6.0 Changelog

This fixes null mapped one-to-one field on an entity loaded from L2 cache.

Update meta field labels so that they can be used in grid customization.

In a details-view, the form view can be closed on demand or if there is no selected line. When we delete a line in the grid, the record in the form is no more displayed.

This also fix duplicated requests, missing onLoad/onNew calls in some conditions and reset attrs states on form view.

Fixes application that can become unresponsive after clicking on a button on a form view while having uncommitted editable grids.

Fix adding duplicate dotted field in grid customization when it exists both in view and search filters.

When the server is running on UTC- timezone, date could be converted back by one day.

In the case of boolean fields with operator false, filter was transformed in order to check for null or false. But by doing that, original criteria was lost, breaking meta filter saving. Replaced client-side operators true and false by new virtual operators $isTrue and $isFalse which perform client-side transformation.

Some clients, ie AzureAd2Client, use path based callback url (/callback/AzureAd2Client) instead of default query based callback url (/callback?client_name=AzureAd2Client).

When a property exists in the configuration and the client, try to set both.

For example, scope exists in both GenericOAuth20Client and OAuthConfiguration.

Applying client-side operators was done on search only. Now, it is also done on exports and mass updates.

Issue happened when setting $-prefixed dummy fields from onNew and record has some default values.

This fixes retrieving user profile picture from Azure Active Directory, where sending the access token is required.

This allow to save a record that contain default values (generally coming from domain definition) when calling save action. This behavior will be same as the toolbar save button behavior.

This fixes setting GenericOAuth20Client.profileAttrs. Issue happened when there was no getter.

Introduce new config api.pagination.max-per-page :

This config is used globally in UI to limit and set the maximum number of items displayed per page. -1 means unlimited (default value). This will block users who try to get a high number of records. Fetch a too large dataset can result in some high server side load.

Add minor fields tracking UI improvements :

Example:

If application has any bound RequestScoped classes, it will cause the database task to fail to install AppModule with "No scope is bound to com.google.inject.servlet.RequestScoped." error.

Apply the same context behavior as other dashlets, ie. merge action-view context with current record context.

Instead of domain, use criteria (as it is done for calendars) for the columnBy filter, as to avoid conflict with current record context.

This fixes action iconsistencies between changing number value via manual input and spinner.

This fixes popup closing when pressing escape in editable grid.

The user-info-form view can be bypassed if we refresh the browser tab after clicking on mail thread creator. The view is now opened in popup. If no view is defined, nothing is opened (no more fallback on user-form).

For example:

In a popup containing an editable grid, the line being edited was not committed if we directly close the popup via the "OK" button without clicking on "Confirm" in the editable grid.

Some mail message endpoints has been reworked to use dedicated path. This avoid to give permission to MailMessage or MailFlag objects in order to access the mail menus and deal with messages and flags. MailMessage action-view is now always allowed in order to open mail views.

Update format from file (1).txt to file-1.txt. This avoids necessary space in file name.

Sanitize uploaded filenames :

In the case of string fields with operators isNull and notNull, filter was transformed in order to check for null or empty. But by doing that, original criteria was lost, breaking meta filter saving.

Instead, use new virtual operators $isEmpty and $notEmpty which perform client-side transformation.

The attribute _domainAction is needed to reevaluate the context server-side.

Preventing password pasting undermines good security policy. https://web.dev/password-inputs-can-be-pasted-into/?utm_source=lighthouse&utm_medium=devtools

onAction and onClick should have context just like onInit.

Fix grouping by custom field defined on JSON field other than default attrs.

The attribute _domainAction is needed to reevaluate the context server-side.

hidden attribute on built-in toolbar buttons wasn’t taken into account for archive/attach/log buttons.

For example:

Due to reserved words added in recent versions of supported databases, change columns name groups and menus to respectively group_id and meta_menu_id in the join tables name meta_menu_groups and meta_view_groups.

Use these SQL statements to upgrade existing database :

The search engine view has been improved. It allows to implement recursive filters for more flexibility on the search condition, but also:

Breakings changes:

The default admins group is now marked as technicalStaff. The default mail.fetcher job is no more active by default.

Formatting of numbers, dates, and currencies used to be based on browser locale only. Now, formatting is done preferably according to the user language. If the user language has no country information, we select the first browser locale that matches the user language.

The internal configuration file application.properties is renamed to axelor-config.properties

https://docs.oracle.com/en/java/javase/11/migrate/index.html#JSMIG-GUID-7744EF96-5899-4FB2-B34E-86D49B2E89B6

Ehcache2 second-level cache is deprecated since Hibernate 5.3. Use jcache in combination with Caffeine by default as second-level cache.

Adding buttons on chart menu was working using the following syntax : <config name="onAction" value="some-action"/>

This syntax has been updated to the following :

This allows to support more than 1 button on chart menu, but also provide a flexible usage of the feature.

This add support new SCRAM-SHA-256 password encryption method which is now the default password encryption method is PostgreSQL 14.

Jdbc also introduce a change about Timestamp rouding : 2018-06-03T23:59:59.999999999 is rounded to 2018-06-04 00:00:00 (previously it was rounded to 2022-03-08 23:59:59.999). This new behavior follow psql’s suit. Especially if you work with Datetime/Timestamp having LocalTime.MAX as time, make sure to adjust your query.

A lot of configurations names has been updated to have better and uniform naming across all settings. Refer to migration notes.

Indirect basic auth allows to log in on callback, while direct basic auth requires credentials in each request.

auth.local.basic.auth.enabled, which was for direct basic auth only, is removed.

Most notably, positional parameters for native queries are now one-based.

PreRequest/PostRequest events are now fired outside of transactions. This fixes accessing the created/update records in a multithreaded process from PostRequest observers. However you can no longer rollback the request process in a PostRequest observer.

Dropped old code generator written in Groovy in favor of a new code generator written in Java.

Beware of breaking changes. See release note for more details :

Now there is only a single com.axelor.app plugin. All modules should use the app plugin only.

Now all axelor modules are axelor apps.

This can be changed on <gantt> view definition using the mode attribute.

The nashorn script engine is deprecated in JDK-11 and has some incompatible changes than JDK-8.

The new implementation uses GraalJS which supports latest ECMAScript features.

The collection helpers listOf, setOf and mapOf are removed as corresponding native JavaScript objects are passed with appropriate Java equivalent wrapper to the Java calls.

Use a more generic method name, because users may override and use custom behavior.

Reflection is now used to configure authentication clients. The new syntax is auth.provider.<providerName>.<configurationName>. You may use any of the built-in providers: google, facebook, github, azure, keycloak, apple, oauth, oidc, saml, cas. Or you can configure any other clients supported by pac4j using your own custom provider name. You may even create and use your own custom authentication clients.

This allow to add more customization on modal/notification :

Example usage:

or with ActionResponse:

No more need to install Node.js locally to build web resource bundles, aka npm-build task.

If your project already depends on gradle-node-plugin, there will be conflicts between both. As the provided plugin is only applied on root project, the best fit is to delegate the process to a subproject. That way, the subproject can process and build your needs, and the root project can depends on that subproject and gets produced build.

To use it, you need to Declare Node.js repository in settings.gradle, section dependencyResolutionManagement :

See https://github.com/node-gradle/gradle-node-plugin/blob/3.1.1/docs/faq.md#is-this-plugin-compatible-with-centralized-repositories-declaration

Secrets defined in axelor-config.properties can be encrypted. Value should be wrapped in ENC() to indicate that the value is encrypted : db.default.password = ENC(<some_thing>)

To use encrypted secrets, config.encryptor.password properties should be added : this is the secret key used to encrypt/decrypt data.

Others optional properties can be added to use custom encryption : config.encryptor.algorithm, config.encryptor.key-obtention-iterations, config.encryptor.provider-name, config.encryptor.provider-class-name, config.encryptor.salt-generator-classname, config.encryptor.iv-generator-classname, and config.encryptor.string-output-type. The default algorithm is PBEWITHHMACSHA512ANDAES_256.

For convenience, a Gradle task encryptText have been added to generate the encrypted value of a string : ./gradlew :encryptText --text="A secret to encode" --password="MySecureKey" This will generate for you, the necessary properties and the encrypted value to used inside ENC().

Because of multisource application settings, settings order is undefined. Use auth.order if you require authentication providers to be displayed in a specific order on login page.

Two new attributes added to validate data being imported.

If check fails, the check-message or default validation message is shown and import will be terminated.

Gantt view attribute mode allows to define the default view mode. It can be set to year, month, week, or day.

Instead of sanitizing all jQuery.html calls, use DOMPurify to sanitize HTML where it is needed only. This should reduce scripting load in the web client.

This is a refactoring on how menus and tags are processing. The original way was complex and mixing tags and menus rules in a single method. There is no changes on how it works.

Now, menus and tags processing are separate. Moreover, instead of parsing each menu one by one (but also recursively checking parent access), it builds a tree. The tree is a representation of the menus' hierarchy, where each menu have a parent and some child’s. Then the tree is traversed, checking each node access. When a node is allowed, it continues traversing each child’s. When a node is not allowed, it skips the node and all the child’s.

Now support YAML format for internal configuration file : axelor-config.properties can be in YAML format (yml or yaml ext). It should only have a one internal configuration file (in properties or YAML format).

External configuration file can be provided by using system properties (axelor.config=<path_to_file>) or using env variables (AXELOR_CONFIG=<path_to_file>). Same as the internal configuration file, it also supports YAML format.

The internal configuration file is now optional. Final properties are built using internal configuration file + external configuration file + env variable + system properties. If variables are redefined, they will take preferences over the previous values.

Configuration values can also be provided with system properties using axelor.config.<key>=value format. For example db.default.user becomes axelor.config.db.default.user.

Configuration values can also be provided with environment variables using AXELOR_CONFIG_<key>=value format, where <key> is underscored uppercase equivalent of the configuration key. For example db.default.user becomes AXELOR_CONFIG_DB_DEFAULT_USER.

Example usage:

and register the QuickMenu in module configuration :

We can now specify order on column names with ASC or DESC. Some examples:

We can also specify whether the index is unique.

This will replace and makes <unique-constraint ... /> obsolete in future.

jakarta.persistence.sharedCache.mode property in axelor-config.properties can be used to overwrite the shared-cache-mode from persistence.xml. It allow to enable/disable the shared cache mode (ie second-level cache).

In action-validate, if there is multiple info matching, only the first will be displayed on UI.

PostgreSQL JDBC driver 42.2.3+ introduce a change on how Timestamp are rounded : https://github.com/pgjdbc/pgjdbc/issues/1211

For example, 2018-06-03T23:59:59.999999999 is rounded to 2018-06-04 00:00:00 Previously 2018-06-03T23:59:59.999999999 was rounded to 2022-03-08 23:59:59.999

If nanoseconds is greater than 999999500 , value is now rounded. This is how PostgreSQL works :

The between operator used when searching on date/dateTime in UI have been updated to use >= and < operators instead.

Thread safe usage of JAXP API. Use XMLUtils to protect XML Parsers from XXE attacks but also disable external entity processing.

Use equalsInclude and equalsIncludeAll instead.

Use Query#fetchStream instead.

Domain models are generated in Java only.

Use ActionExecutor#newActionHandler(ActionRequest) instead

Use Context#getParent instead.

Use cacheable attribute instead.

Since dropping support of removable modules, this event is no more used.

Use WebUtils.issueRedirect instead.

Use setInfo instead.

Form widgets <notebook>, <break>, <group>, <portlet>, and <include> are deprecated. cols and colWidths form attributes used for legacy form layout are also deprecated. Those have be removed. Use panel layout instead.

The feature is not used by any axelor apps and has many technical issues.

Run following SQL script to drop unnecessary columns