Support

The Embedder now shows only its error message when the requested record does not exist or no attribute is named. It no longer goes on to render content after the error.

The page that blocked visitors see now shows a message only for an active IP Manager block rule. Any other record returns an empty page, so the page can no longer be used to read other records.

The Excel export of a data source now checks that the data source is enabled, the same check every DataSource CpScript makes. A disabled data source returns an error instead of its rows. If an Excel export stops working after the update, enable the data source in Design > Data Sources.

The comments RSS feed (/Modules/Comments/Rss.aspx) now shows only comments on records the visitor can see.

• A feed for one record (?did=) is empty when the record is disabled, out of date range, or outside the visitor's audience or roles.
• The site-wide feed leaves out comments on records the visitor cannot see, and respects tenant filtering.

The approve-and-notify and decline-and-notify buttons in form approval emails now work only from a link the site issued. The site refuses a link that was changed.

• The same applies to approval emails from Procedure Manuals > Policies.
• Approval emails sent before this update lose those two buttons. Approve or decline those records in the Console.
• The plain Approve button, which opens the record in the Console, works as before.

The script preview page that Forms > Forms Wizard opens for View Preview and View Reports now shows content only to a Console user signed in on the website.

• A visitor who is not signed in, or who has no Console access, sees a sign-in message and a Login link. The page shows no record content.
• A Console sign-in does not carry over to the website. Editors sign in on the website once, then View Preview and View Reports work as before.
• The Web Site Script Preview property in Admin > Properties now reads Enabled (Console users only) and Disabled. Its value does not change.

Centralpoint Agent 8.12.16.19 adds four security checks that report signs of a breach to Oxcyon.

• Reports whether each site's JWT.Signing.Key.Secret is the default that ships with every install, including a key set only in Local.config. It sends a fingerprint, never the key.
• Reports System-token and admin calls to the Master API from an address that is not this server, Oxcyon, or an allowed address. A load-balanced install lists its balancer in the Agent setting Agent:SecurityChecks:ApiCallerAllowedAddresses.
• Counts request validation, ViewState, cryptographic and session-queue events in the Application log each hour.
• Reports backup, source, database, log and SQL files under each site's Uploads folder.

The Master API keeps a short in-memory list of privileged calls for the Agent, and answers it only to the server itself. Each check can be turned off with the Agent setting Agent:SecurityChecks:<Name>Enabled.

Centralpoint Agent 8.12.16.14 counts the accounts locked out on each site and reports the count to the Uber with its hourly sign-in check.

• A hard lockout and a timed lockout both count.
• Failed attempts are added up for each user, so one user's successful sign-in no longer hides another user's failed attempts.
• A start date moved by an import or an administrator, outside the lockout window, does not count as a lockout.
• The first check after the Agent restarts records the current state and reports nothing.

Centralpoint Agent 8.12.16.13 checks each server for signs of a breach and reports them to Oxcyon's Server Hub.

• Script files added under a site's Uploads or Temp folder, or at the top of its Root folder.
• SQL Server changes: risky options such as xp_cmdshell turned on, the sa login enabled, and new logins, sysadmins, databases and SQL Agent jobs.
• web.config changes made outside an Oxcyon update or command, public Trace.axd, and machine or Telerik keys shared with another server.
• New API keys, sign-ins by deleted or long-idle accounts, and bursts of failed sign-ins.
• An IIS worker process starting a command shell.

The Agent sends key fingerprints only, never the keys. It changes nothing on the server. Each check can be turned off in the Agent's appsettings.json with Agent:SecurityChecks:<Check>Enabled, and Agent:SecurityChecks:ProcessSpawnAllow lists custom code that starts a shell on purpose.

The Data Broadcast Subscriptions page now changes subscriptions only for the member who is signed in. A request that names another member, or comes from a visitor who is not signed in, is refused. Subscribing, unsubscribing from one broadcast, and unsubscribing from all work as before.

The Master API's database export, which the Centralpoint Agent runs for a database backup, now writes only a .bacpac file to a local drive of the server. A network-share path or any other file type is refused, so an export cannot leave the server or replace another file.

On the AI test page, Restart and the batch performance test now work only for an administrator of the site (or an ancestor site) or a member of the Developers role. Other users get a permission message.

• The API test page no longer shows the site's connection string.
• Its Restart button works only for an administrator of the site (or an ancestor site) or a member of the Developers role.

The Restart button on Development > Query Analyzer now works only for an administrator of the site (or an ancestor site) or a member of the Developers role. Other users get a permission message and the site keeps running.

The Master and website Console web.config files no longer allow anonymous access to Trace.axd. Their sign-in requirement now covers it like every other page.

The update removes the override from installed sites, and removes it again if a later deployment brings it back.

web.config change: the update removes this block from the Master Root web.config and the website Console web.config:

<location path="Trace.axd"> with <authorization><allow users="*" /></authorization>.

Client impact: a virtual directory that runs as its own IIS application with its own web.config keeps the override if it has one. Remove the block there by hand.

The website now refuses uploads sent to Telerik's default upload handler, Telerik.Web.UI.WebResource.axd?type=rau, which accepted a copied upload from any visitor. The Console is not affected.

• Every built-in website upload already uses its own checked handler.
• The rich text editor's Image, Document, Media, Flash and Template managers on website pages now upload through the editor's dialog instead.

web.config change: the update adds this block to the website's Root web.config only. It does not touch the Console's web.config:

<location path="Telerik.Web.UI.WebResource.axd" inheritInChildApplications="false"> with requestFiltering > denyQueryStringSequences > add sequence="type=rau".

Client impact:

1. A virtual directory that runs as its own IIS application has its own web.config, which the update does not change. It keeps the default handler until the same block is added by hand.
2. Custom code with a RadAsyncUpload on a website page and no HttpHandlerUrl stops uploading. Point its HttpHandlerUrl at a checked handler that registers an upload context, as described in the upload dialog note in this version.

The DragAndDropFileUpload CpScript now accepts a dropped file only from the page that rendered it, and stores it only where its tag says.

• The module, record, folder and title now come from the tag. A changed request can no longer redirect them.
• Each field in attributesToUploadTo takes one file per page load.
• Only document, image and media file types are accepted.
• A refused or failed upload now shows a message instead of counting as uploaded.
• An uploadToFolder value without a trailing slash now stores a correct path.
• The page must have session state. Without it, the tag shows a message instead of the drop area.

Custom code impact: custom code that posts directly to Modules/FileSharing/Telerik_RadAsyncUpload.ashx is refused with 403 after this update. Use the CpScript instead.

The file upload dialog now saves only to the folder, and only the file types, that the page which opened it allowed.

• With overwrite protection on, an upload goes to the dialog's own folder. A folder named in the request is ignored.
• A file whose type the dialog does not allow is refused with "This file type is not allowed."
• With overwrite protection off, and in the File Explorer view on website pages, uploads now also need the dialog's upload token. An upload without it is refused with 403.
• No setting changes. The dialog sends the token itself.

Custom code impact: this extends the overwrite-protection note in this version. A custom page that uses Telerik_RadAsyncUpload_OverwriteProtection.ashx with cpType file must register a Centralpoint.Web.FormUploadContext of kind file that sets TargetFolder to the mapped folder and Extensions to its allowed list (comma-separated, for example .pdf,.docx). Without both, its uploads are refused. A page with cpType resource registers kind resource.

Data Transfer files now download through the Console, because they are no longer reachable by URL.

• Source file, Excel Sheet Consolidator and Process Monitor download links in the Console keep working for administrators.
• The upload control lists each configured destination file that exists, as a download link.
• Only administrators (Admins and LimitedAdmins) can download these files. Other users see a message instead.
• Custom attribute files linked from the Console, such as the Form Wizard's generated XML, download the same way.
• If your site's Uploads folder is an IIS virtual directory, add a VirtualDirectories entry for /Uploads to the site's Api appsettings.json. Without it, these downloads report that the file no longer exists.

Files under /Uploads/DataTransfer/ and /Uploads/CustomAttributes/ are no longer served to browsers or outside systems. Administrators download them from the Console instead.

• Data Transfer imports and exports, and module custom attribute files, return "not found" when requested by URL.
• An outside system that fetches a Data Transfer export by URL stops working. Move that feed to a secure destination such as SFTP, OneDrive or SharePoint.
• An export configured outside /Uploads/DataTransfer/, such as /Uploads/Public/, stays reachable by URL until you move it.
• Resized images under Uploads (/Uploads/.../photo.jpg/600/0/false/Image.ashx) keep working. Image.ashx now serves image files only.

web.config change

The sync updates the site's Root web.config:

• It adds a locked <location path="Uploads/DataTransfer"> and <location path="Uploads/CustomAttributes">, each denying every file.
• It adds a locked handlers section to <location path="Uploads"> and <location path="PrivateLabeling">. It maps Image.ashx to the image resizer and refuses every other .ashx file.

Check two cases after the sync:

1. A web.config you placed in a folder under Uploads that sets handlers now fails for that whole folder (HTTP 500.19). Move those handler settings into the Root web.config.
2. Custom code that links to a file under these two folders by URL must send administrators to the Console download instead.

The overwrite-protection upload handler, used by the file upload dialog and the Resource upload window when overwrite protection is on, now accepts an upload only from a dialog this site opened in the same session.

• A request that does not carry the dialog's upload token is refused with 403 before any file is written.
• The dialog and the Resource window send the token themselves; no setting changes.
• Custom code impact: a custom page that sets Telerik_RadAsyncUpload_OverwriteProtection.ashx as its RadAsyncUpload handler must register an upload context in Page_Load (Centralpoint.Web.FormUploadContext.Register, kind file or resource) and send its token as ctx from its uploading script, or its uploads are refused after this update.

The Resource upload window and the Bulk File Upload window of a FormUpload field now accept an upload only from the form that rendered the field.

• A direct visit to either window, or an upload sent to its handler from outside the form, is refused with "This upload page must be opened from a form. Reload the form and open the upload window again."
• Each field gets its own upload context when the form renders, so the roles, size limit, folder and file count come from the field's settings, not from the window's address.
• Public forms with a Resource or bulk-upload field keep working for signed-out visitors.
• A signed-in Console or Master user can still open either window by address.
• A visitor who leaves a form open past the session timeout, 20 minutes by default, is refused and told to reload the form.
• Custom code that opens /Modules/Forms/FileUpload/Resource.aspx or /Modules/Forms/FileUpload/TelerikBulkUpload/Default.aspx by address, without the FormUpload field, no longer works for a signed-out visitor.

Centralpoint Agent 8.12.16.12 keeps Trace.axd local-only when a remote trace session started by Oxcyon support ends. The Agent restores the site's earlier trace setting, always with localOnly="true", so a session opened before this update cannot undo the site-wide trace fix.

Trace.axd now answers only requests made on the web server itself, on every site, so trace output is never readable from another machine.

• Trace is turned off on the Development, Master and child sites.
• Turning trace on from Development > Utilities still works. The output is readable only from a browser on the web server.
• If a later deployment brings back a web.config that allows remote trace, the next sync closes it again.

web.config change

The update edits the <trace> element in each site's Root and Console web.config. It sets localOnly="true" and enabled="false".

• A virtual directory that runs as its own IIS application has its own web.config, which the update does not touch. If it carries localOnly="false" on its <trace> element, set it to true by hand.
• No assemblies, handlers or modules change, so custom code is not affected.

Centralpoint Agent 8.12.16.11 and Centralpoint CLI 8.12.16.10 sign their calls to the Uber and the Master with the Master's own key once the Uber has accepted it.

• New centralpoint signing-key show lists the fingerprint of each site's key on the server.
• New centralpoint signing-key rotate --compromised replaces every key on the server after a security incident.
• centralpoint install --enrollment-code installs a new Master with a one-time code from the Uber.
• Both still fall back to the shared signing secret while the Uber accepts it for your Master.

Admin > Settings now shows a Signing Key Fingerprint below Windows Identity. It names this server and the fingerprint of its signing key. Compare it with the fingerprint in Server Hub before a key is approved there.

Each Master and web site now signs its system calls with a key of its own, so one site's key can no longer act as another site.

• Every server creates its own signing key the first time it runs this version. Updates, repairs and load-balancing copies keep each server's key.
• Your Master registers its keys with the Uber, and keeps a list of its web sites' keys.
• The shared signing secret still works on every site, so nothing changes until the Uber turns it off for your Master.
• Admin sign-in now keeps its site type in a cookie protected by your site's own machine key. An administrator from the Master or Uber may be asked to sign in again once.

The Api no longer stores the value of a request header whose name looks like a credential in an error record.

• Headers such as X-API-Key show as redacted on Development > Errors. The fixed list of redacted headers still applies.
• Other headers are stored as before.

Every page load gives a visitor a Web API token, including anonymous visitors. Endpoints that list no roles used to accept that token. They now return 401.

• Five Page Assistant endpoints still accept anonymous visitors on a Web Site: SummarizeText, GetCapabilities, ChatStream, DataSourceRender and RagRetrieve. Master and Uber never accept the anonymous token.
• Admin-only endpoints now check the role: the RAG chunk, inspect and benchmark tools, the embedding test, and the Process Monitor (LimitedAdmins and Admins).
• Signed-in users who are not Admins lose the RAG and embedding diagnostics on API > AI Test Center.
• Word Add-In and other signed-in callers are unchanged. Custom code that calls the Web API with an anonymous token must sign in first.

A Web API key that has no module grants now reads nothing, and only the Admins role can manage keys.

• /data/query returns data only from modules the key has a Query grant for. /data/files downloads only from modules the key has a Download grant for.
• A key missing the grant it needs gets a 403 response. Before this release, a key with no grants read every module.
• API > API Keys marks each key that has no module access, no query grants or no download grants. The create dialog says a new key reads nothing until you grant it modules.
• Only the Admins role can open API > API Keys or call the key endpoints. LimitedAdmins and Developers lose this page.

Before you update: open API > API Keys and grant modules to every key in use. Give Query for /data/query and Download for /data/files. A key without the grant it needs stops working when the update installs.

Centralpoint CLI 8.12.16.9 gives each new install its own machine key and Telerik dialog key.

• The install writes new keys into the Master and Development web.config files. It no longer keeps the keys from the install package.
• When the CLI cannot write the keys, it says so and the install goes on. Generate the keys afterward in Admin > Settings for the Development site, or Master > Admin > Settings for the Master.

Load Balancing Verify now compares the secondary server's machine key with the primary's. Configure copies the full key set.

• Verify shows "Differs from the primary" when the keys do not match. It also flags a key that shipped with Centralpoint. It never shows a key value.
• Configure copies the machine key and the Telerik dialog key to the secondary.
• Windows data protection can encrypt the secondary's appSettings. The primary cannot read that section, so Configure copies the machine key only and reports that it did not copy the Telerik key. Copy the Telerik key by hand.

Creating a web site now gives the new site its own machine key and Telerik dialog key, not its parent's.

• The new site no longer starts with the parent's keys.
• The warning that asked you to generate keys by hand is removed.
• When the parent's key section is encrypted, the update cannot rewrite it, and the new site keeps the parent's keys. The site's RotateKnownSiteKeys entry on the Sync Methods page shows that. You can then generate keys in the new site's Admin > Settings.

Master > Admin > Settings now saves on a master that has no machine key, and it hides the Telerik dialog key.

• A master with no machineKey in web.config shows AutoGenerate. You can save other settings without entering a key, and Save leaves the key out of web.config.
• Generate Keys no longer fails when the master has no Telerik dialog key.
• The Telerik dialog key is a password box, like the machine key fields. Its value is not shown.

Admin > Settings now saves on a site that has no machine key, and it hides the Telerik dialog key.

• A site with no machineKey in web.config shows AutoGenerate. You can save other settings without entering a key, and Save leaves the key out of web.config.
• Generate Keys no longer fails when the site has no Telerik dialog key.
• The Telerik dialog key is a password box, like the machine key fields. Its value is not shown.

Every site now runs on its own machine key and Telerik dialog key, so a key copied from another site no longer works.

• The update replaces a key that shipped with Centralpoint, a key shared with another site on the same master, and keys that differ between two load-balanced servers.
• A site that already has its own keys keeps them.
• Users sign in again once after the update. Open forms and Word Autofill links fail once.
• New sites and new installs generate their own keys. The shipped web.config no longer carries any key.
• A key the update cannot rewrite is left as it is. An example is a Telerik key in an appSettings section that a provider other than Windows data protection encrypts. The Sync Methods page shows that site as partly done.

web.config change warning

What changes. In the Root web.config of each site, the update replaces validationKey and decryptionKey in <machineKey> and sets validation="HMACSHA256" and decryption="AES". It replaces the Telerik.Web.UI.DialogParametersEncryptionKey value in Local.config when the entry is there, and in the web.config appSettings when it is not. It touches the Root web.config and Local.config only. The Console is a nested application under Root and uses Root's machine key, so Console users sign in again too.

Check these after the update.

1. A virtual directory that runs as its own IIS application and shares sign-in with the site through its own machineKey keeps the old key. Copy the new Root machine key into its web.config by hand.
2. A second server that you load-balance by hand is not changed. Copy the Root machine key and the Telerik key to it right after the update. Otherwise the two servers reject each other's sign-in cookies.
3. Custom code that shares forms tickets or MachineKey data with another application needs a new shared pair. Set the same pair by hand in both applications.

QC: after the update, open a page in each virtual directory that runs as its own application. Open a page in each custom application that shares sign-in with the site. Each page must load and accept the sign-in.

Creating a user or resetting a password on Master > Admin > Users now emails a link to set a password. The email no longer contains a password.

• The link works once. It expires after 24 hours for a reset and after 72 hours for a new account.
• A new reset replaces the earlier link.
• A password changed any other way also retires an open link.
• Trace output no longer includes the new password.
• If the link cannot be sent, the page says so.

web.config change

The version's sync adds one location to the Master web.config: <location path="SetPassword.aspx"> with <allow users="*" />. This opens the set-password page without a sign-in.

• A Master that runs as its own IIS application with a separate web.config that the sync does not touch needs the same location added by hand.

Creating a member or resetting a password on Members now emails a link to set a password. The email no longer contains a password.

• The link works once. It expires after 24 hours for a reset and after 72 hours for a new account.
• A new reset replaces the earlier link.
• A password changed any other way also retires an open link.
• The Password placeholder in a custom email template now holds the link, so custom templates keep working.
• If the link cannot be sent, the page says so.

web.config change

The version's sync adds one location to the Console web.config: <location path="SetPassword.aspx"> with <allow users="*" />. This opens the set-password page without a sign-in. It adds nothing to the Root web.config.

• A Console that runs as its own IIS application with a separate web.config that the sync does not touch needs the same location added by hand.

The Console and Master sign-in pages now lock a username for 15 minutes after 10 failed attempts in a row.

• During the lock, even the correct password is refused with "Too many failed sign-in attempts. Try again in 15 minutes."
• The count is kept per username, so a name that does not exist locks the same way.
• A successful sign-in clears the count. The count also resets after 15 minutes with no attempt.
• Setting a new password from a set-password link clears the lock.
• A site that turned on member lockout in its properties now has that lockout apply to Console sign-ins too.
• If the lockout table is missing, sign-in works as before.

SAML sign-in now checks the identity provider's signing certificate before anyone is signed in, for any Global Login record that has a certificate pinned, closing a hole where a response signed by any certificate was accepted.

• When SAML Use Embedded Certificate = Yes, the certificate in the sign-in response must match a thumbprint in the new SAML Trusted Certificate Thumbprints field on the Global Login record (SHA-1 or SHA-256, separate multiple with commas), or the uploaded SAML Partner Certificate File.
• When SAML Use Embedded Certificate = No, the response is verified against the SAML Partner Certificate File as before.
• A record with no thumbprint and no certificate file still signs users in, exactly as before, and is listed in a report so you can secure it. It is not blocked.
• Saving a new Global Login record with Use Embedded Certificate = Yes and no thumbprint and no certificate file is refused. An existing unpinned record can still be edited and saved, and stays in the report until you pin it.

What to do

• After your identity provider rotates its signing certificate, update the thumbprint on any record that has one pinned, or sign-in for that record will fail until you do.
• If a record uses a SAML Partner Certificate File and was set to accept unsigned responses, confirm your identity provider signs its responses: an unsigned response to a record with a certificate file is now rejected.
• Review the report of records that still need a certificate and pin the suggested thumbprint for each. Until you do, that record keeps signing users in without checking the certificate.

Development > Query Analyzer now signs every request that saves, lists or deletes a saved query.

• The signature covers the user and the query being saved, listed or deleted. A changed request fails the check.
• The Uber accepts an unsigned request until its Uber Utilities Require Signature property lists QueryAnalyzer.
• Saved queries keep working on a site that has this update.

Your site, the Master and UberControl now sign every call they make to the Uber and to the parent UberControl.

• The signature uses the same JWT.Signing.Key.Secret as the Console service signing. A call from a site on an older version carries no signature.
• The Uber and UberControl serve an unsigned call for now and record it. Only update uploads to the Uber need a signature.
• Custom code that builds its own Uber.Utilities or UberControl.Utilities proxy sends unsigned calls. Change it to SignedUberUtilities or SignedUberControlUtilities.
• A custom page in Integrations that declares the Uber proxy as Uber.Utilities must declare Centralpoint.Web.Uber.Utilities instead, or it keeps its own unsigned proxy.

Every Development > Web API method set to Security Mode Disabled now uses Access Token, so a caller without a token gets 403 Invalid Access Token.

• cp-interstitials stays Disabled, because the interstitials feature calls it without a token.
• The Development site switches during the update. QA and Production sites switch at their next sync from the parent.
• Integrations, scheduled tasks and custom code that call a switched method must send an access token over HTTPS.
• Each site writes the methods it switched to Backups\WebApiSecurityModeHold-<date>.csv in the site's folder.
• To keep a method public, set its Security Mode back to Disabled. The update does not switch it again.

Inserting an mp4 video or mp3 audio file from the editor's Media Manager works again in every module that uses the rich text editor.

• After a recent update to the editor, Media Manager started creating modern video and audio players for these files. The older code that prepared inserted media did not recognize them, so clicking Insert closed the window and nothing was added.
• Video and audio files now insert as a player you can preview in the Design view and save with the record.
• Other file types insert from Media Manager the same as before.

Saving a search page now lets that page run from the Uploads folder, and deleting it removes the exception, so saved pages keep working under the new Uploads script block.

• Existing saved pages get their exception when the update runs.
• Another .aspx file in the same folder stays blocked.
• If the site web.config cannot be written, the save shows a warning, and the page returns a 404 until a save succeeds.
• On a load-balanced site, a save writes the primary server's web.config only. To reach the secondary server, run BlockHandlerFilesUnderUploads again from Master > Development > Sync Methods.

Script files in the Uploads folder no longer run on any site, so a file written there cannot execute. This is a security change.

• Blocked: .aspx, .ashx, .asmx, .svc, .asp, .cshtml, .vbhtml, .php, .axd, .rem, .soap, .xamlx, .xoml, .rules, .asa, .cer, .cdx, .idc, .shtml, .shtm and .stm. The same block covers the /PrivateLabeling folder.
• Not affected: images, .js, .css, .pdf and other static files, and module views under Uploads/ModuleViews.
• Product pages that live in Uploads keep working: Sync Notes, Gist and File Picker on the Development site, the Utility page on Master, and every Search Page Designer page.
• Pages or web services that your own custom code placed in Uploads now return a 404. We expect a few. We fix each one as it surfaces with a one-file exception, and we do not reopen the folder.
• The Master Errors list shows one report per install. It names every blocked file, every file an exception still serves, and every web.config under Uploads.

web.config change warning

The update edits the Root web.config of Master and of each site, including a registered secondary server. It adds a <location path="Uploads"> block and a <location path="PrivateLabeling"> block. Each block removes, then denies, the blocked extensions in requestFiltering. The block is locked, so a web.config under Uploads cannot allow them again. It also adds one exact-file <location> for each excepted page.

• A virtual directory that runs as its own IIS application has its own web.config, which the update does not touch. Check that script files in it are still blocked, or add the same block by hand.
• Custom code: a web.config under Uploads that sets requestFiltering (for example maxAllowedContentLength) now returns 500.19 for its folder. Move that setting into the Root web.config. A server whose applicationHost.config locks requestFiltering also returns 500.19 under Uploads, so check that before you update.
• QC step: load one page of your own custom code under Uploads. Confirm it works through an exception or returns 404, and that no folder under Uploads returns 500.19.

Tools > Extract Sharepoint Documents now saves files only inside its Parent Folder under Uploads, and only with the file types you select.

• A Parent Folder Name that points outside Uploads, such as ..\Files, is refused before the extract starts.
• A file whose folder or name from your query leads outside the Parent Folder is skipped.
• A file whose type is not selected under Extensions To Retrieve is skipped, even when your query returns it.
• The result shows how many files were skipped.
• You must select an extension before the extract runs.
• An error now shows only its message, without technical details.

A utility on Development > Utilities or Development > Import Utilities now opens and runs only for users who hold that utility's navigation item.

• The page shows the panel that its navigation item names. A display value in the address no longer opens a different panel.
• Utilities.aspx?format=3 now needs a navigation item like any other Console page.
• The actions behind each panel, such as Restart Web Site and Database Backup, check the same navigation item.
• A link that used format=3 stops working. Use the navigation item's own link.

The Master and your site's front end now sign every call to the Console Utilities service, and the Console checks the signature.

• New property Console Utilities Require Signature in Admin > Properties. It is No by default.
• When it is No, the Console still serves an unsigned call and records it in Development > Errors as ConsoleWebServicesAuth:Unsigned, with the caller's address and the likely cause.
• When it is Yes, the Console refuses unsigned calls.
• Choose Yes once the error stops appearing. Leave it No while an outside system still posts to the service, because that system cannot sign.
• Custom code that builds its own Console.Utilities proxy sends unsigned calls. Change it to SignedConsoleUtilities.
• The Master and the site must use the same JWT.Signing.Key.Secret value. If they differ, every call is recorded as unsigned.

Console web methods now run only for a signed-in Console user who has access to at least one audience.

• This covers the Console ClientMethods service (Toolbox, CpEditor filters, Webhooks, Data Triggers, Data Transfer restore and Change Upload Directory), the SolrExport service, the Form Wizard service, and the methods behind each Console page.
• A method behind a Console page also needs the navigation item of that page.
• Any other caller gets an error, and the method does no work. A Console page you can open keeps working.
• Warning: anything that called one of these methods without a Console session stops working. Client custom code is the most likely case. We fix each case one at a time as it appears, and we do not reopen the gap.
• Calls to the Console Utilities service are not affected by this change.

The ExtChangeValueOnJavascriptAction CpScript now does nothing for visitors who are not signed in, unless an admin allows them.

• It saves through the same service as the check-in button, so it follows the same setting: Check In Button (ButtonClick, ButtonClick_v2) in Admin > Properties > Anonymous Client Methods.
• Before, signed-out visitors on a page using it saw an error popup, because the server already refused them.
• The same field rule applies: only an admin can set Roles, Audiences, IsEnabled, StartDate or EndDate through it.

The FormAutoSave CpScript now refuses a signed-out visitor's save that sets Roles, Audiences, IsEnabled, StartDate or EndDate.

• The message "This form cannot set that field." appears next to the checkbox, and nothing is saved.
• When a save fails for any reason, the form now shows "Error" instead of technical details about the server.
• Signed-in users, and forms that set other fields, see no change.

The CheckInButton CpScript can no longer change the fields that decide who sees a record, unless the user is an admin.

• A check-in that sets Roles, Audiences, IsEnabled, StartDate or EndDate is refused and nothing is saved.
• Check-ins that set other fields, such as a Yes/No or text field, work as before.
• This also applies when Check In Button (ButtonClick, ButtonClick_v2) is selected for signed-out visitors in Admin > Properties > Anonymous Client Methods.

Web API methods now change only records in the module they are set up for.

• UpsertData and Upsert Data From Site On Same Server no longer move or change a record from another module when a request names its DataId. The item is skipped with the warning "the provided DataId is not available".
• Upserts by DataId, AutoNumber or IntegrationId in the method's own module work as before.
• Breaking change: a DeleteData method with no DeleteData Module now returns "DeleteData Module Required" and deletes nothing. Open each DeleteData method in Development > Web API, choose its module and save. The field is now required on the form.

Centralpoint Agent 8.12.16.10 reads the Windows Setup log and skips the event sources you name when it captures an event log.

• A Setup log capture shows Windows servicing installs, so you can tell when Windows patched a server.
• A capture can name up to 10 event sources to leave out. Their events no longer use up the capture's event limit.
• A source name that contains & or ' now matches. It matched nothing before, for the source filter as well.
• A capture that asks for the Information level now also returns events that Windows logs with no level, which Event Viewer shows as Information. An "All levels" capture of System or Application can therefore reach its event limit sooner.
• The Security log is still not available to the Agent.

The UserSubscriptions CpScript now saves a favorite, subscription or vote only on a record the signed-in user's roles allow them to see.

• A request for a record hidden from the user by its roles is refused, and nothing is saved.
• Admins are not affected.
• Users saving favorites, subscriptions and votes on records they can see notice no change.

The DesignSwitch CpScript now switches the design only for signed-in users, unless an admin allows signed-out visitors.

• Breaking change: the OverrideAuthenticatedUsers attribute alone no longer shows the dropdown to visitors who are not signed in. They see an alert naming the site property until an admin allows it.
• To allow signed-out visitors, go to Admin > Properties, find Anonymous Client Methods, select Design Switch (ReturnDesignSwitchOptions) and save. Picking a design changes it for every visitor to that audience.
• A switch now applies only from the design the audience is currently shown, to an enabled design that is not tagged to All Audiences.
• Picking the design that is already shown no longer saves anything.

The FormAutoSave CpScript now saves only for signed-in users, unless an admin allows signed-out visitors.

• Breaking change: visitors who are not signed in no longer see the Auto Save checkbox, and the server refuses their saves.
• To allow signed-out visitors, go to Admin > Properties, find Anonymous Client Methods, select Auto Save Form (FormAutoSave) and save. A signed-out visitor can then keep saving only the record their own visit created.
• Auto Save no longer overwrites an existing record from another module, or one the user's roles hide. The message "This record cannot be saved from this form." appears next to the checkbox instead.
• Signed-in users saving their own form see no other change.

The CheckInButton CpScript now saves only for signed-in users, unless an admin allows signed-out visitors.

• Breaking change: visitors who are not signed in no longer see the button, and the server refuses their clicks. Custom pages or integrations that call the check-in service without signing in are refused too.
• To allow signed-out visitors, go to Admin > Properties, find Anonymous Client Methods, select Check In Button (ButtonClick, ButtonClick_v2) and save. Selecting it lets anyone change that value on any record visitors can see.
• The button now saves only on records the user's roles allow them to see. Admins are not affected.
• Signed-in users see no other change.

The FormKeywordManager CpScript's Add New service now requires sign-in, the same as its Create button, unless an admin allows signed-out visitors.

• Breaking change for custom code: a custom page or integration that calls the Add New service without signing in is now refused until an admin allows it. The picker's Create button was already disabled for signed-out visitors, so picker users see no change.
• To let signed-out visitors add keywords, for example on a public form, go to Admin > Properties, find Anonymous Client Methods, select Keyword Picker: Add New Keyword (CreateNewKeywords) and save. The Create button is then enabled for them. Selecting it lets anyone add keywords to any keyword list on the site, not only the list the form shows.
• Anonymous Client Methods is a new property that lists front-end services that change data. Each one requires sign-in unless you select it here. Later releases will add more services to this list, and each release that adds one will say so.
• Keywords with an apostrophe, such as O'Brien, are now saved with a single apostrophe.

The UserSubscriptions CpScript now saves favorites, subscriptions and votes only for the signed-in user who clicked them.

• Visitors who are not signed in, and ancestor admins, can no longer save one. The button already showed them an alert, and the server now refuses them too.
• A request that names a different user is refused, so no one can save a favorite, subscription or vote for someone else.
• Votes accept only the up and down values the button sends.
• Voting the same way twice no longer shows an error, and a favorite, subscription or vote can no longer be saved for a record that does not exist.
• Signed-in users see no other change: saving and removing work as before.

The Policies Word download now honors the PreventDownloadifLocked property.

• With the property on, a locked policy document is refused instead of opening.
• A missing document is refused instead of failing later in the download.
• A version link opens only a version of the same document.

With the property off, downloads work as before.

/data/query and /data/files no longer return Web API records, which hold credentials.

• This applies to every API key, including a key granted access to the Web API module.
• Queries for every other module return the same results as before.

If an integration reads Web API records through the Data API, it now gets no rows for them.

Web API records hold credentials, so more site features now treat them as not found.

• The FormAutoSave CpScript, keyword fields, version restore links and the design switch cannot save over a Web API record.
• The DocCreation document builder, the ModuleResults zip export and DataDiffs history skip Web API records.
• The Word add-in cannot open, lock or save a Web API record.
• FormAutoSave in review mode and Word add-in saves accept only a version of the record being edited.

Normal records work as before.

The backup history in Master > Development > Health Monitor now labels differential backups as Differential instead of leaving the type blank. Azure SQL Managed Instance takes differential backups on its own schedule, so they appear often there.

On Azure SQL Managed Instance, the SQL Server 2025 features sync method completes as not applicable instead of failing. Azure manages those server settings there. SQL Server installs run it as before.

Database maintenance runs without errors on Azure SQL Managed Instance and skips the steps Azure manages.

• On a Managed Instance, maintenance updates space usage, then stops. Azure controls the recovery model and log backups there.
• The daily warning about a large transaction log no longer appears on a Managed Instance, where nobody can act on it.
• Site and Master databases can again be exported to a BACPAC file with SqlPackage.

Other SQL Servers run the same maintenance as before.

Centralpoint CLI 8.12.16.8 and Centralpoint Agent 8.12.16.9 can install and manage a Centralpoint site whose databases run on Azure SQL Managed Instance.

• The CLI detects a Managed Instance and encrypts every connection to it. It checks the server certificate first, and asks before trusting a self-signed certificate on an on-premises SQL Server.
• On a Managed Instance, the CLI skips the steps Azure manages: SQL folder prompts, server settings and database file layout. Databases are imported from the install package, not from a local backup file.
• The installer account on a Managed Instance needs dbcreator, ALTER ANY LOGIN and VIEW SERVER STATE, not sa.
• On any SQL Server that shares the web server, a new install caps SQL Server's maximum memory at 60% of the server's memory when it is still unlimited.
• The Agent reports a Managed Instance as one and does not try to change its memory setting.

Web API records hold access tokens and passwords, so the site's button and keyword services now treat them as records that do not exist.

• The CheckInButton and ExtChangeValueOnJavascriptAction CpScripts can no longer change a Web API record, or save any record into the Web API module.
• Keyword Manager fields can no longer read a value from a Web API record.
• Buttons and keyword fields on every other record work as before, including custom code that calls the button service directly.

Sites using Multi-tenant Audiences filtration (Admin > Properties > Audience Filtration and Security) load module results, searches and listings faster on large modules.

• The TenantsA and TenantsB checks look up each record directly instead of reading the full tenant list for every row.
• Which records each user sees does not change: untagged content stays visible to everyone, and tagged content shows only to users in a matching tenant.
• Custom tenant providers that call the built-in tenant filter get the same improvement with no code change.

Paged lists across the site open each page faster on modules with many records or large text fields, such as rich text or extracted document content. This covers module results pages, site search and Console module lists.

• The page of records is chosen first, then only those records' full content is loaded.
• Results, sort order and record counts do not change.
• Lists that use a window function or a wildcard field list in their fields keep the previous query.

Web API methods now refuse a request Filter or sort that could read other data, and a live site no longer returns database error text.

• A Filter on Read Details, Read Results or Get Users that contains a subquery or a database function call, such as dbo.IsInRole(...), returns a 400: "Filter cannot contain a subquery or a database function call." Invalid Filter is now a 400 too, instead of a 200.
• A Read Results OrderBy must be a list of columns, each with an optional ASC or DESC. A DataTables OrderByDirection must be ASC or DESC, and a sort header the grid did not show is ignored.
• With debugging off, a server error returns "The server could not complete this request. Reference: " and the full error goes to Development > Errors. Errors caused by the request itself keep their message.
• A custom method that throws an ArgumentException returns a 400 with its message instead of a 500. A plain Exception still shows its own message; any other exception returns the message above.
• DataTables encodes [cp:placeholders] values before using them in DataTablesWhere. Keep a placeholder inside quotes. One outside quotes, or inside a LIKE pattern, is not protected.

Development > Web API answers two kinds of errors more clearly and gives away less.

• A request whose JSON is broken, for example cut off partway, now gets a 400 with "The request is not valid JSON." on every method, instead of a 500 with a technical parser message.
• Errors from Process Log, Error Log, Natural Language Search and custom code methods include the stack trace only when debugging is on. A live site returns the error message without it, the same as the other methods.

Opening a run in Master > Development > Process Log now checks that the run's ID is valid before looking it up, so only a real ID ever reaches the database. The page looks and works the same.

Opening a run in Development > Process Log now checks that the run's ID is valid before looking it up, so only a real ID ever reaches the database. The page looks and works the same.

Development > Web API has two new methods, Process Log and Error Log, that return this site's process runs and errors as JSON.

• Both return only the calling site's records. Nothing in the request can widen that.
• Process Log filters by Type, HasErrors and Since, and IncludeSteps adds each run's steps. Send a ProcessId to get one run with its steps and errors.
• Error Log filters by Since. Send an ErrorId to get one error with its stack trace and page details.
• Both page with PageIndex and PageSize, up to 200 per page.
• Both are for admins only. Set Security Mode to Access Token and User Mode to Access Token User, and use a token whose user is in the Admins role. Any other setup gets a 403 that says what to change.
• Error Log is not available on isolated installs.
• A request that is not valid JSON now gets a 400 instead of a server error, on these methods and on Natural Language Search.

The Excel Viewer opened by the FileViewer CpScript loads each sheet with one request and reads only the selected sheet of the workbook.

• Sheets with few rows in a large workbook open about 8 to 20 times faster.
• Sheets over 5,000 rows open 15 to 30 percent faster. They still show the first 5,000 rows and the full row count.
• Switching sheets quickly shows the sheet picked last.
• Merged cells that reach the 5,000-row limit end on the last shown row instead of one row short.
• A damaged cached copy of a workbook is rebuilt instead of showing a partial sheet.

Two third-party libraries are updated to their latest patch releases:

• System.DirectoryServices 10.0.13, used by the API, the Centralpoint Agent and the Centralpoint CLI.
• marked 18.1.1, used to display formatted text in the AI and API pages.

When a file is deleted while an update install, patch, repair or Data Update is copying it, the copy now stops for that file at once.

• The file already in place is left untouched, instead of being renamed aside and back on each of three retries.
• The missing file is still listed in the result.
• A copy blocked for any other reason still retries as before.

This ships in Centralpoint Agent 8.12.16.8 and Centralpoint CLI 8.12.16.7, and in the Master update install and Data Update.

Error entries in Development > Errors carry more of what is needed to find the cause.

• A failed site search records the search query it ran, even when site logging is off.
• A canceled request no longer records a site search failure.
• Repeated log entries in an error's details show as a list instead of a type name.
• Scanner probes against the file upload handler are grouped with other invalid requests.
• Query timeouts from background work, and a relation population failure on document data, are grouped and labeled more precisely.

Clearing or rebuilding a large Contextual Search index now deletes its stored search rows in batches, so the clear finishes instead of failing on a time limit.

The Word add-in now loads a module's required relation fields in a single database request instead of one per relation, so it opens faster on modules with many relations.

The Data API's Contains, Starts With and Ends With filters, and its attribute Contains filter, now match the value literally. A filter value with %, _ or [ no longer returns records it should not.

Contextual Search query suggestions now match the typed text literally, so %, _ and [ no longer act as wildcards and no longer return unrelated suggestions.

The search boxes in the Query Analyzer's data source, query and report lists now match the typed text literally, so %, _ and [ no longer act as wildcards.

The ResourceDragAccordion CpScript's name and group search now matches the typed text literally. A name such as file_1 no longer also matches file11.

Typing *, %, _ or [ into an autocomplete now searches for that character, instead of treating it as a wildcard.

• The site search autocomplete no longer returns an empty list when the typed text contains * or % in the middle, such as te*x.
• Module autocomplete fields that search with SQL LIKE return only literal matches.

A page that has no navigation item behind it, such as a custom page reached by its own URL, now loads instead of failing with an error. The navigation groups and the content filter treat such a page as having no navigation item.

• A Console module list whose read is interrupted by SQL Server while data moves underneath it now retries, the same way it already retries a deadlock, instead of showing an error.
• A list column configured with a quoted or bracketed alias, such as [Title] AS 'Page Title', now displays and sorts correctly.

The update removes the ChartImage.axd handler from the site and Master web.config files. The current Telerik version no longer includes it, so every request to it failed with an error.

web.config change. This line is removed from <system.webServer><handlers> in the site Root\Web.config (primary and secondary servers of a load-balanced site) and the Master Web.config:

<add name="ChartImage.axd" path="ChartImage.axd" verb="*" type="Telerik.Web.UI.ChartHttpHandler, Telerik.Web.UI, ..." />

• A virtual directory that runs as its own IIS application keeps its own web.config. Remove the same line there by hand if it is present.
• Custom code that still draws charts through Telerik RadChart and ChartImage.axd was already failing, and needs a different chart control.

The File Manager now accepts uploads up to 1 GB, the size its uploader already allows. Before, a file over 4 MB failed with "Maximum request length exceeded."

web.config change. The update adds this block to the Console web.config (Console\Web.config) on the primary server:

<location path="FileManager.aspx">
  <system.web>
    <httpRuntime maxRequestLength="1048576" executionTimeout="3600" />
  </system.web>
  <system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="1073741824" />
      </requestFiltering>
    </security>
  </system.webServer>
</location>

• A value already higher than these is kept.
• A virtual directory that runs as its own IIS application has its own web.config, which the update does not change. If it hosts the File Manager, add the same block there by hand.

• The "Scheduled task is running late" warning now measures from the time the task was scheduled for, so a task that runs on time after an update install is no longer reported as late.
• The Forecast view now estimates the run time of a task set to run after another task (Following) from that task's own history.

The CleanUp task now deletes API log records older than 30 days, which it had not been doing, so the API log no longer grows without limit.

• The logging records that step already removed are still kept to 30 days.
• A first run on a large API log deletes it in batches, over several nights if needed, so one run never holds the database for long.

A failed Data Update now says what failed in terms you can act on.

• A failed Source Local Path check names the path it tested and the Windows account it tested it as.
• A failed source database check includes the connection error behind it, such as a refused login or a server that cannot be reached.
• Every other Data Update failure keeps the cause of the error it wraps.

A Delimited Text transfer now waits for a source file that its feed is rewriting, instead of failing the run.

• When the source file is missing or locked by another program, the transfer tries again up to three times, 15 seconds apart. The status shows each attempt.
• A source folder that does not exist, or any other open error, still fails the run at once.
• A preview in the Console never waits. It fails at once as before.
• A Standard Module transfer that fails before it locks its module no longer runs its end-of-run steps, so it cannot disturb another run of the same module.

The Excel File display in Design > Data Sources now resolves CpScripts placed in the template's data row once for each data row, alongside the existing {Column} placeholders.

• A Column CpScript in a data row cell fills that cell from the current row, so removeMarkup, replaceText and the other Column properties apply to Excel exports. Example: Column: Object reference not set to an instance of an object..
• Attribute values can be read with name='cpsys_Attributes:SystemName', so the query only needs to return the Attributes column instead of extracting each value in SQL.
• A page-level CpScript placed in the data row, such as CurrentDate, now repeats on every row instead of appearing only on the first.
• Templates that use only {Column} placeholders export as before.

The ContextListFilter CpScript now checks its Default property as the quoted value it becomes in the filter.

• Ordinary text, including [ and ", is accepted as before.
• A Default that would end its quotes early and change the filter is rejected with the alert "The 'default' property must keep its quotes and parentheses balanced."
• A Default holding its own list, such as a', 'b, still works.

SQL filters typed into settings now read parentheses inside [bracketed] and "quoted" names the way SQL Server does.

• A filter can no longer use a parenthesis inside a bracketed or quoted name to reach outside the condition it belongs to.
• Filters that use bracketed or quoted names normally, such as [Course Code] = 'a', keep working.
• A filter with an unclosed [ or " is now rejected with a clear message instead of failing as a SQL error.

This applies wherever an administrator types a filter, such as Data Transfer source where clauses and CpScript filter attributes.

Error details, the Process Log and error emails now also hide credentials that a vendor echoes back as a header, a Bearer token or JSON.

• Header values such as X-Api-Key: and X-Auth-Token: show as ***REDACTED***.
• Authorization: Bearer and Basic tokens are hidden, and the scheme name stays. For Digest and similar schemes, the whole header value is hidden.
• JSON values such as "api_key": "..." and "access_token": "..." are hidden, and the JSON stays valid.
• accesskey= values and Azure storage sig= values are hidden.
• A task setting whose name ends in AccessKey or Authorization is hidden in notification emails.
• JSON data transfer errors now hide header and JSON credentials too, which an earlier note listed as not yet redacted.
• A phrase that only looks like a header, such as api_key: required, also loses the word after the colon.

A JSON Output export of a data source that fails now returns HTTP status 500 when JSON Output Error Format is HTML (default).

• The error message still shows on the page.
• Tools or scripts that call the export link and treated any 200 as success now see the failure.
• Exports set to the JSON error format are unchanged. They already returned 500.
• Check any custom code or integration that reads an export in HTML error mode and relies on a 200.

The clicks scheduled task can now remove old clicks log rows on a schedule, through a new Clicks Log Retention setting.

• The job is now Manage Clicks (ClicksManager). Existing ClicksMerger tasks move to it and keep their settings.
• Clicks Log Retention defaults to 0, which keeps every click. Any other value removes clicks log rows older than that many months.
• Ad banner clicks and the newest click are always kept.
• Each URL's clicks Total is reduced by the clicks removed, and a URL with no clicks left is removed. Reports that count the clicks log directly, such as Most Popular, then count only the clicks that remain.
• Removal needs an index on the clicks log's CreateDate. Smaller sites get it with the update. On a large site, the first run with retention on builds it instead of removing anything, which can take some time.
• Each run stops removing rows 20 minutes after it starts, so a large backlog clears over several runs.
• Merging Query String Variable Names now ignores extra spaces and line breaks.

An update install now waits for a running patch to finish, so the two never change the server's files at the same time.

• This applies to the UpdateInstall scheduled task and to installs started from Master > Deployment > Updates.
• The install waits up to 5 minutes. If the patch is still running after that, the install skips that run, and the next scheduled run installs the update.
• The protection starts with the update installed after this one.

Centralpoint Agent 8.12.16.7 no longer starts a patch while an update install is running on the server.

• If an install is running, the Agent leaves the patch untouched. Server Hub sends it again 15 minutes later.
• While a patch runs, an update install waits for it to finish before it starts.
• A patch built to carry its binding redirects forward still applies them to Master/Root/web.config after the server moves past the patch's version. A redirect is applied only when the matching DLL in Master/Root/Bin has the same version.
• If none of those redirects can be applied, the patch reports a failure in Server Hub.

Web API methods no longer return, change or delete the Web API records themselves, which hold method settings and stored credentials.

• Read Details, Read Results and DataTables answer as if a Web API record does not exist, whether it is asked for by DataId, Filter or module.
• Upsert Data skips an item aimed at a Web API record ("not available"), Delete Data reports it as not existing, and Upsert Data From Site on Same Server skips it.
• A request Filter that contains --, ; or /*, or whose parentheses do not balance (even inside quotes), now returns Invalid Filter.
• A Read Results method set to a table name with an alias, hint, database prefix, subquery or comma list on a record table now returns ReadResults Table Not Allowed. Use the plain table name.
• A method set to the Web API module itself now returns a "Module Not Allowed" error.

A refused or failed one-way call no longer risks ending the worker process on a site with trace on.

• Affected: the cache methods RemoveCache and RemoveMemoryCache, and the data transfer, retention policy, NLS and PDF queue one-way methods.
• These methods write no trace messages. Their requests usually leave no row in Trace.axd.
• Refusals are still logged as errors.

Centralpoint Agent and CLI 8.12.16.6 keep the Master's App_Data/AgentSignedProof.txt file when they repair an install.

• A CLI repair no longer overwrites the file.
• The Agent has no other change in this version.

A Master that enforces signed calls keeps enforcing after its app restarts.

• Master saves the time of the last correctly signed Agent call in App_Data/AgentSignedProof.txt.
• After a restart, Master reads the file and enforces at once. Before, it served unsigned calls for up to ten minutes.
• A missing, damaged or expired file, or a changed JWT.Signing.Key.Secret, means no proof. Master then behaves as it did before.
• The file belongs to each install. Sync, a full install and a repair leave it alone.

Development > Web API has a new AceProject Issues method that returns open AceProject issues per user as JSON.

• Each endpoint signs in with its own AceProject login, so callers see only what that login can see in AceProject.
• Filter by UserFilter, ProjectFilter and ModifiedSince, and add IncludeReviewer to include issues the user reviews.
• Each issue shows its project, status, priority, days since it was last modified, and a link to the issue.
• Results are cached for the minutes set in AceProject Cache Minutes, and saving any Web API record clears the cache.
• Keep Security Mode on Access Token for these endpoints.

When a dynamic role's query fails, that role keeps its current members, and the other dynamic roles still update.

• The failure is listed in Master > Development > Errors and in the Process Log, naming each role whose query failed.
• Before, members of the failing role could lose it until the next successful run.

The scheduler now reports problems it used to skip without a trace.

• A web site that cannot be loaded is listed in Master > Development > Errors by id, and the other sites' tasks still run.
• When the list of web sites cannot be read, no site tasks run and the tick is reported as failed.
• A task whose next run time cannot be calculated is reported as urgent.
• A failure reading the advanced scheduled tasks is reported.

The Mail module no longer shows an empty mailbox when a mail service fails to load messages.

• On page load, the user is told the service failed and is offered its account settings.
• On refresh or paging, messages from the other services still list. The list fails only when no service returned messages.
• The Settings list shows a failing service as invalid.
• Each failure is listed in Development > Errors.

Web API methods now tell the caller when they fail, instead of returning an empty success.

• A DataTables request that fails returns its error, and the table shows it, instead of an empty table.
• An Upsert Users request skips a user whose existing account cannot be looked up, rather than creating a duplicate. The response fails, says how many users were skipped, and counts only the users written.
• Each failure is listed in Development > Errors.

An XML conversion that fails, to Excel or to Access, now stops with the error instead of saving with no generated files.

• That includes a missing source XML file or a missing Access template.
• The record is put on hold and shows the error, the same way for both output types.
• The failure is listed in Development > Errors.

Broadcast failures that used to pass unnoticed are now listed in Development > Errors.

• A message body that cannot be read from its URL is reported. The email is sent as before.
• Script failures and batch completion failures are reported once per batch, with a count.

FtpFiles now says how many files failed to upload, and names the first file and its error.

• The count appears in the script's result and in the Process Log.
• The failure is listed once in Development > Errors, with the FTP host but never the full address.
• Files that uploaded are still counted and, when requested, deleted.

ShortGuid now reports a value that is not a valid GUID once per run in the Process Log, and leaves that field empty.

• The run is marked as having errors, so a source-data problem is visible after it finishes.
• Later rows with the same problem are not listed again.

OcrZone now reports an invalid validatepattern or format in the Process Log once per run, instead of failing silently on every row.

• The run is marked as having errors, so the problem is visible after it finishes.
• A validatepattern that times out is listed in Development > Errors once per run, with a count.

GetImageMetaData now reports a JPEG 2000, DICOM or TIFF image that cannot be opened, once per run with a count, in Development > Errors.

• That row's field is left empty, and the rest of the transfer continues.
• A tag or property the image does not have still returns an empty value, without an error.

In a data transfer, now returns the current time when the attribute is blank or missing, in the requested format.

• A transfer's first run, before ScheduledLastRunDate has a value, gets a date instead of an empty value.
• The Process Log no longer shows an ERROR: Attribute line for a blank date.

Data transfers now report failures that used to pass unnoticed, and stop instead of finishing on partial data.

• Validation labels a destination problem as Destination Error, and the message names the account the Master runs as and the real error.
• A step that fails for some rows, such as a skipped XML file or a SharePoint column value, is listed once per run in the Process Log and in Development > Errors, with a count.
• An MD-Staff transfer fails when a page of results or the sign-in request fails, instead of importing part of the data.
• An RSS (Quirks Mode) transfer fails when the feed cannot be read.
• When a failed batch's record ids cannot be read, the batch alert says why.

Data Transfer now reports a stale field map, an unmatched lookup value and a failed batch in full, without filling the error log.

• A field map that names columns missing from the source sends one error per run. It names the transfer and lists every missing column with its destination, instead of one error per column.
• The Process Log notes each value that a Replace, Audiences, Keywords, Taxonomy, Roles or Module script could not match, once per value and up to 50 per lookup. Generating new taxonomy is not reported.
• When a batch fails in a Comments, Aliases, Searches or Clicks transfer, the alert gives the row count, up to 40 row ids and whether any rows were imported, and the batch is saved under Uploads/DataTransfer.

Ignoring a sync method keeps the status it replaced, so a Failed method that is ignored still reads as "Ignored (was Failed)" in the Server Hub.

• Four guards now stay pending and run again on the next sync, until their condition clears: RepairUnreachableApiBaseUrl (no request context, protected or empty appSettings, no endpoint answering) and UpgradeTargetFrameworkAll (.NET Framework 4.8.1 not installed).
• A binding redirect written for a DLL that the site excludes from sync is recorded in Master > Development > Errors. The redirect itself is unchanged.

The scheduler now reports whether a tick ran the due tasks or ran nothing, and why.

• The existing Execute method is unchanged.
• The Master also lists the Development site's pending sync methods once an hour and after an update, so the Server Hub shows a method that never ran, even when an update stopped before the Development step.

Centralpoint Agent 8.12.16.5 tells the Server Hub why it cannot manage a server, and reports the real cause of a failure.

• When server management turns off, the Agent reports the check that failed, such as a missing Site.Key or a Master web.config it cannot read. It sends this once per change.
• A TLS or connection failure reaches the Hub with its underlying cause, not "see inner exception".
• Capping SQL Server memory names the SQL login and the missing permission, and gives the GRANT to run.
• The standing site probe recognizes an HTTP.sys answer that matched no IIS site, and retries it once before reporting.
• The check-in lists the certificates that IIS HTTPS bindings serve, with their expiry dates.
• The Agent reports which path each scheduler tick took.

The SAML IdP Cert Password in the Admin > Deep Links module properties no longer shows its value. A saved password shows dots and the hint "A value is set. Type a new value to replace it."

• Save without touching the field to keep the saved password.
• Type a new password and save to replace it.
• Check Clear and save to remove it.

Saved passwords are not changed.

The SAML Local Certificate Password in the Admin > Global Login module properties no longer shows its value. A saved password shows dots and the hint "A value is set. Type a new value to replace it."

• Save without touching the field to keep the saved password. SAML sign-in keeps working.
• Type a new password and save to replace it.
• The field is required, so Clear is refused while SAML is turned on.

Saved passwords are not changed. If you need the password, get it from whoever issued the certificate.

When updates are turned off for a master, Master > Deployment > Updates now says "Updates are turned off for this master" and offers nothing to install.

• The UpdateInstall scheduled task skips the install and records "Updates are turned off for this master." in its process log.
• Masters with updates turned on see new versions as before.
• This applies to versions released after this one.
• To turn updates back on, contact support.

The Module Designer has a new Password Box control for properties and attributes that hold a password, API key or other secret.

• The saved value is never shown. The field shows dots and the hint "A value is set. Type a new value to replace it."
• A blank save keeps the saved value, and a Clear box removes it.
• Version compare shows dots for a Password Box value instead of the secret.

Switching an existing Text Box field to Password Box keeps its saved value.

The Validation Key and Decryption Key on Master > Admin > Settings no longer show their values. They show dots and the hint "A value is set. Type a new value to replace it."

• Save without touching them to keep the current keys.
• Generate Keys and save still replace both keys.

If you need the Master machine key, read it from the Master web.config.

The Validation Key and Decryption Key on Admin > Settings no longer show their values. They show dots and the hint "A value is set. Type a new value to replace it."

• Save without touching them to keep the current keys.
• Generate Keys and save still replace both keys.

If you copy the machine key to other servers, read it from the site's web.config instead of this page.

Secret fields on Admin > Properties no longer show their saved value. A saved field shows dots and the hint "A value is set. Type a new value to replace it."

• Leave the field blank and save to keep the saved value.
• Type a new value and save to replace it.
• Check Clear and save to remove the value.
• This covers the TinyPNG API key, Google Static Maps API secret, Twilio authorization token, FitBit consumer secret, SalesForce password, consumer secret and security token, SharePoint password, MD-Staff password and client secret, and Itiliti client secret.

Saved values are not changed. If you need to read one of these values, get it from the service that issued it.

A Web API record that saves content now stores a document of up to 16 MB, completing the higher limit added in this release.

Saves over about 4 MB passed the Web API but failed when the site handed the document to its Console, and the response read No Items Upserted. They now save in full, including HTML with dense markup.

web.config change

The update replaces the Console's WebServices\Web.config with a version that adds a <location path="Utilities.asmx"> block: httpRuntime maxRequestLength="196608" and requestLimits maxAllowedContentLength="201326592", both 192 MB. The document grows when it is escaped on the way to the Console, so the limit sits well above 16 MB.

Check two cases on your own servers:

• Any change you made by hand to Console\WebServices\Web.config is replaced by the update. Re-apply it afterward.
• A virtual directory that runs as its own IIS application keeps its own web.config, which the update does not touch.

When DisplayAppOffline is on, the DataUpdate scheduled task no longer fails because the App_Offline.htm page is locked.

• Taking the site offline retries a locked page, and continues when the page is already in place.
• Bringing the site online renames a page it cannot delete, so the site comes back online instead of the task failing.
• The task still leaves the site's API app pool running, as before.

Centralpoint Agent 8.12.16.5 brings a site back online when the Master worker that took it offline stops before its work finishes.

• A sync, an update install, a data update or a backup restore takes a site offline while it runs. If that worker crashed, was recycled, or restarted because a Master file changed, the site stayed offline until someone removed App_Offline.htm by hand.
• The Agent now removes App_Offline.htm from the site's Root and Console within one check-in, and starts the site's API app pool if the work had stopped it.
• A restore that stops after emptying the site's folders leaves the site offline, so a half-restored site is never served.
• An App_Offline.htm placed by hand is never removed.
• Each recovery, and any site the Agent cannot bring back, is reported to Oxcyon.

This needs the Master on 8.12.16. Set Agent:OfflineRecoveryEnabled to false in the Agent's appsettings.json to turn it off.

Creating a site from a backup no longer adds a second copy of a web.config location block.

The backup's location blocks are now matched to the new site's by path, ignoring letter case and slashes. A backup's api.svc block no longer lands beside the new site's Api.svc block, which would define the same setting twice.

web.config updates in a release now reach the secondary server of a load-balanced site.

Some updates stopped before writing the secondary server, because that server had no Backups folder. The update now creates the folder first, so both servers get the same web.config. A secondary that missed an update in an earlier release is not repaired by this release.

Web API records now accept a posted request of up to 16 MB, up from 64 KB, so large generated content saves in one call.

• A request over 16 MB is refused with status 413.
• Lrs.svc and the Query Analyzer share this setting, so their 64 KB limit rises too.

web.config change

The update edits each site's main web.config (Root). The Console web.config is not changed.

• system.serviceModel > bindings > webHttpBinding: the unnamed binding gets maxReceivedMessageSize, maxBufferSize and readerQuotas maxStringContentLength of 16777216. A higher value is kept, and a named binding is not changed.
• <location path="Api.svc">: maxRequestLength is set to the binding's size, at least 16384. A higher value is kept.
• An unnamed basicHttpBinding added by hand at exactly these 16 MB values is removed, when nothing on the site uses it.

Check two cases on your own servers:

• A virtual directory that runs as its own IIS application keeps its own web.config, which the update does not touch. Add the same binding there if its services need larger requests.
• If custom code declares its own <service> for the Web API with a named binding, raise that binding by hand. The update reports it and leaves it unchanged.

When saving Master properties cannot log on as the administrator, the save message now says which step did not run, and why.

• On Master > Admin > Properties, the websites are not updated, and the message says they still hold the old Master property values.
• On Master > Development > Properties (API), the message says the API was not restarted.

Both messages name the account and the reason the logon was refused.

A File System storage path that impersonates an administrator or a named account now stops when that logon is refused. It no longer runs as the app pool identity instead.

• The error starts with "Could not impersonate" and names the account and the reason.
• For a named account, the error points to the storage path's own identity fields, not Admin > Settings.
• Validating the storage path shows this error instead of a stack trace.
• The run status no longer shows the stored encrypted password.

On a Master whose app pool runs as NetworkService, tasks that run as the administrator no longer fail with "An error occurred while attempting to impersonate".

• The CleanUp scheduled task runs to completion again.
• Installing an update records the new version in the Master properties.
• Creating or restoring a website, Update Build Prep, and saving the API properties complete.
• When the administrator logon is refused, the error on Master > Deployment, Master > Content > Scheduled Tasks and update installs now names the account and the reason.

The Centralpoint Agent's admin impersonation check now accepts a user@domain account when the Domain setting is blank.

• A user@domain username with a blank Domain, or a Domain of ., now logs on with the full account name.
• The Agent's hourly check no longer raises AdminImpersonationFailed for a correct password.
• The Api uses the same logon for load balancing and service control, so those actions accept the account too.
• A username without @ is unchanged, and a Domain you set is used as entered.
• A local account whose name contains @, with a blank Domain, now fails to log on. Set Admin.Impersonation.Domain to the machine name for that account.
• When a logon fails with error 1326 and the Domain is blank, the message now says the Domain is blank and how to set it.

A patch now restarts every app pool it stops, and it never copies files into a pool that will not stop.

• A busy app pool gets as long as IIS allows its worker to finish: the pool's shutdown time limit plus 15 seconds.
• A pool that will not stop in time, or cannot be found, is left alone. The patch reports its files as deferred, and that site stays on the old version until you dispatch the patch again.
• A pool that an earlier patch left stopped is copied and restarted by the next dispatch.
• A web.config skips its binding redirects only when a file in its own folder did not land. The other folders of the same site still get theirs.
• When the patch dispatches again, it handles the pools it deferred last time first.
• One patch spends at most 3 minutes stopping and restarting pools. A pool whose stop and restart no longer fit is left running and deferred.

The Api and Centralpoint Agent and CLI 8.12.16.5 use System.Security.Cryptography.Pkcs 10.0.13, which fixes two published denial-of-service advisories.

• The advisories are GHSA-846f-f764-76mx (High) and GHSA-2fmv-rv2c-59x7 (Moderate).
• None of the three calls this library directly. It reached them through the SQL Server client.
• No setting changes and no action is needed.

A new Word Variable Autofill module property fills a Word template's DOCVARIABLE fields from the record whenever the document is opened.

• It applies in the Word viewer and PDF viewer (FileViewer and PdfViewer CpScripts), on download for editing (WordAddInDownload and the Policies download), and in File Output.
• Enter one line per field: Field Name = Attribute | Attribute ; format=MM/dd/yyyy. The first attribute with a value is used, and a field with no attribute prints blank.
• A->B reads attribute B from the record whose DataId is stored in attribute A.
• Fields fill only when the viewer can see the record. A disabled, expired or restricted record opens unfilled.
• Formatted text prints as plain text, and dates show in the site's time zone.
• An invalid format= leaves that field blank. The document still opens.
• Viewing never changes the uploaded file. A copy downloaded for editing and saved back keeps the values filled at download.
• The template must contain a field for each value. Fields missing from the template are skipped.
• Prior policy versions are shown exactly as they were.
• The property is empty by default, so nothing changes until it is set in the module's Page Options > Module Properties.

The libraries behind the Anthropic Claude provider, local ONNX embeddings, the API reference page and AI answer formatting are updated to their latest versions. Nothing changes in how you use these features.

Centralpoint CLI 8.12.16.5 now finds site names and addresses that contain ] when it rewrites them during a migration.

Backup cleanup now keeps deleting old backups when one archive cannot be deleted. The error that follows names each archive it could not delete and why.

Emails and text messages sent by a scheduled task no longer fail because no web page is involved. An email with an attachment given as a site-relative path now includes the attachment.

Multifactor sign-in access codes, Twitter sign-in requests, and other random values the site generates now come from a cryptographically secure generator. Nothing changes in how you use these features.

The RelatedData CpScript now applies each related attribute's own filter. Before, every attribute used the filter of the first one. A site map link with no Fields set no longer causes an error.

The DataSource CpScript's Google Map display now places each marker at the row's own latitude and longitude. Before, every marker used the longitude of the first row.

When a Data Transfer writes a file whose name is already taken, it now adds the first free number (_1, _2, ...) to the name. Before, it added a random number, which could match an earlier export and overwrite it.

Attribute selectors built on CpListBox and CpDataListBox keep a saved selection in two more cases.

• A list whose values are text, such as an IntegrationId column, no longer drops a saved value that is not a GUID when RememberMissingItems is on.
• A CpDataListBox with JoinClauses no longer reports its saved selections as inaccessible.

Requests from scanners and bots are answered quietly instead of raising server errors.

• A request with a malformed Host header gets a plain 404.
• A request path the server rejects, such as one containing & or ::$DATA, no longer writes an error to the Windows event log.
• When visitors request stored files whose names the site cannot serve, Development > Errors shows one entry that tells you to run Admin > File Name Cleanup.

Module search browse letters and title filters now match %, _ and [ as plain characters.

• A browse letter of % lists only titles that start with %, not every record.
• A title prefix too long for any title to match returns no results instead of an error.
• Searches and related-content filters on a name that contains ] now find that name.

System queries that exclude a list of 100 or more records now run consistently fast, however large the list grows. This applies anywhere the platform builds a query that leaves out a set of records, for example:

• a Data Transfer delete that skips the records listed in a module's Grid Disabled Checkboxes property
• front-end role filtering when Web Site Role Filtration & Security is set to All (FISMA Compliant)
• the DesignSwitch CpScript's excludeddesigndataids list
• custom code that builds a query with SqlBuilder

Custom code that filters by a user attribute with more than 99 user ids no longer fails with a SQL error. Custom code that references SqlBuilder.MaxValuesBeforeLookupTable now gets a compiler warning; its value is unchanged and the code keeps working.

Each Data Cleaner rule can now record where its logic comes from, using two new optional attributes.

• Determination holds the IntegrationId of each approved detection rule behind this rule, one per line, up to 4,000 characters.
• Source Credit names who the logic is credited to: the authority first, then the citation, up to 256 characters.

Both attributes are optional, so existing rules are unchanged and save as before. Both values can also be used in data sources and reports.

To prevent cross-site scripting (XSS), names, titles and other stored text shown in the console and in front-end dropdowns now display as text and can no longer run script.

• Covers console list pages and record details, including Site Architecture > Taxonomy and Audiences, Users, Roles, Development > Database and Keyword Lists, Design > Media Manager, module record grids, breadcrumbs, and the taxonomy and audience selectors.
• Covers front-end dropdowns built by CpScripts such as NavigationSectionMenu, AdvertisingSearchRedirectDropDownList and EventBriteRegisterButton, plus the taxonomy cascading dropdown.
• Allowed formatting such as bold, italics and colored text still renders.
• A title that contains an email in angle brackets, such as Name <name@example.com>, now shows the email instead of hiding it.
• Module grid columns defined as HTML expressions in the module's Grid Columns setting, such as Preview links, are unchanged.
• Approving or saving a comment in Comments > All Modules no longer saves the on-screen hint text as the commenter's name and email. A comment from a signed-in user keeps its empty name and email, and the comment text is saved exactly as submitted.

Error details and scheduled task notification emails now hide API key, token and secret values, as they already did for passwords.

• A value written as api_key=, apikey=, access_token=, client_secret=, secret_key= or similar shows as ***REDACTED***.
• A form or query field named for a credential, such as api_key, access_token or client_secret, is left out of Development > Errors.
• A task setting whose name ends in Token, Secret or ApiKey, such as JsonBearerToken, is hidden in notification emails.
• Links and HTML around a hidden value stay intact. The notification message you write for a Data Update task is sent as written.
• Some values that only look like credentials, such as a pageToken= paging value, are also hidden.

When a JSON data source cannot load its data, visitors now see "The JSON data source could not be loaded." instead of the vendor's error text.

• The vendor's error is kept in the page trace for administrators, with API keys and tokens hidden.
• After a failure, the data source waits one minute before calling the vendor again, so an outage does not send a request on every page view.
• The Personal Dashboard Data Source gadget and the Data Sources JSON preview and validation messages now show vendor text safely, with any HTML displayed as text.
• CreateExcel.aspx shows the site's error page for a failing JSON data source, and CreateJSON.aspx returns a 500 in JSON error mode. Site search results that use a failing JSON data source come back empty.

When a JSON data transfer fails against a vendor, the vendor's error text no longer shows API keys or tokens.

• An api_key, apikey, token, secret or secret_key value that the vendor echoes back is shown as ***REDACTED*** in the Process Log, the transfer's error email and the Console validation message.
• The error message no longer includes a technical stack trace, so it is shorter and easier to read.
• Credentials sent as a header, such as Authorization: Bearer, or in JSON form are not yet redacted.

Audit trail events are now kept for 30 days when they were written by the system rather than by a person. Until now these events were never removed, and on the busiest sites almost all of them come from automated processes such as Data Transfer, which records an event for every record it touches on every run. Over time that grows into millions of rows that no one reads.

Removing them:

• Keeps the database from growing without limit, which shrinks backups and makes them faster to create and restore.
• Makes the Audit Trail on a record easier to read, since it is no longer buried under repeated automated entries.
• Keeps the history people actually use. Every change made by a current user stays in full.

How it works:

• The new Events Retention property in Admin > Properties sets how long system-written events are kept. It defaults to 30 days.
• Only events not tied to a current user are deleted: automated processes such as Data Transfer, anonymous visitors, and users no longer in the system.
• Events by current users, including users marked deleted, are always kept.
• The newest event of each type on a record is always kept, so "last modified by" and similar displays are unchanged.
• Set 0 to delete all such events on each clean up, or -1 to disable retention and keep full history.
• It runs from the CleanUp scheduled task, Master > Development > Utilities, and each site sync, install, backup and deployment. Sites with a large backlog clear it over several clean ups.

A JSON Data Transfer no longer sends a blank URL parameter when its token resolves empty, and a vendor error now fails the run.

• A query parameter whose value is only cp:scripting tokens that resolve empty is left out of the request. The Process Log names the parameter that was left out.
• Fixed text written beside a token is still sent, so fields=id,name[token] sends fields=id,name.
• When the vendor returns an error (such as 401 or 404), the run fails and sends the error email. Before, the run could report success and import one bogus row.
• Saving a transfer whose JSON source returns an error shows the vendor's message under Validation, as plain text.

When install or repair creates the cpsys_Master app pool, Centralpoint CLI 8.12.16.4 turns off IIS's 29-hour periodic recycle on it, so a new install never starts with it.

• The CLI changes only a pool it has just created. The Centralpoint Agent covers an existing cpsys_Master.
• A value set in the server's app pool defaults is kept.
• Site and API app pools keep the IIS default.

Centralpoint Agent 8.12.16.5 turns off IIS's 29-hour periodic recycle on the cpsys_Master app pool, so a recycle no longer kills a long scheduled task or sync partway through.

• The Agent changes the pool only while the pool and the server's app pool defaults are both on the IIS default of 1,740 minutes. A value the client set is kept.
• Changing the pool can restart it, so the Agent waits until no Master process is running and no site is offline.
• A Master older than 8.12.12 keeps the default until it is updated.
• Site and API app pools keep the IIS default.

Centralpoint Agent 8.12.16.4 restarts a loop that faults and keeps checking in when one management step fails.

• A scheduler, management or pipe-listener loop that faults restarts after a 1 minute wait. The wait doubles on each repeat fault, up to 4 minutes, and starts again at 1 minute after an hour without a fault.
• A management step that throws before the check-in is logged and skipped, and the check-in still runs. The steps are the web.config refresh, the trace auto-revert, the IIS repair and the pending Master operations.
• A Master database that cannot be opened no longer stops the tick. A pending Sync or Update Install waits. One still open after 4 hours is reported as "the Master database could not be reached".
• Every Master database connection the Agent opens trusts the SQL Server certificate.
• The Master health probe takes the Master's address from UpdateInstall.SyncInvokeMethods when Api.Base.Url and Cda.Utilities are absent. A localhost address is skipped.
• Agent:ReportLoopHealth (default true) set to false stops the Agent sending its loop health.

Download to Edit in Word now works for macro-enabled Word files (.docm and .dotm), and their macros are kept when the document is saved back.

• These files no longer show a System Error. They download, lock and save back like a .docx.
• The WordAddInDownload CpScript now shows its checkout link for .docm and .dotm records instead of a plain download link. With handlerOnly set, these records show the checkout link instead of the nonHandlerFormat output.
• To edit a .dotm template, right-click the downloaded file and choose Open. A double-click starts a new document, which the add-in cannot save back.
• Word may block the macros in a downloaded file until it is unblocked. Editing and saving still work.
• If a document cannot be prepared for editing, the download fails without locking the record.
• When Remote Update Security Mode is empty, WordAddInDownload shows a plain download link instead of a checkout link that fails.
• .docx, .doc and .pdf downloads are unchanged. The PolicyWordAddInDownload CpScript in the Policies module does not support macro-enabled files yet.

The DragAndDropFileUpload CpScript now works when its optional redirectUrl is left out.

• Leaving out redirectUrl no longer causes an error on the page.
• Without redirectUrl, no "Click here to go to form" link is shown after an upload. A blank redirectUrl used to show a link to the home page.
• With redirectUrl set, the link works as before.

A site page that is still listed in navigation, but whose content record no longer exists, now shows the Page Not Found page instead of a server error.

• Visitors see the standard not-found page.
• Pages whose content exists are not affected.

Tools > Clear Search Terms now works when All Modules is selected, and checks the Filter before deleting anything.

• Choosing All Modules clears search terms instead of failing. With an empty Filter, you are asked to confirm before every search term on the site is cleared.
• A Filter that contains ;, --, /*, or unbalanced quotes or parentheses is rejected with a message, and nothing is deleted.
• When one module is selected, the Filter applies only to that module's search terms, even when it uses OR.
• All Modules appears once in the Module list.

Centralpoint CLI 8.12.16.3 creates cpsys_Master as NetworkService on a new install. Centralpoint.exe repair no longer changes cpsys_Master's identity, which the Centralpoint Agent now manages. Repair still restores the identity of every other Centralpoint app pool.

Centralpoint Agent 8.12.16.3 runs a local named pipe that makes IIS changes for the Master, and it moves the cpsys_Master pool to NetworkService.

• The pipe accepts only the Master's own worker process, SYSTEM, or an elevated administrator. A web site's worker process is refused, even though it runs as the same account.
• The move to NetworkService waits until the Master is 8.12.16 or later, its admin impersonation logs on, and no Master process is running.
• Agent:MigrateMasterPoolIdentity (default true) set to false moves the pool back to LocalSystem. Agent:PipeEnabled (default true) turns the pipe off.

When Windows cannot translate an account name during a file permission grant, because the Local Security Authority is briefly unavailable, Master > Development > Errors now records it as a temporary outage. The message says that the next Clean Up retries the grant. It no longer reports that the SQL service account does not exist.

Master > Development > Health Monitor now shows available memory correctly in GB for any amount. Before, values under 1,000 MB or over 9,999 MB showed the wrong figure. When the server does not let the Master read the memory counter, the page shows "unavailable" instead of an error.

When the Admin Impersonation account cannot log on, a sync method now stops and reports "Could not impersonate an administrator" instead of running under the Master's own identity.

• Executing a method from Master > Development > Sync Methods shows the error, and the Process Log records the run as failed.
• An update install reports the failure for each affected method.
• The DevOps task keeps the admin identity for every method in its run.

To fix the logon, update the Domain, Username and Password in Master > Admin > Settings.

Saving a load-balancing change on a web site now tells the Centralpoint Agent to re-read its load-balanced site list. The Agent service no longer restarts. If the Agent cannot re-read the list, the save restarts the service, as before.

The Master application pool (cpsys_Master) now runs as NetworkService, its original identity, and the Centralpoint Agent makes the Master's IIS changes for it.

• The Agent moves an existing Master pool to NetworkService on its hourly check, when no Master process is running. The pool recycles once.
• Creating and deleting a web site, turning read-only on or off, Always On, and the update install's pool stops and starts now go through the Agent.
• A pool stop or start that fails is now recorded in Master > Development > Errors.
• A scheduled task that writes to a folder outside the Centralpoint install needs NETWORK SERVICE granted on that folder, as before. This covers Data Transfer, Data Archive, SFTP Source, File Synchronization and similar tasks.

A canceled module unenroll or settings change that removes indexed passages now writes an error entry on Master > Development > Errors. The entry names the module and the passages already removed. Run the unenroll again to finish.

Knowledge Assistant search and chat, and the Page Assistant, now finish faster on large indexes and no longer time out when too many passages match.

• Search and chat build the list of matching passages first, then rank only those. A search over about 80,000 passages dropped from about 5.6 to 3.7 seconds on a test server.
• When more than 150,000 passages match, the search stops and shows "Select specific knowledge-base modules to search this index."
• When you already picked modules and they are still too large, it shows "The selected knowledge-base modules are too large to search together. Select fewer modules."
• Chat shows that message instead of an answer with no sources. The Page Assistant still answers, without content from your site.
• A search that cannot finish within 20 seconds now stops at that point, before the browser's 30-second limit.
• The retrieval benchmark on the AI test page reports how many passages matched, and it stops with the message instead of timing a search that did not run.

A Bulk (insert only) transfer into a standard module no longer loses rows silently when the database connection drops.

• A batch that fails because the connection dropped is cleaned up and retried, up to three tries.
• A batch that still fails is saved to Uploads\DataTransfer\Failed_{transfer id}\, and the transfer continues with the next batch.
• When a run loses a batch or does not finish, its source files are moved to that folder, so the next scheduled run does not import them again.
• The run shows "Transfer Completed with N lost batch(es)" and sends no success notification.
• One recovery email lists the lost rows, the saved file and how to re-run. It goes to the transfer's Error Notification and Notification recipients, or else to the site's Error Notification Email.
• The Error Notification Body has three new placeholders: DataTransferRecordLink, LostBatchSummary and KeptSourceFolder.
• A lost batch sends this recovery email instead of the transfer's own error email. Its subject is "Data Transfer lost N batch(es): ", so update any mailbox rule that matches the old subject.

Delete the saved files once the rows are recovered.

Data Broadcasts that use the custom SMTP settings now always check the email server's certificate when they send over SSL.

• A broadcast sent through a custom SMTP server with a self-signed, expired or mismatched certificate now fails instead of sending. Before, a form email on the same site could switch this check off.
• Broadcasts sent through the site's own email settings keep trusting that server, the same as form emails, so they work as before.
• Custom SMTP settings now send directly to the configured server, and accept a host written as host:port.
• SMTPEnableSsl is now applied both on and off, even when the site's web.config turns SSL on for email.
• When custom SMTP has no user name and password, the broadcast connects without credentials. It no longer uses Windows sign-in or the user name and password in the site's web.config.

If custom SMTP broadcasts stop sending after this update, install a valid certificate on that email server, or set the host to the name the certificate was issued for. The failure reads "The remote certificate is invalid according to the validation procedure."

Centralpoint now trusts an invalid certificate only for the one connection that needs it, never for the whole site.

• Form emails still send through an email server with a self-signed certificate, the same as today.
• All other secure connections, such as web service calls and other emails, now check certificates normally, even after a form email was sent.
• The Epic wait-time data sources still connect to their own Epic server as before. Other code that calls that same Epic server also skips the check, so point these data sources only at your real Epic server.
• Data Broadcast subscription confirmation emails now close their mail connection after each send.

Check your custom code

Custom code under App_Code/Custom may have worked only because a form email had already turned certificate checks off for the whole site. After this update, it can fail when it calls an HTTPS site or email server whose certificate is self-signed, expired, or issued for a different name.

• Look for this error: "The remote certificate is invalid according to the validation procedure."
• Best fix: install a valid certificate on that server, or connect with the host name the certificate was issued for.
• If the server must keep its certificate, trust only that connection with Centralpoint.Web.CertificateTrust. Do not add code that trusts every certificate, because it turns the checks off for the whole site again.
• Custom code that trusts a mail client must dispose it (a using block). Otherwise another email to the same server can reuse the trusted connection.

Failed SAML sign-ins through a Global Login now show up in Development > Errors with their cause, and users no longer loop back to the Identity Provider.

• Each failed sign-in is recorded under its own SAML sign-in error, with the step that failed and the timing details sent by the Identity Provider. User names and attribute values are never recorded.
• Repeated failures are limited to about one entry an hour for each Global Login and step, so an outage cannot flood the error list.
• After three failed sign-ins in a row, the user sees the AuthenticationFailedErrorMessage with a support reference instead of being sent back to the Identity Provider again.
• Error entries no longer store the raw SAML response for any error on the site.

The Centralpoint Agent and command-line tool are updated to 8.12.16.1.

• System.Security.Cryptography.ProtectedData is updated to 10.0.12.
• System.IdentityModel.Tokens.Jwt is updated to 8.23.0.

Several third-party libraries that every site loads are updated to their current versions. There is no intended change in behavior.

• Dapper (data access) is updated to 2.1.89.
• Microsoft.Bcl.AsyncInterfaces, Microsoft.Extensions.DependencyInjection and System.Security.Cryptography.ProtectedData are updated to 10.0.12.
• System.IdentityModel.Tokens.Jwt and its four Microsoft.IdentityModel libraries (sign-in tokens) are updated to 8.23.0.

Masters already on 8.12.15 receive the same libraries and binding redirects through patch 8.12.15.1.

web.config change - read this if a site has a virtual directory or custom code

This version updates these runtime > assemblyBinding binding redirects in each site's Root and Console web.config, and in the Master's Root web.config:

• Microsoft.Bcl.AsyncInterfaces -> 10.0.0.12
• Microsoft.Extensions.DependencyInjection and Microsoft.Extensions.DependencyInjection.Abstractions -> 10.0.0.12
• System.Security.Cryptography.ProtectedData -> 10.0.0.12
• Microsoft.IdentityModel.Tokens, Microsoft.IdentityModel.JsonWebTokens, Microsoft.IdentityModel.Logging and Microsoft.IdentityModel.Abstractions -> 8.23.0.0
• System.IdentityModel.Tokens.Jwt -> 8.23.0.0

Dapper keeps its assembly version, so it needs no redirect.

1. A virtual directory running as its own IIS application has a separate web.config that this update does not touch. Add the same redirects to that web.config by hand, or the sub-application fails with a "Could not load file or assembly" error.
2. Custom code that references any library above at an older version must still load after the update. If it does not, add the matching redirect to its configuration.

The CleanUp scheduled task's Temp folder sweep no longer deletes an empty folder created in the last month.

• The same sweep runs from Development > Utilities and with each website sync.
• Pages that create a working folder in Temp and fill it later keep that folder while they wait. A large upload no longer fails with a missing folder error.
• An empty folder now stays until it is one month old, then cleanup removes it.
• Files older than one month are removed as before.

The new Admin > File Name Cleanup page finds files and folders under Uploads whose names the site cannot serve, renames them, and updates the content that links to them.

• Scan Uploads lists each name containing & % + # , ;, a character Windows does not allow, or a trailing dot or space, with its planned new name. Blocked characters become _, and a taken name gets _1, _2.
• Find links in content finds the records in site search that link to those names. Links written as a full URL are listed to fix by hand.
• Download CSV lists every rename, every linking record and field, and every full-URL link.
• Fix renames the files and saves each linking record once, with a history version and an event. A fix that stops part way is completed by the next Fix.

Only content in site search is updated. Links outside Centralpoint, such as emails and bookmarks, keep the old names. Find links and Fix require a healthy site search index. Running Fix outside business hours is recommended.

web.config change

The Console web.config gains a <location path="FileNameCleanup.aspx"> entry with httpRuntime executionTimeout="7200", so a long fix is not cut off. Only the Console web.config changes. The page exists only in the Console, so virtual directories running as their own IIS application and client custom code need no change.

Uploaded and imported files are stored with _ in place of & % + # , ;, characters Windows does not allow, and a trailing dot or space, so the site can serve them.

• The rule applies to Design > File Manager, the file upload dialog and FormUpload, the content editor's file managers, File Sharing uploads, zip extraction, the FileDownload, FileAction and ScreenCapture Data Transfer scripts, SharePoint attachments and Word Add-In saves.
• A renamed file is saved beside an existing file of that name, such as name_1.pdf, rather than overwriting it. A name that needs no change still replaces the existing file.
• The Modify File Name website property still applies on top of the rule.
• Moving a file to another folder keeps its name. Only a new file or a rename is cleaned.
• Form emails attach a file whose name contains a comma, such as Last, First.pdf.
• The WordAddInDownload link works for names containing &, # or +.

Existing files are not renamed. Admin > File Name Cleanup handles those.

A recurring Data Transfer that stored a file under a blocked or percent-encoded name, such as A&B.pdf or My%20File.pdf, downloads it once more under the cleaned name. The older copy stays on disk until Admin > File Name Cleanup removes it.

A file sync now completes when a folder it removes from the destination holds a path longer than the Windows limit of 260 characters.

• That folder is removed, and the sync continues with the remaining folders.
• The site's last sync date updates when the sync finishes.
• A folder that cannot be removed, for example because it is in use or access is denied, is skipped while the sync continues.

Built-in plugin scripts now carry a version stamp, so browsers load the updated file after a release instead of a cached copy.

• This covers the ExtDatePicker, ExtFancyBox, ExtFlyoutMenu, ExtWaterMark, ExtPasswordStrength, ExtCalculation, ExtExpandTextArea, KillerCarousel, JPlayer and TaxonomyFileExplorerView CpScripts.
• It also covers the paginator, Google Map, organization chart and thumbnail viewer scripts, and the Resources and Website Links pickers in the content editor.

Pages look and behave the same.

Visitors see the site's own error page in two more cases.

• When the database connection pool is exhausted, the error page now shows its built-in message instead of the server's generic error page.
• An expected error raised by a page, such as a missing template or an unknown feed, shows the error page without writing an ASP.NET warning (Event 1309) to the server's Application event log.

Form emails again include the generated PDF when the form's FilePath ends in /. Since 8.12.14 the email went out without the file.

• The FormManager CpScript now trims a trailing / or \ from FilePath.
• An attachment path with a doubled slash inside it is accepted.
• A form set to save to a folder (FileLoacation 01) with an empty FilePath now reports a clear error instead of sending without the file.

Attribute validators that name only their type, with no id, are recognized again everywhere a module's attributes are read.

• Data Transform > Data Transfer applies these validators when it writes a standard module, instead of skipping them.
• A form generated from a module with these validators renders its required, length, range and pattern checks, instead of failing.
• The Web API attribute selector and the module attributes page load for the Data Sources, Script Generator, Data Transfer, Manifests and System Pages modules, instead of failing.
• A pattern validator keeps its own pattern check.

Scheduled tasks no longer repeat a failure on every check.

• A web site task whose web site was deleted now records a Skipped process that names the missing site and says to point the task at a live site or disable it. Before, it failed on every run.
• A master task that fails or runs past the request time limit, such as a long Backup, now moves its next run time forward. It no longer runs again on every check and holds up Clean Up and Database Maintenance.

A form whose content contains its own form script now shows a message instead of stopping the website.

• The nested copy is replaced with "This form includes itself and cannot be displayed." The rest of the page renders normally.
• This also covers a chain, such as form A including form B, which includes form A again.
• Development > Errors records the problem once an hour and names the forms involved, so you know which form's content to fix.

Form validator errors now show the validator's own message, such as "You must provide a valid second field name.", instead of always saying the form control may not exist. That hint now appears only when a missing control is the likely cause.

The Learning Record Store (lrs.svc) now saves and returns xAPI Activity State, so a course can store the learner's place and read it back on relaunch. Previously the save was accepted and discarded, so learners always started over.

Behavior changes on every install:

• Course resume: state documents are stored per learner, course and registration, and returned with their original content type. A read of a document that was never saved answers "not found" (404) instead of an empty success (204).
• Exit saves: course players that save on tab close using the xAPI alternate request form are now accepted. They were all refused before.
• Voiding: voiding a statement keeps the original (marked as voided) and stores the voiding statement as its own record, so voiding statements now appear when statements are read.
• Duplicate statement ids: resending the same statement is accepted without creating a second record. A different statement under an id that is already used answers 409 (was 400).
• PUT /statements now reports failures instead of always answering success, and uses the statementId it is given.
• authority on new statements names the account that submitted them, not the learner.
• With an access token, a voiding statement must name the same learner as the statement it voids.
• Merging a state document with POST is not supported and answers 400. Use PUT.
• Each learner can keep at most 1000 state documents. A new one over the limit is refused (403).
• State saves are now validated. A save whose agent is not a Centralpoint user, or whose activityId, stateId, registration or Content-Type is missing or invalid, is refused with 400. Before, every save answered 204 and was thrown away. The course player treats a refused save as a failed save and keeps running, but that learner cannot resume.
• A statement whose object has no objectType is now stored, since xAPI treats it as an Activity. Before, it was refused with 400.
• Voiding a statement now returns the id of the new voiding statement, not the id of the statement it voids.

A new Learning Record Store (xAPI) option is available under Admin > Properties. Default keeps today's behavior. Enhanced shows three settings:

• LRS Learner Identity: token only, signed-in learner first (token still allowed), or signed-in learner only. When a signed-in learner is used, they can only write and read their own statements and state.
• LRS Integration Accounts: which Web API accounts may send statements with an access token (empty allows any).
• LRS Require HTTPS: refuse access token calls over plain HTTP.

The Document Content Attributes module property can now read text from scanned PDFs and image files (PNG, JPG, JPEG, TIFF, BMP and GIF) with the Tesseract OCR engine, and insert it into the destination attribute of each pair (for example FileUpload1=RTFEditor1). Previously a scanned PDF produced no text, or only the junk text a scanner had hidden in the file, and image files were skipped.

OCR is off by default and is chosen per source in the new Document Content Attributes: Read with OCR property: Images, Scanned PDFs, or both. Each costs differently, and OCR runs while the record saves at several seconds a page, so only the sources a module needs should be selected. On a module whose uploads include photographs, selecting Images would fill the attribute with stray characters or empty it, replacing anything entered there by hand.

• Scanned PDFs are PDFs that contain images where every page has fewer visible words than OCR: Minimum Visible Words (default 20). Text a scanner embeds as a hidden layer is not counted and is replaced by the OCR text. A PDF with any typed page, or longer than 25 pages, is converted as before.
• OCR: Minimum Confidence (default 60) discards OCR text the engine is unsure of. A file that falls below it, or that OCR finds no text in, is not used: a PDF keeps its normal conversion, and an image leaves the attribute empty, clearing any text from a previously uploaded file. Clean scans of typed pages score above 90; drawings, maps and handwriting score lower and are kept out.
• OCR text is always inserted as plain text. When OCR reads a scanned PDF, Insert PDFs as HTML? does not apply to it.
• The two OCR settings are shared module properties listed after OOXML Extractions, so any future OCR option uses the same pair.

Handwritten pages, drawings and maps generally do not produce usable text. Details are in the OCR help file and the updated Document Content Attributes help file. The three new properties must be added to a module's properties before use.

A site's Console could fail to start on a server that does not have .NET Framework 4.8.1 (Windows Server 2019 and older). The Console web.config targeted 4.8.1, ASP.NET refused to load it, and the site redirected to the error page with no message beyond an event 1310 in the server's event log. A new sync method, DowngradeTargetFrameworkAll, and the Centralpoint installer, repair and migrate tools now lower the setting to 4.8 where 4.8.1 is missing. Servers that have 4.8.1 are not changed, and the sync method records itself as skipped there. The method re-arms itself if a web.config that targets 4.8.1 is restored onto a server without 4.8.1, for example from a backup or a moved database.

web.config change warning. This release edits web.config files on servers without .NET Framework 4.8.1. It changes targetFramework="4.8.1" to targetFramework="4.8" on both the httpRuntime and compilation elements, in the main site (Root) web.config and the Console web.config of each website, and in the Master web.config. A secondary server in a load-balanced pair has only its Root changed. The change applies on the update that follows this release.

• Virtual directories running as their own IIS application have a separate web.config that this release does not touch. If one targets 4.8.1 on a server without 4.8.1, change both values to 4.8 by hand.
• Client custom code (App_Code/Custom, or a custom-code app with its own config) that sets targetFramework to 4.8.1 needs the same manual change on those servers.

Changes Made: Records written through the Web API now clear the cache of the modules they change, the same way saving a record in the Console does. Previously, records created, updated or deleted through the Upsert Data, Upsert Data From Site on Same Server and Delete Data methods did not clear any cache, so the change was not visible on the site until the cache expired or was cleared another way. For example, a new SiteMap page added through the API did not appear in the navigation.

The cache is now cleared once per module after all items in the request are processed, both on the site and in the Console. For the SiteMap and PreferredUrls modules this also refreshes the site navigation. Clearing applies to the module each record actually belongs to: an update by DataId into a record outside the method's configured module clears that record's module, and a Delete Data request without a module that deletes records from several modules clears each of them. No change to existing requests is required.

Upsert Data From Site on Same Server now clears the Resources cache once at the end of the request instead of once per copied resource, after each resource's file extension is updated, so a changed resource file type is picked up immediately.

If a cache cannot be cleared, the request still succeeds and the response Warning notes which module could not be cleared.

The Resource Content Attributes module property now stores the search text of an Excel workbook (.xlsx, .xls, .xlsm, .xlsb, plus .csv and .tsv) as each distinct cell value in its visible worksheets, listed once. Spreadsheets repeat the same values down every column, so this reduces the stored search text by roughly 25% to 90%, with large data workbooks seeing the largest savings. Hidden worksheets are not included. Word, PDF and other file types continue to store their full text.

A workbook attribute is now added to the record's search content even when the same attribute is also listed in the Document Content Attributes module property. Other file types continue to skip Resource Content in that case, as before. This keeps workbook text searchable, including workbooks too large to convert to HTML.

The FileReadAllText Data Transfer script has several Excel improvements.

• Prefer HTML: with preferHtml='true', a workbook is now returned as HTML with a tab for each visible worksheet, including formatting and embedded pictures. This is the same HTML the Document Content Attributes module property produces. Previously only a single-worksheet workbook returned usable HTML (without its formatting), and a workbook with several worksheets returned no worksheet data at all.
• Size limits: with preferHtml='true', a workbook over 25,000 cells across its visible worksheets, or 5,000,000 characters of HTML, returns an empty value. Plain text (the default, without preferHtml) is not limited, so large workbooks can still be read as text.
• .xlsm and .xlsb workbooks are now read as Excel, in both plain text and HTML.
• Hidden worksheets: plain text output no longer repeats the first visible worksheet's text once for every hidden worksheet in the workbook.

The script's Prefer HTML help in the Script Designer describes the workbook output and the limits.

The Document Content Attributes module property now supports Excel workbooks (.xlsx, .xls, .xlsm, .xlsb) in addition to Word, PDF and text files. The same attribute pair that converts a Word document or PDF (for example FileUpload1=RTFEditor1) now converts an uploaded workbook into HTML in the destination attribute.

• Each visible worksheet is shown as its own tab above the workbook, in workbook order. Links inside the workbook that point to another worksheet switch to that worksheet's tab. A single-worksheet workbook is shown without tabs.
• Fonts, colors, fills, borders, merged cells, column widths and row heights carry over, and pictures and charts are embedded in the HTML. Hidden worksheets are not included.
• The tab styling can be overridden from the site's stylesheet through the cpxl-wrap, cpxl-tabs, cpxl-active, cpxl-section and cpxl-sheet classes.
• Size limits: a workbook is only converted when it is within 25,000 cells across its visible worksheets (counted from the first cell to the last cell holding data on each worksheet) and 5,000,000 characters of HTML. Larger workbooks produce more HTML than a page can render and records too large to work with, so a workbook over either limit is not converted, and the destination attribute is left empty (clearing any content from a previously uploaded file). Large spreadsheets are better suited to the Excel Viewer. A workbook that is password protected or cannot be read also leaves the destination attribute empty.
• Existing mappings: a module that already maps an attribute in Document Content Attributes will begin converting Excel workbooks in that attribute on the next save of each record, replacing the destination attribute's content.

The Document Content Attributes help article has been updated with the workbook details, the limits, and how to make workbook text searchable.

The FileReadAllText CpScript can now extract text from image files (PNG, JPG, JPEG, TIFF, BMP and GIF) using the same Tesseract OCR engine as the OcrZone script. The new Read Images option (isReadingImages) under the script's Advanced properties turns it on. It is off by default, because OCR is resource intensive and increases transfer time. Transfers that already point FileReadAllText at image files keep returning an empty value until the option is enabled.

When enabled, the whole image is read, including every page of a multi-page TIFF. A new minconfidence property (0 to 100) discards the text when the engine's recognition confidence falls below the threshold, so unreadable scans return an empty value instead of junk text. To read a single region of an image, or to use the character-type and case options, continue to use the OcrZone script.

OCR requires the image file to exist on disk before the transfer runs, for example a File System source's FullName column or a Standard Module upload path. Images served from a URL or SharePoint are not read and continue to return an empty value.

The Knowledge Assistant, the Page Assistant and text summarization can now use three more AI providers, in addition to OpenAI and LLamaSharp. The AI Providers page at AI Governance > AI Providers shows a card for each one, with the vendor logo.

• Anthropic Claude activates from its card with the same agreement flow as OpenAI. Usage bills to Oxcyon at first. The activation email lists the steps to move the client onto its own Anthropic workspace and API key, so each client gets its own usage report.
• Google Gemini and Azure OpenAI use the client's own account. The client enters the API key in AI Governance > AI Properties. Azure OpenAI also needs the resource endpoint and the deployment names. These two cards show "Configure in AI Properties" instead of the agreement flow.
• The "Works with Copilot" badge now shows on the Azure OpenAI card only. The OpenAI card no longer carries it.
• ONNX Embedding is now the last card, and the last entry in the Embedding Models section, because it is embedding-only and rarely changed.
• When a provider account runs out of credit, every provider now shows the same plain message in chat. A provider that is not configured stays unavailable and does not affect the others.

Existing sites keep their current provider. Nothing changes until an administrator activates or configures one of the new providers.

Two newer local (on-premises) AI models are now available under AI Governance > AI Providers:

• Gemma 4 E2B (Google) - the fastest local model, using about half the memory of the default.
• Granite 4.2 3B (IBM) - tuned for business documents, with 12 languages including Spanish.

Gemma 3 4B and Granite 3.3 2B are now marked as superseded by these. Sites that use them keep working. The default local model is unchanged (Qwen3 4B Instruct). A new model downloads automatically the first time a site uses it.

Local AI chat now stops when its answer is complete. Previously, most local models kept generating after the answer, repeating or restating it until they reached the length limit. This affected the Knowledge Assistant, the Page Assistant and the AI Test Center chat. Answers are now shorter and arrive two to four times faster.

Local AI chat and summaries now also use each model's own tuned settings, including repetition controls that were configured but never applied. Chat answers and summaries from local models may read slightly differently after this update.

When Oxcyon schedules a hotfix for your server, the addresses in the New Update Notification Email property under Master > Admin > Properties now receive an email in advance. The email gives:

• when the hotfix starts, in the server's own time zone, with Eastern time beside it
• the server and the sites on it
• one sentence on what the hotfix changes
• the impact: sites on the server stop and restart while the hotfix installs, and are briefly unavailable

Hotfixes are normally scheduled for 11:30 PM Eastern. If the server installs a newer Centralpoint update before the start time, the hotfix is canceled. A server that only receives the hotfix once it updates to that version is not sent a notice. Until a server reports its time zone, the email shows Eastern time only. If the property is empty, no notice is sent. Separate multiple addresses with semicolons.

The third-party Telerik UI components that power several built-in features have been upgraded to the current patched release. These components sit behind the rich-text content editor, the File Manager (Design > File Manager), file and image uploads, the in-editor Image Manager and Image Editor, and the dynamic role filter builder.

This is a security and maintenance update. It closes two vulnerabilities present in the previous component version (an unauthorized file-read and a remote-code-execution risk in the editor's file dialogs). There is no change to how any of these features work for end users, and existing content is unaffected. The rich-text editor opens, renders, and saves exactly as before.

The updated license is built into the platform, so no per-server licensing step is required after deployment.

IMPORTANT - FOR INSTALLS WITH CUSTOM CODE: If a client install includes custom code that directly calls Telerik UI controls or APIs, that custom code must be tested against the new component version after deployment. All standard Centralpoint functionality has been fully regression-tested; only bespoke client customizations that reference Telerik directly carry any residual risk. If you are unsure whether an install has such custom code, flag it for review before rolling out.

A host with no routing rule can now redirect to a primary domain. A request for a host name that has no domain rule used to end in a 404, and legacy brand domains produced a steady stream of error reports. A new Web Site Primary Domain property on Admin > Properties names the host to send those requests to. The visitor is redirected permanently, with the path, a non-default port, and https behind TLS termination kept. A request made by IP address is still answered with a 404 and never reported, and an empty value, an invalid host, or the request's own host keeps the 404. Unroutable hosts are reported once an hour as a ranked list, and an audience whose home page was retired is no longer reported on every visit.

Form emails keep their attachments. In 8.12.14 an attachment whose stored path had a stray space was refused, so the form email went out without the file. Each path is now trimmed first. A file name that itself contains a comma is still split.

Admin > Settings finishes saving when the site folder does not allow new files. Saving writes the new web.config through a temporary file, which needs permission to create a file in the site folder. Where that was denied, the save stopped after the new configuration was already live and before connection strings and the console configuration were updated. It now writes in place, and writes the original content back if that write fails. The API log-level setting uses the same fallback.

Master > Content > Scheduled Tasks - long tasks reschedule instead of repeating. A web site task stopped by the request time limit (DataBroadcasts, XMLConversion, RetentionPolicies) kept a next-run time in the past and ran again on every check. It is now rescheduled first. A data transfer stops shortly before the request limit and fails as an ordinary transfer failure, so the schedule moves on instead of the task restarting for hours. The transfer's attributes and relation counts are saved together, and the module backup flag is reset on its own connection, so an aborted chained transfer no longer leaves a full module backup to run on every later transfer.

Master > Content > Scheduled Tasks - Database Maintenance reports each database once a day. One shared budget of three reports an hour per master meant a frequently maintained staging database used it up and later databases in the same sweep went unreported.

Site search records its SQL before it runs and limits repeated terms. A search that timed out never logged the statement it ran. The statement is now logged first. A term repeated many times, as crawlers send it, is de-duplicated, and a query keeps at most 25 terms.

Dates are written to SQL the same way on every server. Dates built into SQL text used the server's regional format, so on a day-first server an update could fail or, for days 1 to 12, store the wrong date. Current-time values now come from the database, and other dates use the ISO 8601 format. This affects Data Broadcast send and unsubscribe, Policies and Procedures approval, Contextual Search date filters, the console change notification on a module edit, and Ecommerce orders.

Forms > Forms Wizard keeps a Keyword List or Taxonomy Tier choice. The saved system type was loaded into the wrong dropdown, so the choice fell back to Module on the next rebind and was saved that way.

Broadcasts - the unsubscribed recipients list no longer fails when the module has no RecipientSource attribute or no data id.

Online course tests handle the question parameter safely. The value is now escaped before it is matched and encoded when it is copied into the result redirect. A signed-out visitor is stopped before grading, and the already-passed check treats %, _ and [ in the value as literal characters.

Module view pages recover from stored form state. After a Module Designer change, a form post carrying older page state could fail a Details, Results or Home page. These pages no longer restore state they rebuild on every request, which also makes the page state smaller.

Smaller fixes. The Comments control is hidden when a Site Map page has no current record, instead of returning a 500. A preview column that looks up a table once per row now counts the table once per request. Uploading a custom attributes file that repeats an attribute id is rejected with the repeated id named. When the AI provider is out of credits, summaries, chat, and the Page Assistant tell the user to contact an administrator, and an OpenAI failure names the model. The Page Assistant debug block shows server text safely. The Uploads copy during a site data update skips the generated stylesheet cache and no longer lists server paths in skipped-file entries.

Error reporting groups related failures correctly. A refused file permission write and a rejected logon no longer share one error, a closed-connection fault is reported per call site, and a failing site data copy is no longer reported with the source path.

The Centralpoint Agent and command-line tool are updated to 8.12.15.3. The Agent now probes the canonical host under the localhost scope.

When importing Module Designers through a Data Transfer, a new Module Views File Handling option controls how each module's code files (the .ascx / .ascx.cs views) are handled during the import. Three choices:

• Copy from path - copies the existing code files from a source directory (the previous behavior; the source path is entered in the Module Views Directory Source Files field, which now appears only when this option is selected).
• Data only - imports the Module Designer records only, with no code files.
• Generate files - builds the code files from the module templates during the import, so the imported Module Designers work immediately.

Previously, importing Module Designers brought in the records but required re-submitting each Module Designer by hand to create its code files. The new Generate files option removes that manual step. The option appears on a transfer whose Source and Destination are both set to Module Designers, on the Source & Destination tab.

Contextual Search query suggestions (the type-ahead list fed by AlgoliaAutocompleteIncludeQuerySuggestions) are now faster and lighter on the database, and stay that way as search statistics are rebuilt over time.

The 8.12.15 sync improves how the search statistics are stored and indexed:

• The full-text index on the search statistics is rebuilt on a new numeric key, so it no longer accumulates leftover index data. Running the sync also clears any data already accumulated on existing sites.
• The statistics rebuild now updates the existing statistics rows in place instead of deleting and re-adding all of them. New queries are added, and queries that fall outside the statistics window (90 days by default) are removed, so the suggestions and their counts are unchanged.
• The suggestions index now carries the click count and last-searched date, so ranking the suggestions no longer needs extra lookups.
• On SQL Server 2025, a search statistics index still in the older full-text format is rebuilt automatically.

The change runs once per site during the sync and needs no configuration. Like the rest of Contextual Search, it applies to SQL Server 2016 and later, and sites on SQL Server 2014 are skipped. Full-text suggestions repopulate on their own within a few minutes of the sync.

Centralpoint's own scripts no longer compile text as code at runtime. This removes Centralpoint's reliance on the 'unsafe-eval' Content-Security-Policy directive, so a site can adopt a stricter policy. Timers, JSON parsing, and the lookups that ran configured script now run as ordinary functions. Pages behave as before, with the exceptions listed below.

Custom code that may need attention

• DataTables: custom script that calls cp_DataTables.init directly must now pass Order, Columns and ColumnDefs as values, for example Order: [1, 'asc'], rather than as quoted strings such as Order: "[1, 'asc']". The standard DataTables CpScript is already updated. A call that still passes strings stops the table from loading and reports a script error in the browser console.
• CheckInButton: the SuccessJavascript property of the CheckInButton CpScript now runs as the body of a function. The same values are available as before (that, dataid, moduleid, attributeValue, checkedInValue, attributeName, checkedInText), and return can now be used to exit early. Existing success code needs no change.
• FormAutoSave: the legacy mode of the FormAutoSave CpScript has been removed. A tag that still sets IsLegacyMode now uses the current auto-save behavior, which requires the form's AutoSave attribute to be enabled.
• Page Options: each entry in the Page Options menu on Console pages now runs independently, so one malformed entry no longer affects the others.

A scheduled task that is meant to act on web sites but has none selected used to finish without doing anything and without telling anyone. This release reports it.

• Sync tasks. A Sync task whose scope is "Selected" with no sites chosen, or which has no scope at all, now logs an error that names the task and says to set its sites in the Master Console. The task still reschedules and does not run. "All sites" on a master that has no web sites yet is still valid and raises nothing.
• Other site-scoped tasks. The ClicksMerger, DataArchive, NaturalLanguageSearch and Template tasks now fail their run with a message naming the task when neither the master nor any web site is selected. Before, they ran with an empty site list. A task with the master selected and no web sites is a valid scope and is unaffected.

Masters that already have a scope on every one of these tasks see no change. A master with a task that was silently doing nothing will now show an error for it on each run until its sites are set.

The taxonomy, audience, and role selectors (shown when editing any content record, and on front-end forms that use a taxonomy selector) now render their intended formatting again - bold text, colors, and the hidden sort-order prefixes - instead of showing raw HTML tags as plain text. This closes the display regression introduced in 8.12.14 while keeping those labels safe: a shared safe-list allows a small set of formatting tags and strips anything else, including scripts, event handlers, and any style that could load or run remote content. This replaces the interim 8.12.14 patch, which restored the formatting but left the underlying security gap open.

This now also covers the radio-button selectors in the Module Designer - for example the Taxonomy Search attribute's options, where the "None" option previously showed its hidden sort-order prefix as literal text.

Behavior change to note: label styling is now limited to safe cosmetic properties (text color, bold/italic, font family and size). Any layout or positioning style stored in a label - position, display, margins, or screen-relative sizes - is dropped, which closes a way a styled label could overlay the page. The usual color and font styling on taxonomy labels is unaffected. Separately, label markup outside the allowed set (such as underline, superscript, or a class on a span) renders as plain text; if a client reports a label losing styling after this update, this is the cause, and the safe-list can be extended if a tag or property is legitimately in use.

Deployment note: this release pairs Centralpoint.dll and Centralpoint.Web.dll - the web controls use a shared component in Centralpoint.dll, and this now includes the radio-button selectors and the Console yes/no switches. Any patch or hotfix built from this must ship both files together, or the taxonomy, audience, role, and radio selectors will fail to load.

A new module property, Resolve Login via RelayState (EnableRelayStateLookup), has been added to the AuthenticationSources module (Admin > Global Login), off by default. It addresses a "No configuration found" error that can appear when several Global Logins share the same Identity Provider - for example, multiple portals under one Microsoft Entra tenant, which stamps the same Issuer on each.

When enabled, a sign-in carries the specific login's identifier through the sign-in round-trip, so if the browser session is lost (a fresh window or tab) the callback resolves the exact login that started the sign-in, instead of falling back to an Identity-Provider/audience guess that can come up empty. When off, behavior is unchanged.

This is a module-wide switch: when it is on, it applies to every SAML Global Login on the install. Only enable it when the logins that share an Identity Provider are the same trust tier, since an enabled login can be selected by any user holding a valid sign-in for that shared Identity Provider.

On a Windows Server 2025 master, an old copy of a shared library (such as Newtonsoft.Json) in the Windows Global Assembly Cache (GAC) can take precedence over the site's own copy. The Master Console then stops with a server error. Centralpoint has a repair for this, but it was recorded as done in the master database. A master built from a copied database therefore never ran the repair on its new server.

• Master > Development > Sync Methods now moves the GAC repair back to New when the server's GAC still disagrees with the site's copy. The repair then runs on the next version install, a retry from Server Hub, or a run from the Explorer view. A site sync never runs it.
• The repair now checks the server again after it finishes. If a stale copy remains, it reports Failure instead of Success, so an unsettled repair stays visible.
• The Windows version check for these methods now reads the server's real Windows version instead of a value saved at install time. A database copied from an older server no longer gates on the wrong version.
• New command Centralpoint.exe gac screens every Centralpoint site folder on the server and refreshes any stale GAC copy. It works while the Master Console is down. Use --what-if to report only, with no changes and no administrator rights. Without --what-if, the command asks for administrator rights.
• install, migrate and repair now run the same screen. A failed screen shows a warning with the command to re-run, and the run continues. repair --dry-run previews the screen without changing anything.
• When the GAC changes, gac and repair restart IIS once so no worker keeps the old copy in memory.
• If two site folders ship different builds of the same library, the screen refuses to change the GAC and names both builds. Align the folders, then run it again.

The Master web services folder used to accept calls from anyone, with no sign-in. That included methods that run updates and sync methods, create and restore backups, run scheduled tasks, and start processes. Every call to the Utilities, SyncInvokeMethods and ScheduledTasks web services now carries a signature, and Master checks it. The site Console, the site pages, the Agent, Centralpoint.exe sync-method run and Master's own update install all sign their calls. The Agent and the CLI move to 8.12.15 with this release.

How the rollout works. Sites often sync after Master updates, so Master does not refuse unsigned calls at once. While any site on the install is below 8.12.15, Master serves an unsigned call and logs it under Development > Errors with the key MasterWebServicesAuth:Unsigned. The entry names the endpoint, the method, the caller address and the reason. Master starts refusing unsigned calls (HTTP 403) when all of these are true: every site is on 8.12.15 or later, Master has verified a correctly signed Agent call in the last 24 hours, and the installed CLI is 8.12.15 or later. Master rechecks every 5 minutes. No setting turns this on or off.

Sign-in for three more services. ClientMethods, ProcessMonitoring and WebSiteBackups now need a signed-in Master session. Master admin pages already call them from a signed-in browser, so admins see no change. A script that polled ProcessMonitoring without signing in now receives the sign-in page.

SOAP 1.1 only. These endpoints now accept SOAP 1.1 only. SOAP 1.2, form posts and .asmx/Method style calls count as unsigned, because the signature binds to the SOAP 1.1 SOAPAction header.

Custom code. Custom code that builds Master.Utilities directly sends unsigned calls. Master serves and logs them now, and refuses them once the install enforces. Change such code to SignedMasterUtilities, which sets the Master address and signs the call. Page.Master in the site Console and Root already returns a signed proxy. The site cache methods RemoveCache and RemoveMemoryCache also check the signature now. These methods send no reply, so an unsigned caller sees no error. The site records the refusal in Development > Errors as "Rejected unauthenticated ... call".

Configuration change. One file changes: Master's WebServices\Web.config. It removes the folder-wide "allow all users" rule. It adds "allow all users" only for Utilities.asmx, SyncInvokeMethods.asmx, ScheduledTasks.asmx, Services.svc and DevOps.svc. It also removes the HttpSoap12 and HttpPostLocalhost protocols. The update package ships this file, so no sync method applies it. No site web.config changes, and a virtual directory that runs as its own IIS application keeps its own web.config.

Impersonation cleanup. Master now always ends administrator impersonation when an operation fails partway. Before, a failure could leave the worker thread running as the administrator for the next request.

Editing a Data Transfer record with a SQL Server source is now much faster and places far less load on the source database.

Previously, the Data Transfer form ran the full source query many times during an ordinary edit, not only when the transfer itself ran. Opening a record ran it once, and moving between the General, Source & Destination and Fields steps ran it again, up to three times per step. A typical edit session ran the source query about 12 times before anything was transferred. For a source that reads a large table, each of those runs took as long as the transfer itself, so editing one record could keep the database busy for minutes and slow down the rest of the site.

The form now only checks the source's column names and types, which SQL Server answers without running the query or reading any data. That check takes a fraction of a millisecond regardless of how large the source is. The same walk through the form that used to run the source query 12 times now runs it 0 times.

• Opening, navigating and saving a record no longer runs the source query.
• Show Source Sample on the Fields step now fetches the sample only when the button is clicked. It is the one place in the form that still runs the source query, because a sample needs real rows. Once loaded, the button shows and hides the sample without running it again. Unsaved field mappings are kept, and an unfinished mapping no longer shows validation errors when the sample is loaded.
• Scheduled and Execute Now transfers run the source query once per run, where they previously ran it twice. Statements that a source runs after its main query, such as a stored procedure that marks rows as exported, still complete as before.
• Validation messages for invalid SQL (a syntax error or a missing table) are unchanged and still appear immediately.

A small number of sources cannot be checked this way, most commonly queries that use temporary tables or build their SQL dynamically. Those continue to run the query during editing, exactly as before.

A blank Source Select Command is now rejected with the message "You must select a valid Source Select Command." (or "enter" for ODBC, OLE DB and Oracle sources) instead of a technical error. A transfer with a blank select command could never run, so no working transfer is affected.

The Centralpoint CLI repair command no longer rewrites the Agent scheduler address (Agent:SchedulerUrl) on every run. Before, repair rebuilt it from the first IIS binding and assumed https whenever a host header existed. On a Master with only an http binding, or with a certificate that does not match the default host name, this left scheduled data transfers unable to connect, and each repair put the broken address back. Now repair tests the current address from the server itself, using normal certificate checks. If it answers, repair leaves it unchanged, which also keeps a value an operator corrected by hand. If it fails, repair replaces it with the first address that does answer: the Master Api.Base.Url, then each https binding, then each http binding. An https address that fails is never downgraded to http. When nothing answers, repair keeps the current value and prints a warning that scheduled tasks will not run until the Master site is reachable. Each change prints as old -> new.

The same rule now applies to the Development site's Master and API addresses (Api.Base.Url.Master, Master.Utilities, Api.Base.Url, Cda.Utilities, Console.Utilities). Repair changes a key only when its address fails, and it backs up web.config first. If the Development appSettings section is encrypted, repair writes nothing and prints the steps: set Protected to No, re-run repair, then set Protected back to Yes. The https or http scheme now comes from the https binding that exists, not from the host header. Changing the domain with repair --domain still moves every address to the new domain.

This change is in the CLI only. It does not add a version bump or a sync method, and it ships with the 8.12.15 CLI.

The Delete button on the Errors page (Development > Errors, on the site Console and on Master) now removes any error in the list. Before, only errors marked low priority could be deleted, and the checkbox for every other error was disabled. The Delete button on an open error now deletes that error. Before, it acted on the checkboxes in the list behind it. Deleting only affects your own errors: on a site Console it covers that website's errors, and on Master it covers the errors for the whole master. If some of the selected errors could not be deleted, a message above the list says how many, for example "Not deleted: 1 of 2 selected errors. They were already deleted or cannot be deleted from this site." If the delete itself fails, the page says so, and none of the selected errors are removed. Sites on a version earlier than 8.12.15 can no longer delete errors from this page. Delete shows an error page there until the site is updated.

Security hardening: a form using FormZipFileToDirectory can now only delete the zip that was just uploaded to it, not zip files or Resources that other people uploaded earlier.

The FormZipFileToDirectory CpScript extracts the zip named by its target upload field into Uploads\FormZipFileToDirectory. With Is Deleting Zip? enabled (the default), it then deletes the zip. That deletion exists so a zip uploaded only to be unpacked does not linger on disk or in Resources: someone uploads a zip, submits the form, and only the extracted files remain.

The zip path comes from the submitted form, so a modified submission could name a different zip, such as an existing file under the site or any zip Resource, and have it deleted along with its Resource record. Two safeguards now prevent that:

• Deletion is limited to a zip written within the last 10 minutes, which covers the normal upload-then-submit flow. A zip submitted after that window, or one carrying a future file date, is still extracted but is left in place, with a trace warning recording the skipped deletion.
• A plain file path is only accepted when it points into the site's Uploads folder. Paths anywhere else on the site are ignored, so no extraction or deletion takes place for them. Zips uploaded as Resources are unaffected apart from the 10-minute deletion window.

The form itself never fails because of either safeguard. When one applies, the only effect is a zip left on disk.

• The save does not wait for the conversion. Conversions run in the Master application one file at a time across the whole server, and a burst of saves, such as a Data Transfer with Use Console Utilities, is handled by a single run.
• Applies to saves in the Console and to Data Transfers that use Console Utilities. PDF files and unsupported file types are not queued.
• A file that fails is attempted up to 3 times and then kept as a failed entry; saving the record again queues it again. Queue entries are removed after 30 days.
• If the Master application is unavailable, the files wait in the queue for the next save or the next Temp PDF File Generator run.
• Conversions run during working hours and share the server with daytime traffic, so this option suits modules with light, steady saves. For large modules and bulk imports, the Temp PDF File Generator scheduled task is recommended instead.
• Results appear in Master > Development > Process Log under PDF Conversion Queue.

• Settings: Web Site, Modules, Attributes (the attributes that hold relative file paths or Resource.ashx links, for example FileUpload1, FileUpload2) and Maximum Execution Time (Minutes).
• 4-hour limit: a run never exceeds 4 hours (240 minutes; 0 uses the full 4 hours). Files a run does not reach are generated on its next run, because each run skips files that are already cached.
• Process log: each failed file is logged with its path and error, and a Sweep - Checked / Converted / Already Cached / Skipped / Failures summary is written every 25 files or 5 minutes and at the end. Before its sweep the task also processes files queued by the new PDF Pre-Generation module property (logged as Queue - ...).
• Not pre-generated: PDF files (served as they are) and watermarked views (built when viewed). Files in a virtual directory are pre-generated only when the same virtual directory is also mapped on the Master application, to the same folder.
• Cached PDFs are removed by the monthly temporary-file cleanup, so the task should recur

• Integrity Scan (Yes/No) - turns the check on.
• Integrity Scan Module Ids - optional comma-separated list of module ids to limit the scan (leave empty to scan recently changed content instead).
• Integrity Scan Date Offset (days) - when no modules are listed, how far back to look (default 90).

• Radio or checkbox option labels that intentionally contained HTML markup (a styled label, or a link inside an option) will now show the tags as literal text rather than rendering them.
• Client custom code that added its own HTML-encoding to radio/checkbox item labels should remove it, since the controls now encode once at display. A leftover manual encode shows literal < characters (display only, not a security issue).

• Connection strings - cpsys_Select and cpsys_Execute must have a value.
• Machine Key - the Validation Key and Decryption Key must be present and must be valid hex values of the correct length. Entering AutoGenerate is rejected, because it causes the key to be regenerated on every application start, which signs out every logged-in user.
• Master Id - must be present and a valid GUID, in any of the standard GUID formats.
• Master Root - must be present. An empty value previously failed silently rather than raising an error, which made it harder to diagnose.
• Check Frequency Minutes - must be a whole number of 1 or more. A value of 0 caused the remote security check to run on every page request instead of disabling it. Values above 1440 are still accepted and treated as 1440 (daily).

• Resource Roles - a comma-separated list of role system names (found under Admin > Roles) allowed to open the files. Left blank, every resource carries the Private role, which means any signed-in user can open it and anonymous visitors cannot. Naming roles restricts access further. Where the destination website has Role Filtration And Security turned on, a user must hold every role listed rather than any one of them. A name that does not exist is reported once and no resources are written for that run; the mapped attributes are left empty until the name is corrected and the transfer run again, which restores them. The public files are never removed while the value is unresolved.
• Resource Audiences - audiences assigned to each resource. Defaults to All Audiences.
• Resource Url By System Name - returns the readable ?sn= form of the link. On by default.

• Scheduled task lock file held past 1h ... and ... is N hours old (past the 1h max age); an incomplete process last recorded activity ... Not orphaned. — Informational. A long-running task is being protected. No action. Expected during long runs.
• URGENT: Deleting a scheduled task lock file ... because it exceeded the 12h hold ceiling ... — Actionable. A run outran the 12-hour safety ceiling and its lock was cleared, so a concurrent run may start. Investigate why the task runs that long (or raise the ceiling for that install).
• WARNING: Deleting a scheduled task lock file ... because the liveness check could not run ... — The master database was unreachable/timed out during the check. Check database health if it recurs.
• WARNING: Deleting orphaned scheduled task lock file ... — Normal recovery. A previous run ended without cleaning up and no activity was seen; the next run proceeds.

• A scheduled task that only ran out of request time is no longer disabled. It previously switched itself off and had to be re-enabled by hand.
• The late-task threshold is now configurable and defaults to four hours.
• A SAML certificate fault is now reported rather than only suppressed, so a signing-certificate problem surfaces instead of appearing as a silent login failure.
• A transient database failure during Windows single sign-on falls through as an anonymous visit instead of throwing.
• A supplied PDF that cannot be read is reported as a content problem, not a platform fault.
• Database connectivity failures wrapped inside another error are now grouped with the rest.
• The error logger no longer throws while it writes a log entry.
• Repeated check-in and OAuth renewal notices are rate limited, the latter per authorization and user rather than for the whole site.

• A failure while repopulating a module relation table no longer deletes the user's document.
• A relation delete that fails now stops the repopulation, instead of reporting a duplicate-key symptom on the insert that follows.
• Replacing a resource file now retires the previous file aside rather than deleting it, so a file that is locked or in use is no longer lost. Replacing a file with one of a different extension retires the original correctly.
• Large bulk index deletes are queued through a list parameter, so the request is no longer rejected on size.

• A Data Transfer targeting the Site Map module now matches that module correctly. The field map could previously be generated against the wrong table name, and the transfer then failed with an invalid object name.
• Generated SQL renders a MAX-length parameter as MAX, and quotes string and date types.
• A delete-only search synchronization reads only its own index.
• The scheduled task that downloads a file now runs under the process id its caller supplied, so its row appears in the Process Monitor with its status steps.
• Images loaded for template rendering and size checks are released immediately, so a source file can be renamed straight after a render.
• Stylesheets and scripts shipped with the platform now carry an automatic version stamp, so a browser picks up an updated file after a deployment.

• The vector upsert holds its lock on the content index for less time.
• A retrieval timeout now reports how many eligible chunks were in play.

• Aborting a running process from the console is now signed and verified between the site and the master.
• Document preview conversion accepts a source file only from inside the site, in every accessibility mode.
• The document preview cache refreshes when its source changes, and two files with the same name in different folders no longer share one cached copy.
• The OneDrive download target is taken from the session rather than the address bar, so a download link no longer carries the credential to an address a visitor supplies.
• The console login return address is validated before the redirect.
• File and folder paths are checked against the folder boundary rather than the leading text. A sibling folder whose name merely started with the permitted one was previously accepted.
• Two pages that build a browser redirect from a supplied address now encode it.
• Uploads through the file browser validate the requested subfolder.

• Clean Up's index and statistics maintenance step now reports its progress while it runs. Previously, a long-running maintenance pass on a large database could be misidentified as a stalled or abandoned process and closed out prematurely; it is now correctly recognized as active for as long as it is genuinely working.
• If a Clean Up is already running, a second attempt to start one - scheduled or manual - is now skipped rather than allowed to run at the same time, preventing duplicate maintenance work from overlapping.
• Process Monitor's detection of processes interrupted by a server restart or crash is more thorough. Some older interrupted processes were previously excluded from reporting entirely; they are now included in a single summary so a backlog is visible instead of hidden.

• Revisions count. A record with no activity in the selected period now reports a revision count of 0 rather than -1, and no longer subtracts a point from its own total. This applies to any record whose activity all falls outside an active date filter, not only to records that were never touched, so it affects most rows on a typical board: in testing it moved about four of every five records. Because each affected record also gains a point, the ordering of a board can change wherever point totals were close. Point totals and ranking should be expected to differ from the previous release, and the new figures are the correct ones.

• Form submissions count. The count of form submissions per record was previously read from a shortened copy of the underlying data, so records referenced late in a large submission could be undercounted. That limit is gone, and the match is now made on the record identifier itself rather than by searching the submission's text, which also removes a dependency on the database's sort order settings. No change is expected on most sites, since the shortening only took effect on unusually large submission records, but sites that hit it will see submission counts and point totals rise to their correct values.

• Row ceiling. A gamification board now returns at most 1,000 rows, and its Excel and JSON exports are limited to the same. The Limit attribute on the Gamification Configuration record can lower that ceiling but can no longer raise it. Previously an unset Limit allowed up to 10,000 rows, and a blank, non-numeric or zero Limit returned every matching row with no ceiling at all. No Gamification Configuration record currently in use sets a value the new ceiling would reduce, so no existing board is expected to truncate where it previously did not. The ceiling is there to stop a future misconfiguration returning an unbounded board and rendering it into the page. A Limit the ceiling rejects is now written to the page trace, so a board truncated against its own configuration can be diagnosed rather than guessed at. The ceiling applies to the leaderboard and Module Specific boards, which render every row into the page; a personal board is unaffected, as covered below.

• Personal boards now always show the signed-in user's own row. A gamification data source set to report on the current user only, rather than a full leaderboard, previously had to find that user inside the ranked rows it had already retrieved. A user ranked outside that set saw an empty panel with no explanation. The whole site is now ranked and the user's own row selected from that ranking, so a personal board reports correctly regardless of how the user ranks or how many people the site has. Sites large enough to have hit this will see previously blank personal panels start reporting.

• A misconfigured board now renders empty instead of raising an error. A gamification data source whose GamificationConfiguration or GamificationModule attribute is missing, malformed, or points at a record that no longer exists now returns an empty board, with the reason recorded in Health Monitor. Previously this produced an entry in Admin > Errors. A board that stops reporting will now appear blank rather than announcing itself, so a blank gamification panel is the first thing to check, and Health Monitor is where the reason is recorded.

• Metrics whose module was never installed now report zero instead of failing the board. With no Gamification Configuration record every metric is treated as enabled, and the Logs, CE Reports and Forms metrics each read from a module that not every site has. On a site missing one of those modules the entire board previously failed to load. Those metrics now report 0 and the rest of the board renders normally.

• An empty board still returns its columns. A Module Specific board that cannot resolve its configuration now returns an empty result carrying the full set of columns, and the per-metric multiplier values a template may read are published on every path. A template that binds a column such as Points, or reads a multiplier, no longer fails on an empty board.

• Module Specific author details. Each row shows the person who most recently touched that record. Where several entries share an identical timestamp, the name, email, last-login and photo are now all taken from the same entry, so a row can no longer pair one person's name with another person's photo. On those tied rows the person shown may differ from before.

• Date filters passed on the address bar. A startDate or endDate supplied in the page address without a time zone is now interpreted in the viewer's own time zone and converted before filtering. Results for those links shift by the viewer's offset from UTC, and the new figures are the correct ones. A value that states its own time zone or offset is honored as given rather than being reinterpreted. A date falling outside the range the database accepts is now brought inside that range; previously such a value produced an error before the board ran, on a page that does not require sign-in. Date filters set on the Gamification Configuration record itself are unchanged, and continue to be compared exactly as stored.

• Module Specific boards now also return each record's identifier, auto-number and module, which allows the ColumnFriendlyUrl script to build links to the ranked records. Templates that name their columns are unaffected; a template that lists every returned column will show three more.

• A database in Full recovery with an active log-backup chain is reported only when its transaction log is above the maintenance threshold of about 1.5 GB. Below that, the log is healthy, its owner manages it, and nothing is reported. An oversized log still reports, because at that point there is space to reclaim and only the database administrator can reclaim it.
• A database in Bulk-Logged recovery is reported at any log size. That setting is usually left behind by accident rather than chosen, and a routine log-backup job picks the database up either way, so size alone cannot tell the two apart.
• Maintenance that is deferred because a backup is running follows the same rule, so a database whose maintenance window always overlaps its own backup can no longer defer without ever being seen.

• These maintenance messages no longer go to the site's Error Notification email. They are still recorded for review, so nothing is lost - they simply stop arriving in the inbox as though they were site errors.
• Each database in a run is now reported on its own. Previously the first database to report could suppress every other database's message for the following hour, so a genuine finding on a later database went unrecorded.

• Charts refuse a chart belonging to another member instead of rendering it.
• The log form view refuses another member's log rather than displaying its title.
• Record entry verifies both the log and each record being edited before anything is written, so a partly saved form is no longer possible.
• Log deletion verifies ownership before removing a log or its records. A deletion request carrying another member's log id previously removed that member's log while leaving their records behind.

• The Delete This Log? link now works from the chart views. It previously issued its request and silently did nothing, which read as a broken feature.
• The chart on the standalone chart page now renders. Its drawing area was being replaced before the chart was drawn, so that page never displayed a chart.
• The chart date range is now validated before it is applied. An empty or non-date entry previously produced either a blank chart with no explanation or an unhandled error. Invalid entries are now reported next to the button and kept on screen for correction.

• Legacy (default) — no change from current behavior; the document renders

• Canonical — the visitor is redirected to the document's own section, so it

• Strict — the same redirect as Canonical, and additionally returns a Page

• Admin > Global Login: a certificate problem during single log-out now names the Global Login source that failed and the certificate settings to check, instead of reporting a generic failure.
• A locked-out account is no longer handed back to the requesting page in a signed-in state. The sign-out rebuilds the request identity, and self-request sign-outs redirect only from a page request.

• The Source Attributes limit is raised from 25 to 100. Wide indexes that previously could not be saved at all now save. The stored field was also widened to hold a list that long, so a long list no longer fails on save.
• A failure now says what went wrong. Both the preview and the save previously reported only a status number, which is why a rejected list and a permissions problem looked identical. The dialog now reports the actual reason, including the reason returned by the server.
• Both calls now have a time limit. A save on a large module used to appear to fail instantly; it now runs to completion and reports what it did.
• A rebuild that is interrupted can be resumed. Re-running the save finishes the remaining work instead of starting over.
• Values are checked before anything is sent. An empty or out-of-range Chunk Size, Overlap, or Max Chunks/Record, and a list over the limit, are reported inline in the dialog.
• New attribute picker. Browse this module's attributes lists every attribute defined on the module, prose fields first, and marks the ones that hold no text. Names that are not defined on the module are called out by name, including a name that is correct except for its capitalization - matching is exact, so aidescription does not match AIDescription and would have indexed nothing.
• The dialog estimates how much of each record is actually indexed, and the preview shows it measured per attribute: how often each one is filled, its size, the running total, and where the budget runs out. Attributes past that point are named as not reached, so a list that is longer than the budget allows is visible before saving rather than after.
• The preview states the exact impact - how many chunks and stored values the save will delete, how many records will be rebuilt, and roughly how long that takes. Records that exceed Max Chunks/Record are now reported instead of being silently shortened.

• The wait now derives from the request's own time budget rather than a fixed five minutes, so a sync method that needs longer is allowed to finish. Each phase is given a share of the remaining time, so the phase that follows still has time to run.
• The message now names what actually happened. A timeout, an unreachable address, and a server-side error read differently instead of sharing one wording. The message names the scope that failed rather than always saying "Master and Development", and the advice to check the web service address now appears only when the address really was unreachable. The remediation text no longer tells the operator to select "Pending" on Master > Development > Sync Methods - there is no such filter on that page, and a method that has never run shows as New.
• A slow Master phase no longer silently skips Development. When the Master scope times out, the install now still runs the Development scope, because a Master timeout says nothing about Development and minutes of install work run in between. It still skips Development when the address is unreachable or the server returned an error, and it now records a step on Master > Development > Process Log naming the scope it skipped. Previously a skipped phase left no record at all.

• Update file manifest. Master > Deployment > Updates records which files an update replaced. If that record was interrupted while being written, the next update could read it as empty and treat every file as needing replacement. The record is now written whole or not at all.
• Deployment backups. A deployment interrupted while writing its backup marker could afterwards be read as a completed backup. The next deployment then skipped taking a backup and began replacing files with nothing to roll back to. The marker can no longer be left in that state.
• Deployment packages. Replacing a deployment package on the server briefly removed the old file before the new one was in place. A site requesting it in that instant received a "not found". The swap is now a single step.
• Long installation paths. On installations whose folder path exceeds the Windows 260-character limit, saving settings, toggling application trace, and restarting an application all silently did nothing - the operation reported success without acting. These now work on long paths.

• The two taxonomy tree CpScripts and the TaxonomyProximitySearch CpControl now store their results per taxonomy root and per module. Widgets configured with different roots previously shared a single storage key, which would have served one widget's taxonomy to another as soon as the cache began holding anything.
• The audience menu now builds its own filtered list on each request. It previously filtered a shared list in place, so two visitors in different audiences loading a page at the same moment could affect each other's menu.
• Deleting a member log, and saving a member log record, now update the log display immediately. Both write directly rather than through the console, so neither released the stored copy.
• The taxonomy trees now refresh when a taxonomy item is renamed or moved.
• The member log chart no longer stores its results. Its date range moves with the current date, so a stored copy was never reused; it now reads live on every request, and changing the date range always re-reads.

• The navigation set is read once and shared. Every audience now builds its menu from a single lookup instead of running its own. The menus produced are unchanged; only the number of lookups changes.
• An audience with no published home page is recorded once. Previously that condition was re-checked in full on every visit, for the life of the application. It is now recorded the first time and skipped after that, until a home page is published or the navigation cache is cleared.
• Simultaneous first visits to the same audience share one lookup. Several visitors arriving at once no longer each open their own connection for the same audience.
• One audience's failure no longer affects the others. If a menu cannot finish building, only that audience is affected. Previously the site discarded every audience's menu, so every visitor had to wait for a rebuild - and the rebuilt links could come back in a non-standard form until the next restart.

• Recorded search terms - stored only when Admin > Properties > Search Criteria Recording is enabled. These feed popular-search and search-activity displays.
• Leads - recorded only on navigation items with lead tracking turned on.
• Clicks - recorded through the click redirector, which has no separate setting and is therefore the broadest of the three.

• Deleting a web site - if the IIS bindings cannot be read, the process status now says so and the failure is recorded, so it is clear that a hosts-file entry may have been left in place. Previously this was discarded entirely.
• Restarting the API application - now reports three outcomes instead of two: restarted, requested but not confirmed, or failed. Previously anything that was not an outright failure was shown as a successful restart, including a restart that was only requested. This wording is shared with Master > Admin > Properties, so both pages say the same thing.
• Saving load balancing settings - if the Centralpoint Agent service cannot be restarted to pick up the new configuration, the operator is now told. Previously this went only to trace output, which is switched off on client servers, so the save reported success while the Agent carried on with its previous configuration.

• The whole server finished in 50 minutes, start to last index complete.
• The largest site, at 2.7 GB of indexed content, rebuilt in 6 minutes 27 seconds.
• Ordinary site search and Contextual Search returned identical result counts before and after on every site checked.

• Semantic - Document Keyphrases
• Semantic - Similar Documents
• Semantic - All Keyphrases Score in Content but not in Keywords
• How to create a Semantic Keywords Tag Cloud (Generic Enhanced A) including an EXCLUDE dictionary
• How to render a Semantic Keywords Tag Cloud - Against an Individual Record (Generic Enhanced A Only)

• Console navigation. The menu and breadcrumb depend on a licensing lookup against the central service. A single brief failure could break those on every console page until the application restarted.
• Administrator role checks. A brief database interruption could leave administrator permissions unresolvable for the whole application in the same way.

• Creating a web site from a backup under Master > Deployment > Web Sites had a one-hour limit. On a large site the domain-rewrite stage alone can exceed that, so the creation failed after the database and files were already in place. The limit is now five hours, and the rewrite stage itself was made substantially faster - it no longer scans every text column twice on sites whose new domain is longer than the old one.
• Retrying a sync method from the Server Hub had a ten-minute limit, while the same method run during a version install had two hours. A long database operation could therefore fail on retry and succeed on install, with nothing to explain the difference. Retries now get the same five-hour allowance as the other maintenance services.
• Streaming a video or large file from the console, opening the template gallery, and converting a document to PDF each had no explicit limit and fell back to a short default. All three now carry their own.

• A virtual directory that runs as its own IIS application has a separate web.config that the deployment does not touch, so it keeps the old, shorter limits. If that sub-application serves long-running requests - large downloads, document conversion, reporting - the same time limits must be applied to its own web.config by hand.
• Custom code with its own configuration is unaffected by the values themselves, but confirm the site still loads after the update if your configuration overrides the same settings; where it does, your value takes precedence and may still be too short.

• Resource.ashx, which streams files and video to the browser, now allows 1800 seconds
• Scripting/AsposeToImg.ashx, which renders a document thumbnail, now allows 600 seconds
• WebServices/Utilities.asmx on Master now allows 18000 seconds

• Development > Content Audit now names the specific configuration entry or audience that is missing, instead of failing with a generic error
• The Code File Manager no longer errors when opened with an unrecognized site in the address bar - it falls back to the current site
• Logging entries created without a results count no longer fail
• Trigger registrations are now cached in a form safe to read from concurrent requests, removing an intermittent failure under load

• The Centralpoint Agent's IIS repair now creates a site's missing /Api application, and corrects one that points at the wrong or a deleted application pool. Previously a site whose API was never mounted could report as healthy.
• The deployment engine's file copy step now honors the same exclusion list its cleanup step already used
• Master > Development > Sync Methods now keeps each site's local copy of sync-method history in step with the master record, so a site restored or copied from another server no longer inherits stale failures from its source
• Master > Content > Web Sites no longer reports a successful API application pool restart when the restart actually failed, and now names the pool in the error

• Long-running process cleanup now uses a recorded activity timestamp, so a process that is still working is no longer marked as abandoned during a quiet phase
• Static file references now carry an automatic version stamp, so browsers pick up updated files after a deployment instead of serving a cached copy
• A failure to reach Uber is now consistently classified as an infrastructure issue rather than being reported as an application error, and those calls are time-bounded
• Sign-in continues to work against the last known good signing key when the database is briefly unreachable, rather than failing outright

• Resource.ashx -> 1800, applied to each site's Root/Web.config and Console/Web.config
• Scripting/AsposeToImg.ashx -> 600, applied to each site's Root/Web.config
• WebServices/Utilities.asmx -> 18000, applied to the Master Root/Web.config only

• A document at /Uploads/Policies/charter.docx is cached at ...\Temp\AsposeWordViewer\Uploads\Policies\charter.html
• Resource-based documents are cached at ...\Temp\AsposeWordViewer\Resources\[resourceId].html

• A type class on every gadget, naming the kind of gadget, such as cp-gadget-rss or cp-gadget-html.
• An instance class where the gadget has an identity to key on. Preset gadgets use their record number, for example cp-gadget-6. Gadgets configured with a URL, meaning RSS and URL gadgets, use a simplified form of that URL, for example cp-gadget-rss-feeds-bbci-co-uk-news-rss-xml. These are the gadgets a user can add more than once, so the type alone would not tell them apart.

• SQL performance has been optimized when loading a dashboard. Dashboards containing preset gadgets now make considerably fewer database calls per page load, and the saving grows with the number of gadgets on the dashboard.
• Each dashboard module view now keeps its own default gadget list. Previously every dashboard on a site shared a single cached list, so whichever dashboard loaded first determined what the others showed. On a site with more than one dashboard, a user who has never customized their layout may now see a different, correct set of default gadgets. Users with a saved layout are unaffected.

• FileViewer and the Word viewer page
• PdfViewer and the PDF conversion handler
• Thumbnail and image generation
• Full-text search extraction (the ResourceContent attribute)
• Word document content attribute extraction
• FileOutput template documents

• The data synchronization will not delete content when another process is interfering with the working tables it uses. It stops with a clear message instead.
• A single file marked read-only no longer aborts an entire synchronization. The file is corrected automatically and the run continues.
• Recovering content no longer depends on the file copy finishing first. The database work runs even if the file phase fails, and All Elements no longer forces every file to be re-copied, so restoring content completes on large sites instead of timing out.
• Long file copies now report their progress, so a healthy run is no longer mistaken for a stalled one.

• Remove the semantic option from the site's full text indexed columns.
• Retire the semantic example Data Sources under Design > Data Sources. These are archived rather than deleted, so they remain retrievable.

• Virtual directories running as their own IIS application have a separate web.config that this deployment does not touch. If a sub-application calls Utilities.asmx, its cleanup still aborts at whatever ceiling its own config carries. Apply the same executionTimeout there by hand.
• The usual custom-code concern does not apply here: this changes a timeout value only, with no assembly, handler, or module changes, so nothing that loads today can fail to load after it.

• A stalled search index now recovers on its own. The health check previously treated any index reporting an active population as healthy and busy, so an index whose population had stopped progressing was skipped on every sync and cleanup indefinitely, and the site returned no search results with no error. It is now treated as stalled once it has run past a generous threshold with nothing indexed against a table that has rows, and repaired - releasing automatic change tracking first, because the database engine otherwise declines the stop request and the index stays stalled.

• Concurrent update installs are prevented. The pipeline uses one fixed working folder, and a finishing run removed it before stamping the version, so a second in-flight run lost its extracted package and failed reporting an incomplete update package. Installs are now serialized per installation and a second run declines cleanly.
• A reused backup is verified before it is trusted. A completion marker is written only after every file has copied, and the retry path requires it, so an interrupted backup is no longer treated as complete. Long file paths are handled throughout, including the marker itself.
• A leftover file that cannot be deleted no longer aborts an install after the file tree has already been replaced, which previously left a partially applied update.
• Removing a deployment target no longer fails with a database syntax error.

• The scheduled-tasks endpoint execution timeout is raised to 5 hours, so a pass on an installation with many sites no longer ends part-way. See the web.config note below.
• The webhook step that runs first on each pass now retries a transient database failure instead of reporting an error and skipping the pass. Only failures that fail immediately are retried; a command that already used its full time budget is not, since re-running it would hold the queue for the same result.
• The nightly cleanup task and the development build task now coordinate across the whole server rather than only within one application, closing a case where a restart between them allowed an overlap that left the cleanup hanging.

• The stale-process sweep now clears every orphan in one pass. A single failure previously ended the sweep, so a backlog cleared at roughly one per night.
• The error-reporting path itself is now tolerant of failure, so a problem while recording an error cannot interrupt whatever was reporting it.
• Failures reaching the central error-reporting service are classified correctly again, restoring the rate limiting they had lost.
• A.D.A.M. content-service failures are now reported instead of being written to a trace channel that is disabled outside development, where an outage produced an empty result that looked like a customer with no products.
• A request that is aborted mid-page - a timeout, a recycle, a visitor navigating away - is no longer reported as a Module Designer Results View failure against a correctly configured view.

• On AI Governance > AI Providers, the model row now labels itself by what its button actually does. It previously read Set as Generative Default on every provider, but only the provider card's button switches the active provider; on any other provider the model row records the model and leaves the active provider alone, while still reporting success. It now reads Use as this provider's model in that case, and the dialog and confirmation say so.
• On API > API Test Center, a failed Site Info call reports the real reason instead of a NullReferenceException. Where the API returns no message, which is normal for an authentication refusal, the card says so and names where to look.

• The SAML callback test page validates its return path at the source rather than trusting the query string, closing an open-redirect and a script-injection route, and its identity-provider lookup is now parameterised.
• An upload path is decoded before validation and its resolved location confirmed inside the site root before any file is written, closing a path-traversal route through an encoded value.

• The vector orphan cleanup is batched so the recurring reconcile sweep no longer times out on a large backlog.
• A signature form no longer fails when its temporary image cannot be removed. Pressing Start Over previously produced an unhandled error and lost the visitor's signature if the file was briefly held by another process. Also applied to the change-request approval flow.
• The website activity log no longer shares one buffer across request threads, and no longer drops entries when a flush coincides with a page write.
• A site's most recent backup date is now the newest backup rather than an arbitrary one.

• A virtual directory that runs as its own IIS application has a separate web.config that this deployment does not touch. If such a sub-application serves this endpoint or inherits configuration expectations from it, apply the same change by hand in that application's own web.config, or it keeps the old limit and the task can still end early there.
• A client-specific ` block for the same path will conflict. If your installation already defines its own , confirm after the sync that the effective executionTimeout` is the intended value and that your other attributes in that block survived.

• Word Add-In sign-in. After completing MFA, the Word Add-In sign-in now returns directly into the plug-in instead of landing on the site dashboard, so users no longer have to close the sign-in window by hand for the plug-in to load. The return destination is now carried through the identity-provider round trip via SAML RelayState, which survives the session loss that happens inside the Office sign-in dialog. Only the Word Add-In sign-in flow uses this; all other SAML logins are unchanged.
• Failed-SAML-login page (affects all SAML clients). The page shown after a failed SAML login now sends the user to the site home page (/) after a short delay, instead of refreshing the failure page in place. This is a side effect of hardening that page's automatic redirect against a cross-site-scripting / open-redirect issue. Successful logins are unaffected.

• Rendered output now matches the conversation's text size. Previously a data source rendered in a chat reply inherited the host page's base font size, so text-based output appeared noticeably larger than the surrounding conversation. This was not visible with charts, which contain no text.
• Eligibility scanning has been hardened. A source whose templates used the cpsys_Apos script-safe placeholder to wrap a request-context script - Querystring, cookie/session, or current-record scripts - previously passed the eligibility check and will now correctly show as Excluded. This closes a gap where such a script could run in the detached render. Any affected source will name the offending script in its exclusion reason in the AI Data Source Tuner. This applies to existing Chart (Advanced) sources as well as new Raw HTML ones.

• A document at /Uploads/Policies/charter.docx is cached at ...\Temp\AsposeWordViewer\Uploads\Policies\charter.html
• Resource-based documents are cached at ...\Temp\AsposeWordViewer\Resources\[resourceId].html

• My meetings signs in as a single user and imports the meetings that user organized.
• Cross-user modes (Pick users, All users, By department, By group) run organization-wide and import meetings organized by the selected users, using an application (org-wide) authorization plus a Microsoft Teams application access policy.

• Improved validation. The Upload & Data Limits fields are now validated when Save is clicked, so out-of-range or malformed entries are caught up front with a clear message under the field rather than being accepted.
• The change is checked before it is applied. Before the site's configuration is updated, the pending version is verified to be structurally valid and the Upload & Data Limits values are confirmed to load correctly. If anything is invalid, the save is aborted and the current configuration is left in place, so a bad entry can't leave the site unable to start.
• Automatic backup on every save. The current configuration is backed up immediately before each save (last-known-good) so a change can be undone in one step. Backups are kept under the site's Temp\Console_Settings folder, organized into per-application subfolders (Root for the Website, Console for the Console). If a backup can't be created, the save is aborted and nothing is changed.
• Applied to the Console application too. The Upload & Data Limits are now applied to the Console application's own configuration, not just the main site, through the same validate-backup-apply path. One save now covers both applications, so there is no hidden second edit to remember. Only the top-level settings are written, so the Console's per-page overrides are preserved. This matters because some controls are shared between the main site and the Console and rely on these settings (particularly Max JSON Length), so applying them in both keeps behavior consistent. A blank field removes the setting in both configurations, so the two stay in step.
• Execution Timeout guardrail. An Execution Timeout above 3600 seconds (1 hour) now requires the administrator to tick an acknowledgment checkbox before the save proceeds, because an over-high global timeout can hold a worker thread and risk exhausting the server's thread pool. The checkbox and its message appear as soon as a high value is entered (on leaving the field), and the save is blocked until the box is ticked. The acknowledgment is required again on each save that keeps a high value.
• Minimum values (floors). Each field is now floored at its framework/IIS default (Max JSON Length 2097152 bytes, Max Request Length 4096 KB, Execution Timeout 110 seconds, Max Allowed Content Length 30000000 bytes). Below-default values have no legitimate use from this page (blanking a field already yields the default) and a too-small Max Request Length or Max Allowed Content Length could reject the Settings save itself and lock the administrator out of the Console. Setting a value below a default still requires a manual web.config edit.
• New info callout. A notice above the Save button explains that the limits apply to both the Website and the Console, that the minimum values are the framework defaults, and that every save is automatically backed up (and where to find the backups).

• Architecture & Status - a layered diagram (Foundation, Data Preparation, AI Experiences) plus the related cross-cutting tools, with each capability badged by its current state (Configured, Partial, Off, or Available). It distinguishes the two ways AI reaches the assistants: answering directly from a provider versus retrieval from the vector index (RAG). Header chips summarize the site at a glance - whether AI Chat and Summarization are enabled, the default provider and embedding model, vector-index availability, and how many features are configured. Clicking any capability opens a help panel with why you go there, step-by-step setup instructions with the exact buttons to click, optional settings, prerequisites, and a link straight to that Console page; where relevant it shows a copyable sample configuration.
• Guided Setup - an ordered checklist for turning AI on, each step marked done / next / not-started against the site's live state, with a worked example, a link to the relevant page, and an advanced site-properties reference.

• Re-save or re-upload the document (this regenerates the PDF automatically), or
• Delete just that document's cached PDF on the server.

• Document: /Uploads/Public/Documents/Template/MyPolicy.docx
• Cached PDF: ...\Temp\AsposeToPdf\Uploads\Public\Documents\Template\MyPolicy.pdf

• Resolved a high-severity security advisory (GHSA-v5pm-xwqc-g5wc) in the API's OpenAPI documentation dependency by pinning the transitive Microsoft.OpenApi library to a patched version. This clears a build/security warning and does not change any API behavior or output.
• Brought several third-party libraries current to their latest patched versions (including Newtonsoft.Json) with no functional or visual change.
• Added internal deployment-engine support for applying web.config binding redirects as part of a patch. This is infrastructure only - it enables the follow-up update below to be delivered safely and has no effect on this release's behavior.

• Dapper (data access) - and Microsoft.Bcl.AsyncInterfaces, which it requires
• System.IdentityModel.Tokens.Jwt (JWT token handling) - and its System.Memory support libraries
• Humanizer (text formatting)
• Microsoft.Extensions.DependencyInjection
• System.Security.Cryptography.ProtectedData

• Microsoft.Bcl.AsyncInterfaces -> 10.0.0.9
• System.Memory -> 4.0.5.0, System.Buffers -> 4.0.5.0, System.Numerics.Vectors -> 4.1.6.0
• Humanizer -> 3.0.0.0
• Microsoft.Extensions.DependencyInjection and .Abstractions -> 10.0.0.9

• No false "Save successful." Previously, if the sign-in session had expired, clicking Save could still show a success message even though the document was not actually saved. The add-in now detects the expired session, does not report a false success, and prompts the user to sign in again before saving.
• Clearer messaging. When a lapsed session is detected, the add-in shows a plain "your session has expired, please sign in again" message instead of a confusing error or an add-in that appears stuck.
• Sign-in resilience behind single sign-on (SSO). The add-in recovers more gracefully from an expired session: it retries a failed load and, if needed, clears a stale sign-in so the next attempt starts clean (similar to the manual "Reset Add-in" step users rely on today). The sign-in dialog also retries once if the login redirect does not complete on the first attempt.
• First-attempt sign-in. A new SSO sign-in entry point helps sign-in complete on the first try for SSO-configured sites, instead of landing on the site home page.

• SSO / SAML login: users whose identity provider sends a role that does not map to any Centralpoint role can now sign in; this previously failed during login.
• Site search: very long search queries no longer produce an error (an internal capacity-calculation issue).
• Module results download: downloading a result set whose columns appear before the record identifier now completes instead of failing.
• Console custom attributes: a malformed or empty custom-attributes file no longer causes a module's Console page to error; it falls back to the base attributes.
• Data transfer: a supplied batch id and auto-number are now saved with a document upsert (they were previously dropped).
• Scheduled tasks: a transient configuration-service error during a scheduled run no longer aborts the run; it falls back to the site's local configuration.
• Update install: an incomplete update package now reports a clear, actionable message instead of a generic "path not found."
• Security, file cleanup (Development > Utilities): the upload-cleanup tool now rejects any entry that resolves outside the site's uploads directory, preventing directory traversal.
• API reliability: the API application folder's read permission for its application-pool identity is now set explicitly and re-applied during scheduled maintenance, preventing and self-healing the IIS 500.19 "cannot read configuration" class of API outages without a manual server fix.

• List Items rows (options defined on the destination attribute) render one option per line. For Attribute Switch attributes, such as the Data Cleaning Type on the HtmlCleaner module, options are sorted by their code and shown as Label = code with the fields each option reveals de-emphasized in gray, e.g. HTML Cleaner = 01 (cfrSearchFor, ...) through SQL Query = 07.
• Top 10 Items rows (options loaded from data, such as modules, audiences, taxonomy, and yes/no lists) also render one per line, with the more… link on its own line.
• The more… marker now appears only when more options than the ones shown actually exist.
• Option labels are HTML-encoded before display.

• The scheduled webhook processor no longer slows down or times out on sites with a large webhook request history. Its lookup now scales with the number of pending webhooks instead of the size of the entire request log.
• A new Webhook Request Retention property controls how many days webhook request and response log rows are kept (default 90). The most recent request per webhook is always retained, so the webhook Deliveries view still shows the latest delivery. Set it to 0 to remove all older rows on each clean up, or -1 to disable retention and keep full history.
• Two data-trigger retention windows that were previously fixed in code are now visible and adjustable here too: Data Trigger Retention (completed, error, cancelled, aborted rows, default 30) and Data Trigger False Condition Retention (false and invalid-condition rows, default 7). Same convention: 0 deletes all on each clean up, -1 disables.

• Installs with a configured mail server (not blank or localhost) now relay directly, using the server's port, SSL, and any credentials set in Admin > Settings.
• Installs with the Email Server left blank or set to localhost continue to use the previous local pickup behavior.
• Sites already using the Data Broadcast module's custom SMTP option are unaffected.

• A document at /Uploads/Policies/charter.docx is cached at ...\Temp\AsposeWordViewer\Uploads\Policies\charter.html
• Resource-based documents are cached at ...\Temp\AsposeWordViewer\Resources\[resourceId].html

• A summary strip shows counts by status: Running, Stale, Succeeded, Failed, and Orphaned.
• Each row shows the process type, site, user, relative start time, and duration. Running processes update live and their elapsed time ticks up.
• Status is determined automatically: a process actively reporting progress reads Running; one that has gone quiet recently reads Stale (it may still be running); one silent past the cutoff reads Orphaned (started but never reported finishing); completed ones read Succeeded or Failed.
• Clicking a row expands a step-by-step timeline of the process, with timing between steps and any reported errors. Simple formatting within step messages now renders correctly.
• Running processes that support it can be aborted from a confirmation dialog (administrators only).
• The list auto-refreshes (slowing automatically when nothing is running) and can be filtered by status tab, searched by type/user/site, and narrowed by process type.
• A built-in How this works panel explains each status, including the difference between Stale and Orphaned.
• On the client site Console the view is scoped to that site's processes; on the Master it shows all sites.

• Local (on-prem) models: the CPU model catalog has been expanded with additional options, and the default local model for new installations is now qwen3-4b - a stronger choice for grounded chat and summarization than the previous default. Existing sites keep their currently configured model.
• OpenAI models: the catalog has been refreshed to match OpenAI's current lineup. The latest GPT-5 family models were added, several older models are now flagged Legacy, and the deprecated dated GPT-5 snapshots display a notice that API access ends December 10, 2026 along with the recommended replacement model. The default OpenAI model for new installations is now gpt-5-chat-latest. Existing sites are unaffected.

• Use Knowledge Base (RAG) - off by default; turn on to let the assistant search AI-indexed module records. Turning it on reveals the options below.
• Use Page Content - on by default; keep the current page as the primary source, or turn it off to make the assistant answer purely from the knowledge base (an on-page Knowledge Assistant).
• Knowledge Base Modules - choose which AI-indexed modules to search, or leave it on All Vector Modules. The list shows one entry per module using its display alias.
• Knowledge Base Results (Top N) and Knowledge Base Similarity Threshold - tune how many records are retrieved and how closely they must match.
• Show References - show or hide the list of source records used in an answer.
• References Template (Template mode only) - customize how each reference renders.

• Large transaction log files that previously stayed oversized are now reduced. The routine makes several passes so that even multi-gigabyte logs are brought down toward 1 GB.
• Error notifications are no longer raised for logs that have already shrunk to their healthy minimum. Previously a notification was sent whenever a log settled slightly above 1 GB even though shrinking had succeeded. A notification is now only sent when a log genuinely remains oversized after maintenance completes.

• Search - a hero question box returns ranked record cards with similarity scores, a threshold slider, a sort dropdown, and a per-result "Why this match?" disclosure that reveals the exact text the AI matched on. Results can be summarized into a single AI-generated digest or exported to JSON or CSV.
• Chat - a streaming conversational view that answers questions with citations to the underlying records. Each reply shows source-reference cards linking directly to the Console record. The history sidebar resumes prior conversations with citations intact.

• Generative Models — LLamaSharp and OpenAI chat and summarization models, each with a "Set as Generative Default" action.
• Embedding Models — new section for vector-producing models with their dimensions shown as badges (384d, 768d, 1536d) and a "Set as Embedding Default" action. Available models include all-MiniLM-L6-v2 (ONNX, fast local), nomic-embed-text (LLamaSharp, higher quality local), and text-embedding-3-small (OpenAI, cloud-based, requires API key).

• Prefix - Text to prepend to filenames (for uniqueness across modules)
• Replace Text - Text or regex pattern to find in the filename
• Replace With - Replacement text (leave empty to remove matches)
• Replace Text: Regex Enabled - Enable regular expression matching

• The API endpoint map (window.cpsys.Api.Endpoints) and user metadata (window.cpsys.User) are now only rendered for authenticated users. Anonymous/public pages no longer expose this information.
• The JWT bearer token is now delivered via an HttpOnly session cookie (cp-api-session) instead of being embedded in the page source. The token is invisible to JavaScript, page source viewing, and security scanners.
• The API middleware now accepts authentication from either the Authorization: Bearer header or the cp-api-session HttpOnly cookie.
• All platform JavaScript (AI Page Assistant, AI Summarization, CpApiManager, Uber error handling) has been updated with hardcoded endpoint path fallbacks so they continue to work without the endpoint map on public pages.
• The token refresh handler now also updates the HttpOnly cookie when refreshing a token.

• Hardcode the endpoint path directly (e.g., replace cpsys.Api.Endpoints.AI.SummarizeText with '/ai/summarize/text'). The paths are stable and documented in the API documentation.
• Use cpApiManager methods with hardcoded paths - cpApiManager.post('/ai/summarize/text', data) works the same way.
• On authenticated pages (Console, logged-in member areas), cpsys.Api.Endpoints continues to work as before.

• requestValidationMode="4.5" on the httpRuntime element - enables lazy request validation (forced on, upgrades legacy 2.0 values)
• enableVersionHeader="false" on the httpRuntime element - suppresses the X-AspNet-Version HTTP response header
• Removes the X-Powered-By response header
• Adds X-Content-Type-Options: nosniff response header - prevents MIME-type sniffing attacks
• Adds X-Frame-Options: SAMEORIGIN response header (only if not already set) - prevents clickjacking

• Always On option: A new Always On field has been added to the web site creation form. When set to Yes, the new site's IIS application pool is configured with AlwaysRunning start mode, preload enabled, and idle timeout disabled. This eliminates cold-start delays by keeping the worker process alive and warm at all times. The option defaults to No, and it is recommended to enable it for only one production site per server to avoid unnecessary memory consumption.
• Domain URL rewrite on deployment: New optional Old Domain and New Domain fields allow automatic domain replacement during site creation. When provided, all URLs in the site's database content are rewritten from the old domain to the new domain, including content in data records, audiences, and relation tables. This is useful when deploying a site backup from one server to another with a different domain. The rewrite supports a 45-minute SQL timeout and 1-hour request timeout to handle large databases.
• Automatic cleanup after site creation: A full site cleanup now runs automatically after every site creation, including file system permissions, orphaned file cleanup, and other maintenance tasks. This eliminates the need to manually run Master > Admin > Utilities > Clean Up after deploying a site.