7.4 Migration Guide

In this document, we will see the major steps to migrate from 7.3 to 7.4.

Please check the change log for detailed list of fixes, changes and improvements introduced in 7.4

Axelor Enterprise edition usage

Usage of the enterprise edition of the platform is evolving: it is no longer a matter of a single com.axelor:axelor-enterprise-edition module to rely on.

To use enterprise edition, remove the dependency com.axelor:axelor-enterprise-edition and add the property axelor.platform.ee = true in your gradle.properties. This will automatically update your dependencies to use the required and right EE modules.

It also brings new features such as studio and advance import/export.

Database changes

Run following SQL script to adjust auth_permission and meta_permission_rule tables changes :

ALTER TABLE auth_permission ADD COLUMN can_import boolean;
ALTER TABLE meta_permission_rule ADD COLUMN can_import boolean;

This is used only by enterprise edition for the moment to fine-grained data import permissions support.

CORS filter hardened

This change is shipped in the 7.4.14 patch release.

If CORS is not enabled (cors.allow-origin not set, which is the default), no action is required.

Credentials are never allowed with *

When cors.allow-origin is *, the filter now sends a literal Access-Control-Allow-Origin: * and never sends Access-Control-Allow-Credentials, even if cors.allow-credentials is true. A warning is logged at startup when both are configured.

cors.allow-credentials now defaults to false

Previously, credentials were allowed by default. If your browser clients served from another origin rely on cookies, set cors.allow-credentials = true explicitly, together with an explicit list of origins.

cors.allow-origin is a list of exact origins

cors.allow-origin was previously evaluated as a regular expression. It is now a comma-separated list of exact origins (scheme://host[:port]), or *:

  • values are lowercased, and trailing slashes and default ports (:443 for https, :80 for http) are removed;

  • invalid entries, such as regular expressions or wildcard hosts (https://*.example.com), are ignored with a warning;

  • if no valid origin remains, all cross-origin requests are rejected with 403;

  • the null origin cannot be listed explicitly. It is only accepted with *, without credentials.

If you used a regular expression, replace it with the list of origins it was meant to match.

If you use OpenID Connect or SAML with response-mode = form_post (or the SAML POST binding) and an explicit cors.allow-origin list, also list the origin of your identity provider. Otherwise, its form post to the callback URL is rejected with 403.