• Ensures internationalization and localization configuration is picked up (#1128)
• Updates libraries (#1096, #1130, #1131, #1132, #1133, #1134, #1135, #1136, #1137, #1094, #1103, #1141)
• Removes unused gradle "maven publish" plugin (#1127)
• Ensures CAS tickets gets passed server name (#1138)
• Ensures that PersonFactory can source properties from uPortal.properties (#1142)
• Ensures the css flex layout will display correctly on extra extra small screens (#1143)
• Correctly clear groups cache on login (#1144)

This is a milestone release (pre-release) of uPortal 5.1.0.

This is another patch release (maintenance update) for uPortal 5.0. It includes a few fixes & improvements.

Change Log

• Add Swagger for REST API documentation and tooling
• Refactor IPersonManager implementations slightly to avoid unnecessary bean tweaking to enable RemoteUserPersonManager
• Updated versions of several Java dependencies: AWS SDK, staxmate, jjwt, jgroups, jackson, javax mail, Apereo Portlet Utils, Apache httpclient, Apache Commons libraries, aspectjrt, Ant, joodatime, Groovy, and Google Guava
• Add documentation for REMOTE_USER AuthN to the uP5 manual
• Updated documentation in French 🇫🇷

There is additional detail in the JIRA Release Notes.

This update should be safe to apply to any uPortal 5.0.x implementation.

Thanks to everyone who contributed!

This is another patch release (maintenance update) for uPortal 5.0. It includes a few fixes & improvements.

Change Log

• Made changes to the way uPortal creates the JGROUPSPING database table for JGroups support in order to minimize the number of orphaned records that accumulate there; orphaned records on that table cause a delay whenever a uPortal JVM is launched (either Tomcat or by the CLI); the new method of creating this table integrates it with the dataInit Gradle task, so any dataInit or portalInit will reset the table.
• Improved the searchForGroups implementation within RDBMEntityGroupStore so that it performs a case-insensitive search only when necessary, which is seldom; the case-insensitive search SQL had been flagged by monitoring tools as a slow-running SQL statement.
• Added documentation in French

There is additional detail in the JIRA Release Notes.

This update should be safe to apply to any uPortal 5.0.x implementation.

Thanks to everyone who contributed!

This is another patch release (maintenance update) for uPortal 5.0. It includes a handful of fixes & improvements.

Update Notes

New BROWSE Permissions

To fix a bug where unpublished portlets (Expired, Approved, etc.) were visible to users in the Customize Drawer & search ui, three new activities (permissions) were added to the UP_PORTLET_SUBSCRIBE permission owner.

These are the ones:

<activity>
    <name>Browse Approved</name>
    <fname>BROWSE_APPROVED</fname>
    <desc>Browse uPortal content that is approved, but not yet published</desc>
    <targetProvider>channelsAndCategoriesTargetProvider</targetProvider>
</activity>
<activity>
    <name>Browse Created</name>
    <fname>BROWSE_CREATED</fname>
    <desc>Browse to uPortal content that has not yet been approved or published</desc>
    <targetProvider>channelsAndCategoriesTargetProvider</targetProvider>
</activity>
<activity>
    <name>Browse Expired</name>
    <fname>BROWSE_EXPIRED</fname>
    <desc>View expired uPortal content in the Marketplace</desc>
    <targetProvider>channelsAndCategoriesTargetProvider</targetProvider>
</activity>

These activities should be included in the UP_PORTLET_SUBSCRIBE.permission-owner.xml file (in uPortal-start) and the file should be re-imported. These changes will be made to the master branch in the Apereo uPortal-start repo shortly (in a few minutes), so you can obtain them there.

With these changes in place, you can import the file with this command:

$ ./gradlew dataImport -Dfile=data/base/permission_owner/UP_PORTLET_SUBSCRIBE.permission-owner.xml

Change Log

• Fixed a bug in how BROWSE permission is handled with unpublished portlets (Expired, etc.) by implementing additional BROWSE_* permissions based on life cycle state in the manner that SUBSCRIBE already handles them (see the Update Notes section)
• Handled missing activity data in permissions checking more gracefully (see the Update Notes section)
• Improved performance of query.getResultList() in JPA PortletDefinitionImpl (FYI this change makes a MASSIVE difference)
• Fixed a regression in the Portlet Admin tool where newly selected principals no longer received BROWSE & SUBSCRIBE permissions by default
• Fixed a display issue with no-chrome portlets that have DLM restrictions applied
• Added CSS classes to the elements surrounding portlet chrome options to make them easier to style
• Added a SimplePredicate class to uPortal-rendering/src/main/java/org/apereo/portal/rendering/predicates that's easy to configure in Spring

There is additional detail in the JIRA Release Notes.

This update should be safe to apply to any uPortal 5.0.x implementation (though we recommend the data adjustment in the Update Notes section).

Thanks to everyone who contributed!

This is another patch release (maintenance update) for uPortal 5.0. It includes a handful of fixes & improvements:

• Fix an issue where StylesheetUserPreferences (Structure & Theme) were not reset when a user's layout was reset
• Add Bootstrap CSS classes to the empty Favorites view as appropriate
• Fix missing aria attributes in the Favorites portlet and allow direct delete (w/o Edit mode)
• Add missing WebAppNameContainsStringPredicate, developed by UW Madison
• Fix a couple missing ARIA attributes in navigation.xsl and regions.xsl
• Enhance (and simplify) the columns.xsl structure transform to make attributes on columns a 'pass through' (like attributes on tabs)
• Fix HTTP 500 error from layout code removing marker node
• Move jstree css import from custom skin xml to common skin xml and obtain it from a webjar

There is additional detail in the JIRA Release Notes.

This update should be safe to apply to any uPortal 5.0.x implementation.

Thanks to everyone who contributed!

This is a patch release (maintenance update) for uPortal 5.0. It includes a handful of fixes & improvements:

• Improvements to the JGroups integration for expiration caching
• Static Analysis of Groovy using CodeNarc
• Fix a bug in the Reset User Layout feature
• Add unit tests for the org.apereo.portal.api.portlet and org.apereo.portal.api.groups packages
• Fix configuration of BranchingRenderingPipeline on uP5
• Enable static analysis and stylechecking as part of test process
• Update NodeJS version (used in the build process) to 8.8.1
• Update gradle plugins com.gradle.build-scan, com.github.kt3k.coveralls, net.researchgate.release and net.ltgt.errorprone to latest versions
• Make CORS domain and method checks case-insensitive
• Update gradle wrapper to version 4.3.0
• Fix a bug involving CORS and portlet ActionURLs

This update should be safe to apply to any uPortal 5.0.x implementation.

Thanks to everyone who contributed!

Brings some Security and Accessibility fixes backported from uPortal 5.

For a full list of changes see https://github.com/Jasig/uPortal/compare/uportal-4.3.1...uportal-4.3.2

Release Notes

The uPortal Community and the uPortal Steering Committee are proud to announce the release of uPortal 5.0.0! uPortal 5 is the newest major version of uPortal: the leading open source enterprise portal framework built by and for higher education institutions, K-12 schools, and research communities.

uPortal 5 offers many significant improvements over previous versions. In preparing this release, uPortal developers completed well over 200 issue tickets! (View the full list of completed tickets in JIRA.) Perhaps a majority of these improvements impact how uPortal is adopted, implemented, configured, assembled, and deployed. uPortal 5 provides the same power and flexibility you’ve come to expect, but brings major improvements in how you work with it. It’s now much easier, more modern, and much less effort intensive.

Contributors

Twenty (20!) individual authors -- representing 8 different organizations -- contributed code, documentation, and/or artwork toward this release. The uPortal Community would like to extend an enormous “Thank You!” to this amazing team and a sincere “Congratulations!” on this terrific release. (View the complete list of contributors in GitHub.)

High-Level Summary of Changes

This list presents the changes in uPortal 5 at a thematic level. It’s short, easy to digest, and should give you a general sense of what you stand to gain by adopting uPortal 5.

• Several significant improvements to ease of adoption and administration of the portal
  • Introducing uPortal-start: a new, easy-to-navigate repository for managing your implementation
  • Much simpler, much faster setup process
  • New build tools (based on Gradle) that are more flexible, more reliable, and significantly faster!
  • More powerful database management tools
  • A new, easy-to-use skinning process
  • Package once, run anywhere -- configure deployment-specific settings without rebuilding!
  • Much simpler patching (upgrading) process
• WCAG 2.0 Level AA Accessibility!
• More & better security features
• Soffits -- a new standard for pluggable content
• Much better support for container- and/or cloud-based deployments

Notes for Upgraders

This list is especially important for those planning to migrate from earlier versions of uPortal. As more potential snags are uncovered, we will add them here. (You might want to re-check this list from time to time.)

• The pre-header region was renamed: the new name is eyebrow. If you have existing fragment layouts that you wish to use in uPortal 5, you will need to check for content in the pre-header region and (manually) change the name to eyebrow.

Detailed Change List

The following lists present a (mostly) comprehensive catalog of changes in uPortal 5.

Gradle-Based Build System

• Replace Ant/Maven with a Gradle-based build system for uPortal
• Decompose sources in uportal-war into Gradle-based submodules
• Replace Ant/Maven-based shell tools with Gradle-based shell tools
• Provide Gradle tasks for starting & stopping the provided HSQLDB on local deployments
• Add hsqlOpen task to uPortal-start
• Provide a Gradle task to download and setup the Tomcat container, as well as tasks to start and stop Tomcat
• Add portalOpen task to uPortal-start
• Add Error Prone Compiler for additional validations
• Add Findbugs tool as part of the test script
• Add RemarkLint tool as part of test script
• Add Stylelint tool to test script
• Add gitattributes to better handle Windows

Updates to Dependencies

• Support Tomcat 8
• Add Java 8 Code Coverage Support
• Upgrade the JGroups dependency due to a published security vulnerability
• Update CalendarPortlet to version 2.3.5
• Update NewsReader portlet to version 4.2.2
• Update Announcements portlet to 2.2.3
• Bundle the Apereo FeedbackPortlet in uPortal-start
• Upgrade the person-directory dependency to version 1.8.5 and refactor to support uP5-style configuration better
• Update to Spring Framework v. 4.3.11.RELEASE
• Update Spring Security to v. 4.2.3.RELEASE
• Update Jackson to v. 2.5.3
• Updating jquery to version 1.11.0 and backbone to version 1.3.3
• Upgrade from Font Awesome 4.0.3 to 4.7.0
• Extract Bootstrap Less from uPortal Source
• Update portlet overlay dependencies to include Hibernate3 DTD

User Interface Improvements

• Add more & better mobile icons
• Allow access to CONFIG mode to be managed directly in the Portlet Manager
• Add offcanvas stickynav flyout
• Add an icon next to every item in the Favorites portlet
• Use AlternativeMaximizedLink within SiteMap for portlet that define one
• Increase size of flyout toggle button
• Add a lock icon ('fa fa-lock') to the portlet chrome of portlets that may not be moved due to DLM restrictions
• Convert Admin tools portlet into app launchers
• Handle text overflow in portlet title
• Support applying filters to page background images
• Add signin, create user, and sign out icons
• Add language to Register New Portlet portlet selection UI advising of behavior when portlet web application fails to start

Implement WCAG 2.0 Level AA Accessibility

• Perform an Accessibility Audit based on WCAG 2.0 Level AA and remediate issues uncovered
• Links have insufficient contrast for WCAG 2.0 AA
• Ensure inputs have a valid label - Permissions Manager Portlet - WCAG 2 AA
• Add / Restore "Skip to page content" button in the portal header
• Import export portlet, label without associated id
• Label inputs for Password Manager Portlet
• Directory portlet input elements missing label
• Label inputs in User Administration Portlet
• Increase Contrast of footer text to meet WCAG 2 AA Standard
• Label inputs - most popular apps portlet - WCAG 2 AAA
• Ensure IDs are unique in Fragment Audit portlet - WCAG 2 AA
• Form missing submit button on import export portlet - WCAG 2 AA
• Add alt text to Background Preference portlet thumbnails
• Improve ADA for Marketplace
• Add Accessibility statement to uPortal 5.0 manual

Security Features

• Make Favorites permissions-governed
• Add integration support for new CAS ClearPass attribute passing
• Allow setting Cookie always secure from portal.properties
• Disable Proxy CAS support for portlets by default
• Add CORS Filter
• Shift CSRF Prevention to baked-in capabilities of Spring Security
• Provide a new permission governing access to one's own user attributes
• CAS AuthN: Prevent uPortal from requiring a CAS PGT by default

REST APIs

• Add a rest service for authorized users to see all ratings for a specified portlet
• Add simple RESTful search API endpoint and update/enhance the search results UI
• Add a REST endpoint for the current user details
• API calls for DLM manipulation often fail silently

Configuration Enhancements

• Add support for encrypted values to the property files within primaryPropertyPlaceholderConfigurer
• Support differentiation between server.home and server.base
• Externalize DB and LDAP pool settings
• Overhaul system of properties files that override baked-in values in uPortal 5
• Access settings defined in security.properties EXCLUSIVELY through the String Environment
• Set "use flyout menu" from configuration files in respondr
• References to 'CATALINA_HOME' should be updated to 'catalina.base'
• Attempt to prevent absence of 'username' and 'displayName' attributes in collections from Person Directory
• Provide more sensible defaults for the portlet rendering thread pool
• Provide sensible defaults for the org.apereo.services.persondir.USER_INFO.merged
• Re-tune cache settings for groups & permissions in the portal

Miscellaneous Improvements

• Add support for Soffits (new type of content) to uPortal
• Soffits -- Provide an annotation-based mechanism for soffits based on the SoffitRendererController to inject model attributes
• Overhaul of data model and supporting code for portlet lifecycle in uP5
• Rename the 'pre-header' region to 'eyebrow' for uP 5
• Provide some additional PagsTester classes developed by ESUP
• Add support for multiple guest users (who may have different content)
• Add ability to write dynamic skin css file to AWS S3 bucket
• Refactor GaP to make it clearer and more maintainable
• Wrap JGroups JDBC_PING with decorator that knows which SQL to use based on db dialect
• Report on caches in poor condition
• Improve Code Test Coverage Metrics
• Add several new unit tests

Bug Fixes

• Export fails for portlet in MAINTENANCE life cycle state when there is no expiration date set
• Make changes in uPortal-api-rest module to avoid NullPointerException
• Fix a regression in the Groups Selector stemming from PortalPreAuthenticatedProcessingFilter
• Manage Users data grid displays error when username or displayname is null
• the new mobile nav doesn't have the right background-color
• PORLTET_DEF_ID column name typo
• Description missing for Import Export Portlet in search results
• Bugs in DLM restrictions enforcement
• layout.json call fails with HTTP 500 for tenant admin user after deleting a portlet that is on one of their layouts
• Subclasses of o.j.p.g.pags.testers.IntegerTester don't handle non-String values
• IE 11 and previous browsers: The space created for the "responsive left nav" does not disappear when desktop users change window size if the menu is open
• Desktop Nav is missing in IE 11 and previous version.
• Fix alt max link to be spelled correctly
• Ensure "Portlet Administration" search is properly labelled
• Sticky header is not responsive at 768px screen width
• Arguments are passed in the wrong order to PortalPermissionEvaluator.hasPermission() using Spring Security within PermissionsRESTController and PrincipalsRESTController
• Respondr defaultSkin -- Fix left padding on larger displays
• Mobile menu issues on 4.2.x and 4.3.x at certain precise resolutions
• Inner class o.j.p.groups.pags.dao.EntityPersonAttributesGroupStore$MembershipCacheKey should implement Serializable
• Background Preference Portlet does not update background
• Cache entries that establish a user's group affiliations are not invalidated when that user authenticates
• Stabilize Flaky InjectAttributeRegexTesterTest
• use of @Lob annotation results in Postgresql using large objects, with rows getting orphaned
• Once favorited, the Favorites portlet continues to list portlets even when a user no longer has permission to view them
• Hyperlinks in the Favorites portlet fail to honor the alternativeMaximizedLink parameter when configured
• AnyUnblockedGrantPermissionPolicy does not properly leverage the UsernameTaggedCacheEntryPurger to clear permissions evaluations when a user re-authenticates
• Customize gallery covers portlet drag and drop area
• Restore the LoginPortletHelper bean, which was overlooked when context:component-scan was refactored
• Unescaped double quotes in layout.json break uMobile
• Fix a race condition in HibernateStyleCounterStore that may cause issues after initdb
• Ant db-update fails for HSQLDB
• Performance issues with the 'Create Ad Hoc group' interface within entity-selector
• Possible memory leak in DLM causing hundreds of millions of NodiInfo objects
• Issues with messages embedded in Javascript stemming from the fact that we don't escape them
• Ant deluser fails with poor error message when user does not exist
• Portlet worker threads use same SpringSecurityContext as its HTTP thread
• Notification Portlet overlay missing DB driver reference
• Missing JSR-286 portlet spec CSS
• Prevent a missing EntityType class from crashing the whole portal (log an ERROR instead)
• Provide better handling for 'bad data' in category memberships
• Include Bootstrap sources in the uPortal.war package so that uPortal-start can compile skins and so that the dynamic-respondr-skin portlet can function properly

Introducing the first Release Candidate (RC) build of uPortal 5! The full release of uPortal 5 is expected next week.

Here are the important changes since the previous most recent build (M10):

• Accessibility fixes for the Marketplace portlet
• Prevent uPortal from requiring a CAS PGT (with CAS AuthN) in all cases, even when Proxy CAS is not in use
• Provide the CAS AuthenticationFilter for (optionally) redirecting unauthenticated users to CAS
• Provide and configure a CORS filter that can deny risky cross-domain requests
• Shift CSRF Prevention to baked-in capabilities of Spring Security
• Rename the pre-header region (Respondr) to eyebrow (REQUIRES MINOR DATA CHANGE!)
• Fixed a regression in the Groups Selector owing to a permissions issue in a REST API
• Fix a regression in the dynamic-respondr-skin portlet stemming from LESS refactoring
• Remove the "Subscribed Fragments" feature

Milestone 10 brings a full upgrade to Spring 4, a new search results API and UI, as well as performance improvements to Gradle build.

Milestone 9 brings fixes to jGroups configuration, allowing use with PostgresSQL, and decreasing time to join a cluster.

Milestone 8 moves the less variables stylesheet to common, simplifying skinning process.

Milestone 7 allows the CONFIGURE permission to be modified from the portlet manager, allows configuring the database from Spring properties, and new provides more generous default caching settings.

Milestone 6 brings improved default caching configuration, and fixes to jGroups that allow use with MS SQL server.
In addition the bundled portlets have been updated bringing improved database configuration.

Milestone 5 adds a graceful fallback mechanism that attempts to generate a displayName and username for a person if those values are not provided.

Issues with missing displayName and username have historically been among the most common troubleshooting topics on the uportal-user list.

Milestone 4 brings support for adding a uPortal skin from uPortal-start.

Summary

Version 4.3.1 is a maintenance release of uPortal 4.3. It has been six months since the release of 4.3.0, and there are a large number of updates. In total, 32 JIRA tickets are resolved in this release. The vast majority of these are bug fixes, tasks, and modest improvements to existing features.

Addresses CVE-2016-1000257 (an open redirect vulnerability).

Highlights

• 14 Bugs
• 8 Improvements
• 3 Tasks

Version 4.3.0 is the newest minor release of uPortal, and it is the product of a significant amount of brand new work. A total of 122 JIRA issues resolved or closed for this release, including 96 that are not a part of the 4.2.2 (or any other) release. If I had to sum up this release in one word, it would be this one: "Polish." uPortal 4.3.0 brings a large number of performance enhancements, improvements to user experience, and bug fixes. uPortal 4.3 also includes support for Java 8 & Tomcat 8.

Highlights

• Support for Java 8
• Support for Tomcat 8
• Addresses a potential security vulnerability (https://issues.jasig.org/browse/UP-4643)
• Ability to manage BROWSE permission in the Portlet Manager
• Performance fixes & improvements for permissions evaluation & JPA PAGS
• Numerous improvements to the Tenant Manager
• Portlet Marketplace improvements
• New & updated REST APIs
• Ad hoc PAGS groups (based on membership/non-membership in other groups)
• Fixes & improvements to Respondr
• Updates to "Hover" Chrome (options for no-chrome portlets)
• New menu for small displays, plus optional "flyout" menues (like Universality offered)
• Allow fragment owners to manage fragment layouts regardless of restrictions
• Update Bootstrap to version 3.3.5
• Version updates to the bundled CAS and several bundled portlets

This version of uPortal is a maintenance/bug-fix release of the 4.2 minor version. It includes 40 bug fixes and improvements in total, which is a substantial number. There are some very important performance improvements included with this release. (There are even more in the 4.3.0 release, which is intended to be available in the same time frame as this release.)

Detailed Release Notes