.

• A failed Source Local Path check names the path it tested and the Windows account it tested it as.
• A failed source database check includes the connection error behind it, such as a refused login or a server that cannot be reached.
• Every other Data Update failure keeps the cause of the error it wraps.

A Delimited Text transfer now waits for a source file that its feed is rewriting, instead of failing the run.

• When the source file is missing or locked by another program, the transfer tries again up to three times, 15 seconds apart. The status shows each attempt.
• A source folder that does not exist, or any other open error, still fails the run at once.
• A preview in the Console never waits. It fails at once as before.
• A Standard Module transfer that fails before it locks its module no longer runs its end-of-run steps, so it cannot disturb another run of the same module.

The Excel File display in Design > Data Sources now resolves CpScripts placed in the template's data row once for each data row, alongside the existing {Column} placeholders.

• A Column CpScript in a data row cell fills that cell from the current row, so removeMarkup, replaceText and the other Column properties apply to Excel exports. Example: [cp:scripting key='Column' name='cpsys_Attributes:RTFEditor1' removeMarkup='true' /].
• Attribute values can be read with name='cpsys_Attributes:SystemName', so the query only needs to return the Attributes column instead of extracting each value in SQL.
• A page-level CpScript placed in the data row, such as CurrentDate, now repeats on every row instead of appearing only on the first.
• Templates that use only {Column} placeholders export as before.

The ContextListFilter CpScript now checks its Default property as the quoted value it becomes in the filter.

• Ordinary text, including [ and ", is accepted as before.
• A Default that would end its quotes early and change the filter is rejected with the alert "The 'default' property must keep its quotes and parentheses balanced."
• A Default holding its own list, such as a', 'b, still works.

SQL filters typed into settings now read parentheses inside [bracketed] and "quoted" names the way SQL Server does.

• A filter can no longer use a parenthesis inside a bracketed or quoted name to reach outside the condition it belongs to.
• Filters that use bracketed or quoted names normally, such as [Course Code] = 'a', keep working.
• A filter with an unclosed [ or " is now rejected with a clear message instead of failing as a SQL error.

This applies wherever an administrator types a filter, such as Data Transfer source where clauses and CpScript filter attributes.

Error details, the Process Log and error emails now also hide credentials that a vendor echoes back as a header, a Bearer token or JSON.

• Header values such as X-Api-Key: and X-Auth-Token: show as ***REDACTED***.
• Authorization: Bearer and Basic tokens are hidden, and the scheme name stays. For Digest and similar schemes, the whole header value is hidden.
• JSON values such as "api_key": "..." and "access_token": "..." are hidden, and the JSON stays valid.
• accesskey= values and Azure storage sig= values are hidden.
• A task setting whose name ends in AccessKey or Authorization is hidden in notification emails.
• JSON data transfer errors now hide header and JSON credentials too, which an earlier note listed as not yet redacted.
• A phrase that only looks like a header, such as api_key: required, also loses the word after the colon.

A JSON Output export of a data source that fails now returns HTTP status 500 when JSON Output Error Format is HTML (default).

• The error message still shows on the page.
• Tools or scripts that call the export link and treated any 200 as success now see the failure.
• Exports set to the JSON error format are unchanged. They already returned 500.
• Check any custom code or integration that reads an export in HTML error mode and relies on a 200.

The clicks scheduled task can now remove old clicks log rows on a schedule, through a new Clicks Log Retention setting.

• The job is now Manage Clicks (ClicksManager). Existing ClicksMerger tasks move to it and keep their settings.
• Clicks Log Retention defaults to 0, which keeps every click. Any other value removes clicks log rows older than that many months.
• Ad banner clicks and the newest click are always kept.
• Each URL's clicks Total is reduced by the clicks removed, and a URL with no clicks left is removed. Reports that count the clicks log directly, such as Most Popular, then count only the clicks that remain.
• Removal needs an index on the clicks log's CreateDate. Smaller sites get it with the update. On a large site, the first run with retention on builds it instead of removing anything, which can take some time.
• Each run stops removing rows 20 minutes after it starts, so a large backlog clears over several runs.
• Merging Query String Variable Names now ignores extra spaces and line breaks.

An update install now waits for a running patch to finish, so the two never change the server's files at the same time.

• This applies to the UpdateInstall scheduled task and to installs started from Master > Deployment > Updates.
• The install waits up to 5 minutes. If the patch is still running after that, the install skips that run, and the next scheduled run installs the update.
• The protection starts with the update installed after this one.

Centralpoint Agent 8.12.16.7 no longer starts a patch while an update install is running on the server.

• If an install is running, the Agent leaves the patch untouched. Server Hub sends it again 15 minutes later.
• While a patch runs, an update install waits for it to finish before it starts.
• A patch built to carry its binding redirects forward still applies them to Master/Root/web.config after the server moves past the patch's version. A redirect is applied only when the matching DLL in Master/Root/Bin has the same version.
• If none of those redirects can be applied, the patch reports a failure in Server Hub.

Web API methods no longer return, change or delete the Web API records themselves, which hold method settings and stored credentials.

• Read Details, Read Results and DataTables answer as if a Web API record does not exist, whether it is asked for by DataId, Filter or module.
• Upsert Data skips an item aimed at a Web API record ("not available"), Delete Data reports it as not existing, and Upsert Data From Site on Same Server skips it.
• A request Filter that contains --, ; or /*, or whose parentheses do not balance (even inside quotes), now returns Invalid Filter.
• A Read Results method set to a table name with an alias, hint, database prefix, subquery or comma list on a record table now returns ReadResults Table Not Allowed. Use the plain table name.
• A method set to the Web API module itself now returns a "Module Not Allowed" error.

A refused or failed one-way call no longer risks ending the worker process on a site with trace on.

• Affected: the cache methods RemoveCache and RemoveMemoryCache, and the data transfer, retention policy, NLS and PDF queue one-way methods.
• These methods write no trace messages. Their requests usually leave no row in Trace.axd.
• Refusals are still logged as errors.

Centralpoint Agent and CLI 8.12.16.6 keep the Master's App_Data/AgentSignedProof.txt file when they repair an install.

• A CLI repair no longer overwrites the file.
• The Agent has no other change in this version.

A Master that enforces signed calls keeps enforcing after its app restarts.

• Master saves the time of the last correctly signed Agent call in App_Data/AgentSignedProof.txt.
• After a restart, Master reads the file and enforces at once. Before, it served unsigned calls for up to ten minutes.
• A missing, damaged or expired file, or a changed JWT.Signing.Key.Secret, means no proof. Master then behaves as it did before.
• The file belongs to each install. Sync, a full install and a repair leave it alone.

Development > Web API has a new AceProject Issues method that returns open AceProject issues per user as JSON.

• Each endpoint signs in with its own AceProject login, so callers see only what that login can see in AceProject.
• Filter by UserFilter, ProjectFilter and ModifiedSince, and add IncludeReviewer to include issues the user reviews.
• Each issue shows its project, status, priority, days since it was last modified, and a link to the issue.
• Results are cached for the minutes set in AceProject Cache Minutes, and saving any Web API record clears the cache.
• Keep Security Mode on Access Token for these endpoints.

When a dynamic role's query fails, that role keeps its current members, and the other dynamic roles still update.

• The failure is listed in Master > Development > Errors and in the Process Log, naming each role whose query failed.
• Before, members of the failing role could lose it until the next successful run.

The scheduler now reports problems it used to skip without a trace.

• A web site that cannot be loaded is listed in Master > Development > Errors by id, and the other sites' tasks still run.
• When the list of web sites cannot be read, no site tasks run and the tick is reported as failed.
• A task whose next run time cannot be calculated is reported as urgent.
• A failure reading the advanced scheduled tasks is reported.

The Mail module no longer shows an empty mailbox when a mail service fails to load messages.

• On page load, the user is told the service failed and is offered its account settings.
• On refresh or paging, messages from the other services still list. The list fails only when no service returned messages.
• The Settings list shows a failing service as invalid.
• Each failure is listed in Development > Errors.

Web API methods now tell the caller when they fail, instead of returning an empty success.

• A DataTables request that fails returns its error, and the table shows it, instead of an empty table.
• An Upsert Users request skips a user whose existing account cannot be looked up, rather than creating a duplicate. The response fails, says how many users were skipped, and counts only the users written.
• Each failure is listed in Development > Errors.

An XML conversion that fails, to Excel or to Access, now stops with the error instead of saving with no generated files.

• That includes a missing source XML file or a missing Access template.
• The record is put on hold and shows the error, the same way for both output types.
• The failure is listed in Development > Errors.

Broadcast failures that used to pass unnoticed are now listed in Development > Errors.

• A message body that cannot be read from its URL is reported. The email is sent as before.
• Script failures and batch completion failures are reported once per batch, with a count.

FtpFiles now says how many files failed to upload, and names the first file and its error.

• The count appears in the script's result and in the Process Log.
• The failure is listed once in Development > Errors, with the FTP host but never the full address.
• Files that uploaded are still counted and, when requested, deleted.

ShortGuid now reports a value that is not a valid GUID once per run in the Process Log, and leaves that field empty.

• The run is marked as having errors, so a source-data problem is visible after it finishes.
• Later rows with the same problem are not listed again.

OcrZone now reports an invalid validatepattern or format in the Process Log once per run, instead of failing silently on every row.

• The run is marked as having errors, so the problem is visible after it finishes.
• A validatepattern that times out is listed in Development > Errors once per run, with a count.

GetImageMetaData now reports a JPEG 2000, DICOM or TIFF image that cannot be opened, once per run with a count, in Development > Errors.

• That row's field is left empty, and the rest of the transfer continues.
• A tag or property the image does not have still returns an empty value, without an error.

In a data transfer, [cp:scripting key='Attribute' ... datatype='DateTime' /] now returns the current time when the attribute is blank or missing, in the requested format.

• A transfer's first run, before ScheduledLastRunDate has a value, gets a date instead of an empty value.
• The Process Log no longer shows an ERROR: Attribute line for a blank date.

Data transfers now report failures that used to pass unnoticed, and stop instead of finishing on partial data.

• Validation labels a destination problem as Destination Error, and the message names the account the Master runs as and the real error.
• A step that fails for some rows, such as a skipped XML file or a SharePoint column value, is listed once per run in the Process Log and in Development > Errors, with a count.
• An MD-Staff transfer fails when a page of results or the sign-in request fails, instead of importing part of the data.
• An RSS (Quirks Mode) transfer fails when the feed cannot be read.
• When a failed batch's record ids cannot be read, the batch alert says why.

Data Transfer now reports a stale field map, an unmatched lookup value and a failed batch in full, without filling the error log.

• A field map that names columns missing from the source sends one error per run. It names the transfer and lists every missing column with its destination, instead of one error per column.
• The Process Log notes each value that a Replace, Audiences, Keywords, Taxonomy, Roles or Module script could not match, once per value and up to 50 per lookup. Generating new taxonomy is not reported.
• When a batch fails in a Comments, Aliases, Searches or Clicks transfer, the alert gives the row count, up to 40 row ids and whether any rows were imported, and the batch is saved under Uploads/DataTransfer.

Ignoring a sync method keeps the status it replaced, so a Failed method that is ignored still reads as "Ignored (was Failed)" in the Server Hub.

• Four guards now stay pending and run again on the next sync, until their condition clears: RepairUnreachableApiBaseUrl (no request context, protected or empty appSettings, no endpoint answering) and UpgradeTargetFrameworkAll (.NET Framework 4.8.1 not installed).
• A binding redirect written for a DLL that the site excludes from sync is recorded in Master > Development > Errors. The redirect itself is unchanged.

The scheduler now reports whether a tick ran the due tasks or ran nothing, and why.

• The existing Execute method is unchanged.
• The Master also lists the Development site's pending sync methods once an hour and after an update, so the Server Hub shows a method that never ran, even when an update stopped before the Development step.

Centralpoint Agent 8.12.16.5 tells the Server Hub why it cannot manage a server, and reports the real cause of a failure.

• When server management turns off, the Agent reports the check that failed, such as a missing Site.Key or a Master web.config it cannot read. It sends this once per change.
• A TLS or connection failure reaches the Hub with its underlying cause, not "see inner exception".
• Capping SQL Server memory names the SQL login and the missing permission, and gives the GRANT to run.
• The standing site probe recognizes an HTTP.sys answer that matched no IIS site, and retries it once before reporting.
• The check-in lists the certificates that IIS HTTPS bindings serve, with their expiry dates.
• The Agent reports which path each scheduler tick took.

The SAML IdP Cert Password in the Admin > Deep Links module properties no longer shows its value. A saved password shows dots and the hint "A value is set. Type a new value to replace it."

• Save without touching the field to keep the saved password.
• Type a new password and save to replace it.
• Check Clear and save to remove it.

Saved passwords are not changed.

The SAML Local Certificate Password in the Admin > Global Login module properties no longer shows its value. A saved password shows dots and the hint "A value is set. Type a new value to replace it."

• Save without touching the field to keep the saved password. SAML sign-in keeps working.
• Type a new password and save to replace it.
• The field is required, so Clear is refused while SAML is turned on.

Saved passwords are not changed. If you need the password, get it from whoever issued the certificate.

When updates are turned off for a master, Master > Deployment > Updates now says "Updates are turned off for this master" and offers nothing to install.

• The UpdateInstall scheduled task skips the install and records "Updates are turned off for this master." in its process log.
• Masters with updates turned on see new versions as before.
• This applies to versions released after this one.
• To turn updates back on, contact support.

The Module Designer has a new Password Box control for properties and attributes that hold a password, API key or other secret.

• The saved value is never shown. The field shows dots and the hint "A value is set. Type a new value to replace it."
• A blank save keeps the saved value, and a Clear box removes it.
• Version compare shows dots for a Password Box value instead of the secret.

Switching an existing Text Box field to Password Box keeps its saved value.

The Validation Key and Decryption Key on Master > Admin > Settings no longer show their values. They show dots and the hint "A value is set. Type a new value to replace it."

• Save without touching them to keep the current keys.
• Generate Keys and save still replace both keys.

If you need the Master machine key, read it from the Master web.config.

The Validation Key and Decryption Key on Admin > Settings no longer show their values. They show dots and the hint "A value is set. Type a new value to replace it."

• Save without touching them to keep the current keys.
• Generate Keys and save still replace both keys.

If you copy the machine key to other servers, read it from the site's web.config instead of this page.

Secret fields on Admin > Properties no longer show their saved value. A saved field shows dots and the hint "A value is set. Type a new value to replace it."

• Leave the field blank and save to keep the saved value.
• Type a new value and save to replace it.
• Check Clear and save to remove the value.
• This covers the TinyPNG API key, Google Static Maps API secret, Twilio authorization token, FitBit consumer secret, SalesForce password, consumer secret and security token, SharePoint password, MD-Staff password and client secret, and Itiliti client secret.

Saved values are not changed. If you need to read one of these values, get it from the service that issued it.

A Web API record that saves content now stores a document of up to 16 MB, completing the higher limit added in this release.

Saves over about 4 MB passed the Web API but failed when the site handed the document to its Console, and the response read No Items Upserted. They now save in full, including HTML with dense markup.

web.config change

The update replaces the Console's WebServices\Web.config with a version that adds a <location path="Utilities.asmx"> block: httpRuntime maxRequestLength="196608" and requestLimits maxAllowedContentLength="201326592", both 192 MB. The document grows when it is escaped on the way to the Console, so the limit sits well above 16 MB.

Check two cases on your own servers:

• Any change you made by hand to Console\WebServices\Web.config is replaced by the update. Re-apply it afterward.
• A virtual directory that runs as its own IIS application keeps its own web.config, which the update does not touch.

When DisplayAppOffline is on, the DataUpdate scheduled task no longer fails because the App_Offline.htm page is locked.

• Taking the site offline retries a locked page, and continues when the page is already in place.
• Bringing the site online renames a page it cannot delete, so the site comes back online instead of the task failing.
• The task still leaves the site's API app pool running, as before.

Centralpoint Agent 8.12.16.5 brings a site back online when the Master worker that took it offline stops before its work finishes.

• A sync, an update install, a data update or a backup restore takes a site offline while it runs. If that worker crashed, was recycled, or restarted because a Master file changed, the site stayed offline until someone removed App_Offline.htm by hand.
• The Agent now removes App_Offline.htm from the site's Root and Console within one check-in, and starts the site's API app pool if the work had stopped it.
• A restore that stops after emptying the site's folders leaves the site offline, so a half-restored site is never served.
• An App_Offline.htm placed by hand is never removed.
• Each recovery, and any site the Agent cannot bring back, is reported to Oxcyon.

This needs the Master on 8.12.16. Set Agent:OfflineRecoveryEnabled to false in the Agent's appsettings.json to turn it off.

Creating a site from a backup no longer adds a second copy of a web.config location block.

The backup's location blocks are now matched to the new site's by path, ignoring letter case and slashes. A backup's api.svc block no longer lands beside the new site's Api.svc block, which would define the same setting twice.

web.config updates in a release now reach the secondary server of a load-balanced site.

Some updates stopped before writing the secondary server, because that server had no Backups folder. The update now creates the folder first, so both servers get the same web.config. A secondary that missed an update in an earlier release is not repaired by this release.

Web API records now accept a posted request of up to 16 MB, up from 64 KB, so large generated content saves in one call.

• A request over 16 MB is refused with status 413.
• Lrs.svc and the Query Analyzer share this setting, so their 64 KB limit rises too.

web.config change

The update edits each site's main web.config (Root). The Console web.config is not changed.

• system.serviceModel > bindings > webHttpBinding: the unnamed binding gets maxReceivedMessageSize, maxBufferSize and readerQuotas maxStringContentLength of 16777216. A higher value is kept, and a named binding is not changed.
• <location path="Api.svc">: maxRequestLength is set to the binding's size, at least 16384. A higher value is kept.
• An unnamed basicHttpBinding added by hand at exactly these 16 MB values is removed, when nothing on the site uses it.

Check two cases on your own servers:

• A virtual directory that runs as its own IIS application keeps its own web.config, which the update does not touch. Add the same binding there if its services need larger requests.
• If custom code declares its own <service> for the Web API with a named binding, raise that binding by hand. The update reports it and leaves it unchanged.

When saving Master properties cannot log on as the administrator, the save message now says which step did not run, and why.

• On Master > Admin > Properties, the websites are not updated, and the message says they still hold the old Master property values.
• On Master > Development > Properties (API), the message says the API was not restarted.

Both messages name the account and the reason the logon was refused.

A File System storage path that impersonates an administrator or a named account now stops when that logon is refused. It no longer runs as the app pool identity instead.

• The error starts with "Could not impersonate" and names the account and the reason.
• For a named account, the error points to the storage path's own identity fields, not Admin > Settings.
• Validating the storage path shows this error instead of a stack trace.
• The run status no longer shows the stored encrypted password.

On a Master whose app pool runs as NetworkService, tasks that run as the administrator no longer fail with "An error occurred while attempting to impersonate".

• The CleanUp scheduled task runs to completion again.
• Installing an update records the new version in the Master properties.
• Creating or restoring a website, Update Build Prep, and saving the API properties complete.
• When the administrator logon is refused, the error on Master > Deployment, Master > Content > Scheduled Tasks and update installs now names the account and the reason.

The Centralpoint Agent's admin impersonation check now accepts a user@domain account when the Domain setting is blank.

• A user@domain username with a blank Domain, or a Domain of ., now logs on with the full account name.
• The Agent's hourly check no longer raises AdminImpersonationFailed for a correct password.
• The Api uses the same logon for load balancing and service control, so those actions accept the account too.
• A username without @ is unchanged, and a Domain you set is used as entered.
• A local account whose name contains @, with a blank Domain, now fails to log on. Set Admin.Impersonation.Domain to the machine name for that account.
• When a logon fails with error 1326 and the Domain is blank, the message now says the Domain is blank and how to set it.

A patch now restarts every app pool it stops, and it never copies files into a pool that will not stop.

• A busy app pool gets as long as IIS allows its worker to finish: the pool's shutdown time limit plus 15 seconds.
• A pool that will not stop in time, or cannot be found, is left alone. The patch reports its files as deferred, and that site stays on the old version until you dispatch the patch again.
• A pool that an earlier patch left stopped is copied and restarted by the next dispatch.
• A web.config skips its binding redirects only when a file in its own folder did not land. The other folders of the same site still get theirs.
• When the patch dispatches again, it handles the pools it deferred last time first.
• One patch spends at most 3 minutes stopping and restarting pools. A pool whose stop and restart no longer fit is left running and deferred.

The Api and Centralpoint Agent and CLI 8.12.16.5 use System.Security.Cryptography.Pkcs 10.0.13, which fixes two published denial-of-service advisories.

• The advisories are GHSA-846f-f764-76mx (High) and GHSA-2fmv-rv2c-59x7 (Moderate).
• None of the three calls this library directly. It reached them through the SQL Server client.
• No setting changes and no action is needed.

A new Word Variable Autofill module property fills a Word template's DOCVARIABLE fields from the record whenever the document is opened.

• It applies in the Word viewer and PDF viewer (FileViewer and PdfViewer CpScripts), on download for editing (WordAddInDownload and the Policies download), and in File Output.
• Enter one line per field: Field Name = Attribute | Attribute ; format=MM/dd/yyyy. The first attribute with a value is used, and a field with no attribute prints blank.
• A->B reads attribute B from the record whose DataId is stored in attribute A.
• Fields fill only when the viewer can see the record. A disabled, expired or restricted record opens unfilled.
• Formatted text prints as plain text, and dates show in the site's time zone.
• An invalid format= leaves that field blank. The document still opens.
• Viewing never changes the uploaded file. A copy downloaded for editing and saved back keeps the values filled at download.
• The template must contain a field for each value. Fields missing from the template are skipped.
• Prior policy versions are shown exactly as they were.
• The property is empty by default, so nothing changes until it is set in the module's Page Options > Module Properties.

The libraries behind the Anthropic Claude provider, local ONNX embeddings, the API reference page and AI answer formatting are updated to their latest versions. Nothing changes in how you use these features.

Centralpoint CLI 8.12.16.5 now finds site names and addresses that contain ] when it rewrites them during a migration.

Backup cleanup now keeps deleting old backups when one archive cannot be deleted. The error that follows names each archive it could not delete and why.

Emails and text messages sent by a scheduled task no longer fail because no web page is involved. An email with an attachment given as a site-relative path now includes the attachment.

Multifactor sign-in access codes, Twitter sign-in requests, and other random values the site generates now come from a cryptographically secure generator. Nothing changes in how you use these features.

The RelatedData CpScript now applies each related attribute's own filter. Before, every attribute used the filter of the first one. A site map link with no Fields set no longer causes an error.

The DataSource CpScript's Google Map display now places each marker at the row's own latitude and longitude. Before, every marker used the longitude of the first row.

When a Data Transfer writes a file whose name is already taken, it now adds the first free number (_1, _2, ...) to the name. Before, it added a random number, which could match an earlier export and overwrite it.

Attribute selectors built on CpListBox and CpDataListBox keep a saved selection in two more cases.

• A list whose values are text, such as an IntegrationId column, no longer drops a saved value that is not a GUID when RememberMissingItems is on.
• A CpDataListBox with JoinClauses no longer reports its saved selections as inaccessible.

Requests from scanners and bots are answered quietly instead of raising server errors.

• A request with a malformed Host header gets a plain 404.
• A request path the server rejects, such as one containing & or ::$DATA, no longer writes an error to the Windows event log.
• When visitors request stored files whose names the site cannot serve, Development > Errors shows one entry that tells you to run Admin > File Name Cleanup.

Module search browse letters and title filters now match %, _ and [ as plain characters.

• A browse letter of % lists only titles that start with %, not every record.
• A title prefix too long for any title to match returns no results instead of an error.
• Searches and related-content filters on a name that contains ] now find that name.

System queries that exclude a list of 100 or more records now run consistently fast, however large the list grows. This applies anywhere the platform builds a query that leaves out a set of records, for example:

• a Data Transfer delete that skips the records listed in a module's Grid Disabled Checkboxes property
• front-end role filtering when Web Site Role Filtration & Security is set to All (FISMA Compliant)
• the DesignSwitch CpScript's excludeddesigndataids list
• custom code that builds a query with SqlBuilder

Custom code that filters by a user attribute with more than 99 user ids no longer fails with a SQL error. Custom code that references SqlBuilder.MaxValuesBeforeLookupTable now gets a compiler warning; its value is unchanged and the code keeps working.

Each Data Cleaner rule can now record where its logic comes from, using two new optional attributes.

• Determination holds the IntegrationId of each approved detection rule behind this rule, one per line, up to 4,000 characters.
• Source Credit names who the logic is credited to: the authority first, then the citation, up to 256 characters.

Both attributes are optional, so existing rules are unchanged and save as before. Both values can also be used in data sources and reports.

To prevent cross-site scripting (XSS), names, titles and other stored text shown in the console and in front-end dropdowns now display as text and can no longer run script.

• Covers console list pages and record details, including Site Architecture > Taxonomy and Audiences, Users, Roles, Development > Database and Keyword Lists, Design > Media Manager, module record grids, breadcrumbs, and the taxonomy and audience selectors.
• Covers front-end dropdowns built by CpScripts such as NavigationSectionMenu, AdvertisingSearchRedirectDropDownList and EventBriteRegisterButton, plus the taxonomy cascading dropdown.
• Allowed formatting such as bold, italics and colored text still renders.
• A title that contains an email in angle brackets, such as Name <name@example.com>, now shows the email instead of hiding it.
• Module grid columns defined as HTML expressions in the module's Grid Columns setting, such as Preview links, are unchanged.
• Approving or saving a comment in Comments > All Modules no longer saves the on-screen hint text as the commenter's name and email. A comment from a signed-in user keeps its empty name and email, and the comment text is saved exactly as submitted.

Error details and scheduled task notification emails now hide API key, token and secret values, as they already did for passwords.

• A value written as api_key=, apikey=, access_token=, client_secret=, secret_key= or similar shows as ***REDACTED***.
• A form or query field named for a credential, such as api_key, access_token or client_secret, is left out of Development > Errors.
• A task setting whose name ends in Token, Secret or ApiKey, such as JsonBearerToken, is hidden in notification emails.
• Links and HTML around a hidden value stay intact. The notification message you write for a Data Update task is sent as written.
• Some values that only look like credentials, such as a pageToken= paging value, are also hidden.

When a JSON data source cannot load its data, visitors now see "The JSON data source could not be loaded." instead of the vendor's error text.

• The vendor's error is kept in the page trace for administrators, with API keys and tokens hidden.
• After a failure, the data source waits one minute before calling the vendor again, so an outage does not send a request on every page view.
• The Personal Dashboard Data Source gadget and the Data Sources JSON preview and validation messages now show vendor text safely, with any HTML displayed as text.
• CreateExcel.aspx shows the site's error page for a failing JSON data source, and CreateJSON.aspx returns a 500 in JSON error mode. Site search results that use a failing JSON data source come back empty.

When a JSON data transfer fails against a vendor, the vendor's error text no longer shows API keys or tokens.

• An api_key, apikey, token, secret or secret_key value that the vendor echoes back is shown as ***REDACTED*** in the Process Log, the transfer's error email and the Console validation message.
• The error message no longer includes a technical stack trace, so it is shorter and easier to read.
• Credentials sent as a header, such as Authorization: Bearer, or in JSON form are not yet redacted.

Audit trail events are now kept for 30 days when they were written by the system rather than by a person. Until now these events were never removed, and on the busiest sites almost all of them come from automated processes such as Data Transfer, which records an event for every record it touches on every run. Over time that grows into millions of rows that no one reads.

Removing them:

• Keeps the database from growing without limit, which shrinks backups and makes them faster to create and restore.
• Makes the Audit Trail on a record easier to read, since it is no longer buried under repeated automated entries.
• Keeps the history people actually use. Every change made by a current user stays in full.

How it works:

• The new Events Retention property in Admin > Properties sets how long system-written events are kept. It defaults to 30 days.
• Only events not tied to a current user are deleted: automated processes such as Data Transfer, anonymous visitors, and users no longer in the system.
• Events by current users, including users marked deleted, are always kept.
• The newest event of each type on a record is always kept, so "last modified by" and similar displays are unchanged.
• Set 0 to delete all such events on each clean up, or -1 to disable retention and keep full history.
• It runs from the CleanUp scheduled task, Master > Development > Utilities, and each site sync, install, backup and deployment. Sites with a large backlog clear it over several clean ups.

A JSON Data Transfer no longer sends a blank URL parameter when its token resolves empty, and a vendor error now fails the run.

• A query parameter whose value is only cp:scripting tokens that resolve empty is left out of the request. The Process Log names the parameter that was left out.
• Fixed text written beside a token is still sent, so fields=id,name[token] sends fields=id,name.
• When the vendor returns an error (such as 401 or 404), the run fails and sends the error email. Before, the run could report success and import one bogus row.
• Saving a transfer whose JSON source returns an error shows the vendor's message under Validation, as plain text.

When install or repair creates the cpsys_Master app pool, Centralpoint CLI 8.12.16.4 turns off IIS's 29-hour periodic recycle on it, so a new install never starts with it.

• The CLI changes only a pool it has just created. The Centralpoint Agent covers an existing cpsys_Master.
• A value set in the server's app pool defaults is kept.
• Site and API app pools keep the IIS default.

Centralpoint Agent 8.12.16.5 turns off IIS's 29-hour periodic recycle on the cpsys_Master app pool, so a recycle no longer kills a long scheduled task or sync partway through.

• The Agent changes the pool only while the pool and the server's app pool defaults are both on the IIS default of 1,740 minutes. A value the client set is kept.
• Changing the pool can restart it, so the Agent waits until no Master process is running and no site is offline.
• A Master older than 8.12.12 keeps the default until it is updated.
• Site and API app pools keep the IIS default.

Centralpoint Agent 8.12.16.4 restarts a loop that faults and keeps checking in when one management step fails.

• A scheduler, management or pipe-listener loop that faults restarts after a 1 minute wait. The wait doubles on each repeat fault, up to 4 minutes, and starts again at 1 minute after an hour without a fault.
• A management step that throws before the check-in is logged and skipped, and the check-in still runs. The steps are the web.config refresh, the trace auto-revert, the IIS repair and the pending Master operations.
• A Master database that cannot be opened no longer stops the tick. A pending Sync or Update Install waits. One still open after 4 hours is reported as "the Master database could not be reached".
• Every Master database connection the Agent opens trusts the SQL Server certificate.
• The Master health probe takes the Master's address from UpdateInstall.SyncInvokeMethods when Api.Base.Url and Cda.Utilities are absent. A localhost address is skipped.
• Agent:ReportLoopHealth (default true) set to false stops the Agent sending its loop health.

Download to Edit in Word now works for macro-enabled Word files (.docm and .dotm), and their macros are kept when the document is saved back.

• These files no longer show a System Error. They download, lock and save back like a .docx.
• The WordAddInDownload CpScript now shows its checkout link for .docm and .dotm records instead of a plain download link. With handlerOnly set, these records show the checkout link instead of the nonHandlerFormat output.
• To edit a .dotm template, right-click the downloaded file and choose Open. A double-click starts a new document, which the add-in cannot save back.
• Word may block the macros in a downloaded file until it is unblocked. Editing and saving still work.
• If a document cannot be prepared for editing, the download fails without locking the record.
• When Remote Update Security Mode is empty, WordAddInDownload shows a plain download link instead of a checkout link that fails.
• .docx, .doc and .pdf downloads are unchanged. The PolicyWordAddInDownload CpScript in the Policies module does not support macro-enabled files yet.

The DragAndDropFileUpload CpScript now works when its optional redirectUrl is left out.

• Leaving out redirectUrl no longer causes an error on the page.
• Without redirectUrl, no "Click here to go to form" link is shown after an upload. A blank redirectUrl used to show a link to the home page.
• With redirectUrl set, the link works as before.

A site page that is still listed in navigation, but whose content record no longer exists, now shows the Page Not Found page instead of a server error.

• Visitors see the standard not-found page.
• Pages whose content exists are not affected.

Tools > Clear Search Terms now works when All Modules is selected, and checks the Filter before deleting anything.

• Choosing All Modules clears search terms instead of failing. With an empty Filter, you are asked to confirm before every search term on the site is cleared.
• A Filter that contains ;, --, /*, or unbalanced quotes or parentheses is rejected with a message, and nothing is deleted.
• When one module is selected, the Filter applies only to that module's search terms, even when it uses OR.
• All Modules appears once in the Module list.

Centralpoint CLI 8.12.16.3 creates cpsys_Master as NetworkService on a new install. Centralpoint.exe repair no longer changes cpsys_Master's identity, which the Centralpoint Agent now manages. Repair still restores the identity of every other Centralpoint app pool.

Centralpoint Agent 8.12.16.3 runs a local named pipe that makes IIS changes for the Master, and it moves the cpsys_Master pool to NetworkService.

• The pipe accepts only the Master's own worker process, SYSTEM, or an elevated administrator. A web site's worker process is refused, even though it runs as the same account.
• The move to NetworkService waits until the Master is 8.12.16 or later, its admin impersonation logs on, and no Master process is running.
• Agent:MigrateMasterPoolIdentity (default true) set to false moves the pool back to LocalSystem. Agent:PipeEnabled (default true) turns the pipe off.

When Windows cannot translate an account name during a file permission grant, because the Local Security Authority is briefly unavailable, Master > Development > Errors now records it as a temporary outage. The message says that the next Clean Up retries the grant. It no longer reports that the SQL service account does not exist.

Master > Development > Health Monitor now shows available memory correctly in GB for any amount. Before, values under 1,000 MB or over 9,999 MB showed the wrong figure. When the server does not let the Master read the memory counter, the page shows "unavailable" instead of an error.

When the Admin Impersonation account cannot log on, a sync method now stops and reports "Could not impersonate an administrator" instead of running under the Master's own identity.

• Executing a method from Master > Development > Sync Methods shows the error, and the Process Log records the run as failed.
• An update install reports the failure for each affected method.
• The DevOps task keeps the admin identity for every method in its run.

To fix the logon, update the Domain, Username and Password in Master > Admin > Settings.

Saving a load-balancing change on a web site now tells the Centralpoint Agent to re-read its load-balanced site list. The Agent service no longer restarts. If the Agent cannot re-read the list, the save restarts the service, as before.

The Master application pool (cpsys_Master) now runs as NetworkService, its original identity, and the Centralpoint Agent makes the Master's IIS changes for it.

• The Agent moves an existing Master pool to NetworkService on its hourly check, when no Master process is running. The pool recycles once.
• Creating and deleting a web site, turning read-only on or off, Always On, and the update install's pool stops and starts now go through the Agent.
• A pool stop or start that fails is now recorded in Master > Development > Errors.
• A scheduled task that writes to a folder outside the Centralpoint install needs NETWORK SERVICE granted on that folder, as before. This covers Data Transfer, Data Archive, SFTP Source, File Synchronization and similar tasks.

A canceled module unenroll or settings change that removes indexed passages now writes an error entry on Master > Development > Errors. The entry names the module and the passages already removed. Run the unenroll again to finish.

Knowledge Assistant search and chat, and the Page Assistant, now finish faster on large indexes and no longer time out when too many passages match.

• Search and chat build the list of matching passages first, then rank only those. A search over about 80,000 passages dropped from about 5.6 to 3.7 seconds on a test server.
• When more than 150,000 passages match, the search stops and shows "Select specific knowledge-base modules to search this index."
• When you already picked modules and they are still too large, it shows "The selected knowledge-base modules are too large to search together. Select fewer modules."
• Chat shows that message instead of an answer with no sources. The Page Assistant still answers, without content from your site.
• A search that cannot finish within 20 seconds now stops at that point, before the browser's 30-second limit.
• The retrieval benchmark on the AI test page reports how many passages matched, and it stops with the message instead of timing a search that did not run.

A Bulk (insert only) transfer into a standard module no longer loses rows silently when the database connection drops.

• A batch that fails because the connection dropped is cleaned up and retried, up to three tries.
• A batch that still fails is saved to Uploads\DataTransfer\Failed_{transfer id}\, and the transfer continues with the next batch.
• When a run loses a batch or does not finish, its source files are moved to that folder, so the next scheduled run does not import them again.
• The run shows "Transfer Completed with N lost batch(es)" and sends no success notification.
• One recovery email lists the lost rows, the saved file and how to re-run. It goes to the transfer's Error Notification and Notification recipients, or else to the site's Error Notification Email.
• The Error Notification Body has three new placeholders: DataTransferRecordLink, LostBatchSummary and KeptSourceFolder.
• A lost batch sends this recovery email instead of the transfer's own error email. Its subject is "Data Transfer lost N batch(es): ", so update any mailbox rule that matches the old subject.

Delete the saved files once the rows are recovered.

Data Broadcasts that use the custom SMTP settings now always check the email server's certificate when they send over SSL.

• A broadcast sent through a custom SMTP server with a self-signed, expired or mismatched certificate now fails instead of sending. Before, a form email on the same site could switch this check off.
• Broadcasts sent through the site's own email settings keep trusting that server, the same as form emails, so they work as before.
• Custom SMTP settings now send directly to the configured server, and accept a host written as host:port.
• SMTPEnableSsl is now applied both on and off, even when the site's web.config turns SSL on for email.
• When custom SMTP has no user name and password, the broadcast connects without credentials. It no longer uses Windows sign-in or the user name and password in the site's web.config.

If custom SMTP broadcasts stop sending after this update, install a valid certificate on that email server, or set the host to the name the certificate was issued for. The failure reads "The remote certificate is invalid according to the validation procedure."

Centralpoint now trusts an invalid certificate only for the one connection that needs it, never for the whole site.

• Form emails still send through an email server with a self-signed certificate, the same as today.
• All other secure connections, such as web service calls and other emails, now check certificates normally, even after a form email was sent.
• The Epic wait-time data sources still connect to their own Epic server as before. Other code that calls that same Epic server also skips the check, so point these data sources only at your real Epic server.
• Data Broadcast subscription confirmation emails now close their mail connection after each send.

Check your custom code

Custom code under App_Code/Custom may have worked only because a form email had already turned certificate checks off for the whole site. After this update, it can fail when it calls an HTTPS site or email server whose certificate is self-signed, expired, or issued for a different name.

• Look for this error: "The remote certificate is invalid according to the validation procedure."
• Best fix: install a valid certificate on that server, or connect with the host name the certificate was issued for.
• If the server must keep its certificate, trust only that connection with Centralpoint.Web.CertificateTrust. Do not add code that trusts every certificate, because it turns the checks off for the whole site again.
• Custom code that trusts a mail client must dispose it (a using block). Otherwise another email to the same server can reuse the trusted connection.

Failed SAML sign-ins through a Global Login now show up in Development > Errors with their cause, and users no longer loop back to the Identity Provider.

• Each failed sign-in is recorded under its own SAML sign-in error, with the step that failed and the timing details sent by the Identity Provider. User names and attribute values are never recorded.
• Repeated failures are limited to about one entry an hour for each Global Login and step, so an outage cannot flood the error list.
• After three failed sign-ins in a row, the user sees the AuthenticationFailedErrorMessage with a support reference instead of being sent back to the Identity Provider again.
• Error entries no longer store the raw SAML response for any error on the site.

The Centralpoint Agent and command-line tool are updated to 8.12.16.1.

• System.Security.Cryptography.ProtectedData is updated to 10.0.12.
• System.IdentityModel.Tokens.Jwt is updated to 8.23.0.

Several third-party libraries that every site loads are updated to their current versions. There is no intended change in behavior.

• Dapper (data access) is updated to 2.1.89.
• Microsoft.Bcl.AsyncInterfaces, Microsoft.Extensions.DependencyInjection and System.Security.Cryptography.ProtectedData are updated to 10.0.12.
• System.IdentityModel.Tokens.Jwt and its four Microsoft.IdentityModel libraries (sign-in tokens) are updated to 8.23.0.

Masters already on 8.12.15 receive the same libraries and binding redirects through patch 8.12.15.1.

web.config change - read this if a site has a virtual directory or custom code

This version updates these runtime > assemblyBinding binding redirects in each site's Root and Console web.config, and in the Master's Root web.config:

• Microsoft.Bcl.AsyncInterfaces -> 10.0.0.12
• Microsoft.Extensions.DependencyInjection and Microsoft.Extensions.DependencyInjection.Abstractions -> 10.0.0.12
• System.Security.Cryptography.ProtectedData -> 10.0.0.12
• Microsoft.IdentityModel.Tokens, Microsoft.IdentityModel.JsonWebTokens, Microsoft.IdentityModel.Logging and Microsoft.IdentityModel.Abstractions -> 8.23.0.0
• System.IdentityModel.Tokens.Jwt -> 8.23.0.0

Dapper keeps its assembly version, so it needs no redirect.

1. A virtual directory running as its own IIS application has a separate web.config that this update does not touch. Add the same redirects to that web.config by hand, or the sub-application fails with a "Could not load file or assembly" error.
2. Custom code that references any library above at an older version must still load after the update. If it does not, add the matching redirect to its configuration.

The CleanUp scheduled task's Temp folder sweep no longer deletes an empty folder created in the last month.

• The same sweep runs from Development > Utilities and with each website sync.
• Pages that create a working folder in Temp and fill it later keep that folder while they wait. A large upload no longer fails with a missing folder error.
• An empty folder now stays until it is one month old, then cleanup removes it.
• Files older than one month are removed as before.